Skip to content

(2026.06) VDIs are not assigned an SSH key pair at launch

Jump to bottom
Junbo Liang edited this page Aug 24, 2026 · 1 revision

Bug description

Newly launched virtual desktops (VDIs) are not assigned an SSH key pair. For Windows VDIs, this prevents users from retrieving the administrator password via the EC2 console ("Get Windows Password" feature). For Linux VDIs, SSH access using the key pair is unavailable.

Affected versions

2026.06

Mitigation

Tip: We recommend running the following commands in AWS CloudShell in the same account and region where RES is deployed. CloudShell comes with pre-installed dependencies and helps eliminate other local environment conditions that may affect the patching process.

  1. Set up a Python 3.12 virtual environment and install all dependencies:
sudo yum install -y python3.12 
python3.12 -m venv /tmp/patch-env 
source /tmp/patch-env/bin/activate
pip install boto3
  1. Create an S3 bucket with ACLs disabled. If you already have an S3 bucket with ACLs disabled, you can skip this step. Otherwise, create one using either the console or the CLI:
    1. Option A (AWS Console):
      1. Follow the Creating a bucket guide in the Amazon S3 User Guide. When configuring the bucket:
      2. Enter a bucket name and select the region where RES is deployed
      3. Under Object Ownership, keep the default setting ACLs disabled (Bucket owner enforced)
      4. Configure the remaining settings as needed (block public access, versioning, etc.)
      5. Click Create bucket
    2. Option B (CLI):
      1. Replace <BUCKET-NAME> and <res-environment-aws-region> with your values and run the command:
aws s3api create-bucket \
    --bucket <BUCKET-NAME> \
    --region <res-environment-aws-region> \
    --create-bucket-configuration LocationConstraint=<res-environment-aws-region> \
    --object-ownership BucketOwnerEnforced

Note: If your region is us-east-1, omit the --create-bucket-configuration parameter.

  1. Download res_lambda_tool_2026.06.py and updated function code for version 2026.06 by replacing <output-directory> with the directory to download the patch script, <environment-name> with the name of your RES environment, <bucket-name> with the name of a ACLs disabled S3 bucket under the account/region where RES is deployed, and <partition> with Classic or GovCloud:
    1. The patch applies to 2026.06
    2. Configure the AWS CLI for the account / region where RES is deployed, and make sure that you have Lambda permissions to update function code.
OUTPUT_DIRECTORY=<output-directory>
ENVIRONMENT_NAME=<environment-name>
PARTITION=<partition>
BUCKET_NAME=<bucket-name>
 
mkdir -p ${OUTPUT_DIRECTORY}
curl https://research-engineering-studio-us-east-1.s3.us-east-1.amazonaws.com/releases/2026.06/patch_scripts/res_lambda_tool_2026.06.py  --output ${OUTPUT_DIRECTORY}/res_lambda_tool_2026.06.py

curl https://research-engineering-studio-us-east-1.s3.us-east-1.amazonaws.com/releases/2026.06/patch_scripts/patches/backend-lambda-c4326583.zip --output ${OUTPUT_DIRECTORY}/backend-lambda-c4326583.zip
  1. Update the lambda function code by running the following patch command by replacing <environment-name> with the RES environment name, and <cloudformation-root-stack-name> with the root RES environment CloudFormation stack name:
ENVIRONMENT_NAME=<environment-name>
STACK_NAME=<cloudformation-root-stack-name>

python3 ${OUTPUT_DIRECTORY}/res_lambda_tool_2026.06.py --zip-file ${OUTPUT_DIRECTORY}/backend-lambda-c4326583.zip --lambda-name ${ENVIRONMENT_NAME}-backend-lambda --s3-bucket ${BUCKET_NAME}

Once the patches have been applied, the Last modified attribute of the Lambda function should be recent, and newly launched VDIs will have the SSH key pair assigned correctly.

Rollback

The patch scripts saved the original lambda function code within the S3 bucket you provided. To rollback, re-run the exact commands from the patching step with an extra --rollback flag.

  1. If you are running this in a new terminal session, make sure to set up the variables again:
OUTPUT_DIRECTORY=<output-directory>
ENVIRONMENT_NAME=<environment-name>
PARTITION=<partition>
BUCKET_NAME=<bucket-name>
STACK_NAME=<cloudformation-root-stack-name>

python3 ${OUTPUT_DIRECTORY}/res_lambda_tool_2026.06.py --zip-file ${OUTPUT_DIRECTORY}/backend-lambda-c4326583.zip --lambda-name ${ENVIRONMENT_NAME}-backend-lambda --s3-bucket ${BUCKET_NAME} --rollback

Clone this wiki locally