Skip to content

(2025.06) Project policies not propagating to VDIs

Jump to bottom
Mohjeet edited this page Jul 9, 2025 · 1 revision

Bug description

When creating a VDI using a project with policies configured, the role attached to the EC2 instance will not have any project policies applied.

Affected versions

2025.06

Mitigation

  1. Download patch.py and project_policies.patch for version 2025.06 by replacing <output-directory> with the directory to download the patch script and patch file and <environment-name> with the name of your RES environment in the command below:
    1. The patch applies to RES 2025.06
    2. The patch script requires AWS CLI v2, Python 3.9.16 or above, and Boto3.
    3. Configure the AWS CLI for the account / region where RES is deployed, and make sure that you have S3 permissions to write to the bucket created by RES.
OUTPUT_DIRECTORY=<output-directory>
ENVIRONMENT_NAME=<environment-name>
RES_VERSION=2025.06
PARTITION=<partition> # e.g. aws (for Classic), aws-us-gov (for GovCloud)
ACCOUNT_ID=<account-id>

mkdir -p ${OUTPUT_DIRECTORY}
curl https://research-engineering-studio-us-east-1.s3.amazonaws.com/releases/${RES_VERSION}/patch_scripts/patch.py --output ${OUTPUT_DIRECTORY}/patch.py
curl https://research-engineering-studio-us-east-1.s3.amazonaws.com/releases/${RES_VERSION}/patch_scripts/patches/project_policies.patch --output ${OUTPUT_DIRECTORY}/project_policies.patch
  1. Navigate to the directory where the patch script and patch file are downloaded. Run the following patch command:
python3 ${OUTPUT_DIRECTORY}/patch.py --environment-name ${ENVIRONMENT_NAME} --res-version ${RES_VERSION} --module virtual-desktop-controller --patch ${OUTPUT_DIRECTORY}/project_policies.patch
  1. Restart the Virtual Desktop Controller instance for your environment. You may also terminate the instance from the Amazon EC2 Management Console.
INSTANCE_ID=$(aws ec2 describe-instances \
            --filters \
            Name=tag:Name,Values=${ENVIRONMENT_NAME}-vdc-controller \
            Name=tag:res:EnvironmentName,Values=${ENVIRONMENT_NAME}\
            --query "Reservations[0].Instances[0].InstanceId" \
            --output text)

aws ec2 terminate-instances --instance-ids ${INSTANCE_ID}
  1. Verify the Virtual Desktop Controller instance status by checking the activity of the auto scaling group starting with the name <RES-EnvironmentName>-vdc-controller-asg . Wait until the new instance is launched successfully.
  2. Create a new managed policy based on the inline policy from the existing scoped down role.
ROLE_NAME="${ENVIRONMENT_NAME}-vdc-host-scoped-down-role"

POLICY_NAME=$(aws iam list-role-policies --role-name "$ROLE_NAME" --query 'PolicyNames[0]' --output text)
POLICY_DOCUMENT=$(aws iam get-role-policy --role-name "$ROLE_NAME" --policy-name "$POLICY_NAME" --query 'PolicyDocument' --output json)

SCOPED_POLICY_ARN=$(aws iam create-policy --policy-name "vdi-host-scoped-down-managed-policy" --policy-document "$POLICY_DOCUMENT" --query 'Policy.Arn' --output text)
  1. Update instance profile and policy being used within DynamoDB table. Run the following command.
aws dynamodb update-item \
    --table-name "${ENVIRONMENT_NAME}.cluster-settings" \
    --key '{"key":{"S":"vdc.dcv_host_instance_profile_arn"}}' \
    --update-expression "SET #val = :val" \
    --expression-attribute-names '{"#val":"value"}' \
    --expression-attribute-values '{":val":{"S":"arn:'${PARTITION}':iam::'${ACCOUNT_ID}':instance-profile/'${ENVIRONMENT_NAME}'-vdc-host-scoped-down-instance-profile"}}'

aws dynamodb update-item \
    --table-name "${ENVIRONMENT_NAME}.cluster-settings" \
    --key '{"key":{"S":"vdc.dcv_host_instance_profile_name"}}' \
    --update-expression "SET #val = :val" \
    --expression-attribute-names '{"#val":"value"}' \
    --expression-attribute-values '{":val":{"S":"'${ENVIRONMENT_NAME}'-vdc-host-scoped-down-instance-profile"}}'
    
aws dynamodb update-item \
    --table-name "${ENVIRONMENT_NAME}.cluster-settings" \
    --key '{"key":{"S":"cluster.iam.policies.dcv_host_role_managed_policy_arn"}}' \
    --update-expression "SET #val = :val" \
    --expression-attribute-names '{"#val":"value"}' \
    --expression-attribute-values '{":val":{"S":"'${SCOPED_POLICY_ARN}'"}}'

Once the patch has been applied and the Virtual Desktop Controller has launched successfully, all newly created VDIs will have project policies applied it its role.

Note that if you have already created a VDI with a project with policies attached, you'll need to delete the project in RES first, then remove the corresponding IAM role {env-name}-vdi-{project-name} from the IAM console before recreating the project to apply the updated policy configuration.

Clone this wiki locally
⌂ 换网址