https://aws.amazon.com/blogs/aws/aws-verified-access-now-supports-secure-access-to-resources-over-non-https-protocols/ is this similar to Citrix Secure Private Access? Could we use this for only allowing certain users RDP access to specific servers in another AWS account / VPC from Workspaces Pools.

I actually have a call this evening with the author, I'll get back to you.

Yes, a colleague has developed a power shell script that reads the logged on user and adjusts the windows firewall, which might at a lot to logon times. Just wondering if AWS has a solution for it