Warm AMI hands out no Administrator password — EC2Launch not re-armed before imaging (GetPasswordData: "Password is not available") #153

Report (from a Windows 11 deploy tester)

The spawn image import warm-AMI build finished and launching an instance from the warm AMI works — but spawn connect win11-test --rdp can't retrieve the Administrator password:

Retrieving Windows Administrator password (this can take a few minutes after launch)...
could not get Windows password data (instance may still be on first boot):
password data not available within 12m0s (Windows still generating it?)

The EC2 console's Get Windows password shows the same thing:

Password is not available. The instance was launched from a custom AMI, or the default password has changed. A password cannot be retrieved for this instance.

Root cause

EC2Launch v2 generates the retrievable Administrator password via its setAdminAccount task, which runs once (frequency once, gated by a run-once marker). The warm-AMI build (#98, buildWarmAMI in cmd/image.go) launches a seed, waits for the password to become available as its "first boot done" gate, then images the seed — but never clears that run-once state. So the captured warm AMI carries "already specialized / password set" state, and GetPasswordData on every launch from it returns "Password is not available." Both spawn connect --rdp and the console hit the same EC2 API, so both fail identically.

Fix

Before CreateAMI, run EC2Launch's re-arm over SSM:

& "$Env:ProgramFiles\Amazon\EC2Launch\EC2Launch.exe" reset -c

reset -c clears the run-once state (+ instance logs) so setAdminAccount runs again on the warm AMI's next boot, without generalizing (Sysprep) — keeping the deliberate non-generalized single-instance warm image (#98). It doesn't shut the instance down, so we image right after. The image is taken with NoReboot:true so the snapshot captures the re-armed (not-yet-run) state — a reboot during imaging would let the seed consume the run-once task before capture. (Verified against AWS EC2Launch v2 docs.)

To run the reset we now require the seed's SSM agent to come Online (previously best-effort) and fail the warm build loudly if it doesn't — a warm AMI that can't hand out a password is worse than a slow base AMI.

Fix in progress.