Repository navigation
fix: re-arm EC2Launch before warm-AMI imaging so password is retrievable (#153) - #154
Merged
Merged
Conversation
…ble (#153) The warm-AMI build (#98) imaged the seed after EC2Launch had already run its one-time setAdminAccount task, so instances launched from the warm AMI returned "Password is not available. The instance was launched from a custom AMI..." for both `spawn connect --rdp` and the EC2 console. buildWarmAMI now runs `EC2Launch.exe reset -c` over SSM before CreateAMI, which clears EC2Launch's run-once state so setAdminAccount regenerates a retrievable Administrator password on the warm AMI's next boot — without generalizing (no Sysprep), keeping the non-generalized single-instance image. The image is captured with NoReboot:true so the re-armed (not-yet-run) state is preserved; a reboot during imaging would let the seed consume the run-once task first. Running the reset requires SSM, so the warm build now hard-requires the seed's SSM agent to come Online (was best-effort) and fails loudly otherwise — a warm AMI that can't hand out a password is worse than a slow base AMI. Verified the reset semantics against AWS EC2Launch v2 docs.
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #153. Reported by the Windows 11 deploy tester: warm AMI launches fine, but
spawn connect --rdpand the EC2 console can't retrieve the Administrator password ("Password is not available. The instance was launched from a custom AMI…").Root cause
EC2Launch v2 generates the GetPasswordData-retrievable Administrator password in its
setAdminAccounttask, which runs once (run-once marker). The warm-AMI build (#98) waits for that password as its "first boot done" gate, then images the seed — but never clears the run-once state. So the warm AMI carries "already specialized" state and every launch from it returns no password. CLI and console hit the same EC2 API → both fail.Fix
Before
CreateAMI,buildWarmAMInow runs over SSM:reset -cclears EC2Launch's run-once state (+ logs) sosetAdminAccountruns again on the warm AMI's next boot → fresh retrievable password per launch.resetdoesn't shut the instance down, so we image immediately after.NoReboot:true(wasfalse): a reboot during imaging would let the seed consume the just-re-armed run-once task before the snapshot captures it, defeating the re-arm.Running the reset needs SSM, so the warm build now hard-requires the seed's SSM agent to come Online (was best-effort, "image anyway") and fails loudly if it doesn't — a warm AMI that can't hand out a password is worse than a slow base AMI. The SSM wait uses the same generous
--warm-timeoutwindow.Verified
resetvssysprepsemantics against the AWS EC2Launch v2 docs (reset re-enables setAdminAccount without generalizing; doesn't shut down).Tests
TestEC2LaunchRearmCommandpins the command (usesreset, passes-c, the EC2Launch v2 path, and crucially does notsysprep). The orchestration itself is AWS-heavy (Tier 1/2 live).make checkgreen.Validation
Needs a live re-test by the tester: re-run
spawn image import(default warm) → launch the new warm AMI →spawn connect --rdpshould now retrieve + decrypt the password. (The previously-built warm AMI is still broken — it predates this fix — so a fresh import is required.)