Skip to content

Commit 4c96f08

Browse files
bpmctbpmct
committed
aws-linux: add RDP support and instructions
1 parent d6812e0 commit 4c96f08

File tree

2 files changed

+93
-51
lines changed

2 files changed

+93
-51
lines changed

‎examples/templates/aws-windows/README.md

Lines changed: 59 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,22 @@ tags: [cloud, aws]
66

77
# aws-windows
88

9+
## Connecting via RDP
10+
11+
You can connect to your workspace over a RDP tunnel. First, ensure
12+
you have the [Coder](https://coder.com/docs/coder-oss/latest/install) CLI installed on your local machine.
13+
14+
In a terminal session, open a tunnel with the RDP port:
15+
16+
```sh
17+
coder tunnel <workspace-name> --tcp 3301:3389
18+
```
19+
20+
With a RDP client on your local machine, connect to `127.0.0.1:3301`.
21+
22+
Username: Administrator
23+
Password: `see value on workspace page`
24+
925
## Getting started
1026

1127
To get started, run `coder templates init`. When prompted, select this template.
@@ -15,7 +31,7 @@ Follow the on-screen instructions to proceed.
1531

1632
This template assumes that coderd is run in an environment that is authenticated
1733
with AWS. For example, run `aws configure import` to import credentials on the
18-
system and user running coderd. For other ways to authenticate [consult the
34+
system and user running coderd. For other ways to authenticate [consult the
1935
Terraform docs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication-and-configuration).
2036

2137
## Required permissions / policy
@@ -25,48 +41,48 @@ instances provisioned by Coder:
2541

2642
```json
2743
{
28-
"Version": "2012-10-17",
29-
"Statement": [
30-
{
31-
"Sid": "VisualEditor0",
32-
"Effect": "Allow",
33-
"Action": [
34-
"ec2:GetDefaultCreditSpecification",
35-
"ec2:DescribeIamInstanceProfileAssociations",
36-
"ec2:DescribeTags",
37-
"ec2:CreateTags",
38-
"ec2:RunInstances",
39-
"ec2:DescribeInstanceCreditSpecifications",
40-
"ec2:DescribeImages",
41-
"ec2:ModifyDefaultCreditSpecification",
42-
"ec2:DescribeVolumes"
43-
],
44-
"Resource": "*"
45-
},
46-
{
47-
"Sid": "CoderResources",
48-
"Effect": "Allow",
49-
"Action": [
50-
"ec2:DescribeInstances",
51-
"ec2:DescribeInstanceAttribute",
52-
"ec2:UnmonitorInstances",
53-
"ec2:TerminateInstances",
54-
"ec2:StartInstances",
55-
"ec2:StopInstances",
56-
"ec2:DeleteTags",
57-
"ec2:MonitorInstances",
58-
"ec2:CreateTags",
59-
"ec2:RunInstances",
60-
"ec2:ModifyInstanceAttribute",
61-
"ec2:ModifyInstanceCreditSpecification"
62-
],
63-
"Resource": "arn:aws:ec2:*:*:instance/*",
64-
"Condition": {
65-
"StringEquals": {
66-
"aws:ResourceTag/Coder_Provisioned": "true"
67-
}
68-
}
44+
"Version": "2012-10-17",
45+
"Statement": [
46+
{
47+
"Sid": "VisualEditor0",
48+
"Effect": "Allow",
49+
"Action": [
50+
"ec2:GetDefaultCreditSpecification",
51+
"ec2:DescribeIamInstanceProfileAssociations",
52+
"ec2:DescribeTags",
53+
"ec2:CreateTags",
54+
"ec2:RunInstances",
55+
"ec2:DescribeInstanceCreditSpecifications",
56+
"ec2:DescribeImages",
57+
"ec2:ModifyDefaultCreditSpecification",
58+
"ec2:DescribeVolumes"
59+
],
60+
"Resource": "*"
61+
},
62+
{
63+
"Sid": "CoderResources",
64+
"Effect": "Allow",
65+
"Action": [
66+
"ec2:DescribeInstances",
67+
"ec2:DescribeInstanceAttribute",
68+
"ec2:UnmonitorInstances",
69+
"ec2:TerminateInstances",
70+
"ec2:StartInstances",
71+
"ec2:StopInstances",
72+
"ec2:DeleteTags",
73+
"ec2:MonitorInstances",
74+
"ec2:CreateTags",
75+
"ec2:RunInstances",
76+
"ec2:ModifyInstanceAttribute",
77+
"ec2:ModifyInstanceCreditSpecification"
78+
],
79+
"Resource": "arn:aws:ec2:*:*:instance/*",
80+
"Condition": {
81+
"StringEquals": {
82+
"aws:ResourceTag/Coder_Provisioned": "true"
6983
}
70-
]
84+
}
85+
}
86+
]
7187
}
7288
```

‎examples/templates/aws-windows/main.tf

Lines changed: 34 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -70,16 +70,38 @@ data "aws_ami" "windows" {
7070
}
7171

7272
resource "coder_agent" "main" {
73-
arch = "amd64"
74-
auth = "aws-instance-identity"
75-
os = "windows"
73+
arch = "amd64"
74+
auth = "aws-instance-identity"
75+
os = "windows"
76+
startup_script = <<EOF
77+
# Set admin password
78+
Get-LocalUser -Name "Administrator" | Set-LocalUser -Password (ConvertTo-SecureString -AsPlainText "${local.admin_password}" -Force)
79+
# To disable password entirely, see https://serverfault.com/a/968240
80+
81+
# Enable RDP
82+
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -value 0
83+
84+
# Enable RDP through Windows Firewall
85+
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
86+
87+
# Disable Network Level Authentication (NLA)
88+
# Clients will connect via Coder's tunnel
89+
(Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -ComputerName $env:COMPUTERNAME -Filter "TerminalName='RDP-tcp'").SetUserAuthenticationRequired(0)
90+
91+
# Install Chocolatey package manager
92+
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
93+
EOF
7694
}
7795

7896
locals {
97+
# Password to log in via RDP
98+
#
99+
# Must meet Windows password complexity requirements:
100+
# https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements#reference
101+
admin_password = "coderRDP!"
79102

80103
# User data is used to stop/start AWS instances. See:
81104
# https://github.com/hashicorp/terraform-provider-aws/issues/22
82-
83105
user_data_start = <<EOT
84106
<powershell>
85107
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
@@ -100,7 +122,6 @@ resource "aws_instance" "dev" {
100122
ami = data.aws_ami.windows.id
101123
availability_zone = "${var.region}a"
102124
instance_type = var.instance_type
103-
count = 1
104125

105126
user_data = data.coder_workspace.me.transition == "start" ? local.user_data_start : local.user_data_end
106127
tags = {
@@ -114,15 +135,20 @@ resource "aws_instance" "dev" {
114135
resource "coder_metadata" "workspace_info" {
115136
resource_id = aws_instance.dev.id
116137
item {
117-
key = "region"
138+
key = "Administrator password"
139+
value = local.admin_password
140+
sensitive = true
141+
}
142+
item {
143+
key = "Region"
118144
value = var.region
119145
}
120146
item {
121-
key = "instance type"
147+
key = "Instance type"
122148
value = aws_instance.dev.instance_type
123149
}
124150
item {
125-
key = "disk"
151+
key = "Disk"
126152
value = "${aws_instance.dev.root_block_device[0].volume_size} GiB"
127153
}
128154
}

0 commit comments

Comments
 (0)