[2025.06.01] Failure to assume S3 mount roles

When associating an S3 bucket with a RES project, the project's virtual desktop instances fail to mount the S3 bucket as the Cluster Manager and VDI components cannot assume the required IAM roles for S3 mounting, preventing the bucket from being accessible inside the instances.

2025.06, 2025.06.01

1. Download patch.py and project_policies.patch for version 2025.06 by replacing with the directory to download the patch script and patch file and with the name of your RES environment in the command below:
   1. The patch applies to RES 2025.06 and 2025.06.01
   2. The patch script requires AWS CLI v2, Python 3.9.16 or above, and Boto3.
   3. Configure the AWS CLI for the account / region where RES is deployed, and make sure that you have S3 permissions to write to the bucket created by RES.

OUTPUT_DIRECTORY=<output-directory>
ENVIRONMENT_NAME=<environment-name>
RES_VERSION=2025.06.01
PARTITION=<partition> # e.g. aws (for Classic), aws-us-gov (for GovCloud)
ACCOUNT_ID=<account-id>

mkdir -p ${OUTPUT_DIRECTORY}
curl https://research-engineering-studio-us-east-1.s3.amazonaws.com/releases/${RES_VERSION}/patch_scripts/patch.py --output ${OUTPUT_DIRECTORY}/patch.py
curl https://research-engineering-studio-us-east-1.s3.amazonaws.com/releases/${RES_VERSION}/patch_scripts/patches/s3_mount_credentials.patch --output ${OUTPUT_DIRECTORY}/s3_mount_credentials.patch

2. Navigate to the directory where the patch script and patch file are downloaded. Run the following patch commands (This will apply the patch to both cluster-manager and virtual-desktop modules):

python3 ${OUTPUT_DIRECTORY}/patch.py --environment-name ${ENVIRONMENT_NAME} --res-version ${RES_VERSION} --module cluster-manager --patch ${OUTPUT_DIRECTORY}/s3_mount_credentials.patch

python3 ${OUTPUT_DIRECTORY}/patch.py --environment-name ${ENVIRONMENT_NAME} --res-version ${RES_VERSION} --module virtual-desktop --patch ${OUTPUT_DIRECTORY}/s3_mount_credentials.patch

3. Restart the Virtual Desktop Controller instance for your environment. You may also terminate the instance from the Amazon EC2 Management Console.

INSTANCE_ID=$(aws ec2 describe-instances \
            --filters \
            Name=tag:Name,Values=${ENVIRONMENT_NAME}-cluster-manager \
            Name=tag:res:EnvironmentName,Values=${ENVIRONMENT_NAME}\
            --query "Reservations[0].Instances[0].InstanceId" \
            --output text)

aws ec2 terminate-instances --instance-ids ${INSTANCE_ID}

4. Verify the Cluster Manager instance status by checking the activity of the auto scaling group starting with the name -cluster-manager-asg . Wait until the new instance is launched successfully.

Note that if you have an already deployed VDI, it will not have the patch applied to it. The VDI will need to be recreated.