Windows Server on EC2: RDP, passwords and user data

Start as usual:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json

1Create an RSA key pair for Windows

Paste this whole block:

$key = aws ec2 create-key-pair --key-name saat-rsa --key-type rsa --key-format pem --tag-specifications 'ResourceType=key-pair,Tags=[{Key=course,Value=saatvedha-aws},{Key=lesson,Value=12}]' --query KeyMaterial --output text
[IO.File]::WriteAllText('C:\aws-lab\saat-rsa.pem', (($key -join "`n") + "`n"))
icacls C:\aws-lab\saat-rsa.pem /inheritance:r /grant:r "$($env:USERNAME):(R)"

2Find the Windows Server 2025 image

Run this:

$ami = aws ssm get-parameter --name /aws/service/ami-windows-latest/Windows_Server-2025-English-Full-Base --query Parameter.Value --output text
$ami

You should see an AMI ID, something like this:

ami-0e1f2a3b4c5d6e7f8

3Allow RDP from your IP only

Paste this whole block:

$myip = (Invoke-RestMethod https://checkip.amazonaws.com).Trim()
$rdpSg = aws ec2 create-security-group --group-name saat-rdp-temp --description "RDP from one admin IP (temporary)" --vpc-id $v.VpcId --tag-specifications 'ResourceType=security-group,Tags=[{Key=Name,Value=saat-rdp-temp},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=12}]' --query GroupId --output text
aws ec2 authorize-security-group-ingress --group-id $rdpSg --protocol tcp --port 3389 --cidr "$myip/32" | Out-Null

4Launch win01

Paste this whole block:

@'
<powershell>
Install-WindowsFeature Web-Server -IncludeManagementTools
Set-Content -Path C:\inetpub\wwwroot\index.html -Value '<h1>Hello from win01</h1>'
</powershell>
'@ | Set-Content C:\aws-lab\win01-userdata.txt
$id = aws ec2 run-instances --image-id $ami --instance-type t3.medium --key-name saat-rsa --subnet-id $v.PublicA --security-group-ids $v.WebSg $rdpSg --user-data file://win01-userdata.txt --metadata-options HttpTokens=required --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=win01},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=12},{Key=owner,Value=yourname.admin}]' 'ResourceType=volume,Tags=[{Key=course,Value=saatvedha-aws},{Key=lesson,Value=12}]' --query "Instances[0].InstanceId" --output text
aws ec2 wait instance-running --instance-ids $id
$ip = aws ec2 describe-instances --instance-ids $id --query "Reservations[0].Instances[0].PublicIpAddress" --output text
"$id  $ip"

Windows user data is fine with Windows line endings, so Set-Content is OK here.

5Wait for and decrypt the password

Paste this whole block (it checks every 30 seconds and usually finishes within 10 minutes):

do { Start-Sleep 30; $pw = aws ec2 get-password-data --instance-id $id --priv-launch-key C:\aws-lab\saat-rsa.pem --query PasswordData --output text } until ($pw)
if ($pw) { 'Password received' }

You should see this:

Password received

6Check the web page and the RDP port

Run this:

(Invoke-WebRequest "http://$ip" -UseBasicParsing).Content
Test-NetConnection $ip -Port 3389 -InformationLevel Quiet

You should see this (if the page isn’t there yet, IIS is still installing; wait two minutes):

<h1>Hello from win01</h1>
True

7Connect with Remote Desktop

Run this:

cmdkey /generic:$ip /user:Administrator /pass:$pw
mstsc /v:$ip

Accept the certificate warning (the server uses a self-signed certificate). In the remote session, open Windows PowerShell and run:

$t = Invoke-RestMethod -Method Put -Uri http://169.254.169.254/latest/api/token -Headers @{ 'X-aws-ec2-metadata-token-ttl-seconds' = '300' }
Invoke-RestMethod -Uri http://169.254.169.254/latest/meta-data/instance-type -Headers @{ 'X-aws-ec2-metadata-token' = $t }
Get-Service AmazonSSMAgent | Select-Object Status, Name

You should see something like this:

t3.medium

 Status Name
 ------ ----
Running AmazonSSMAgent

The SSM Agent is already installed and running on Amazon’s Windows AMIs. In Lesson 13 it will let you manage servers with no RDP port open at all.

✅ Checkpoint: win01 served “Hello from win01”, get-password-data gave you a password, and RDP worked from your IP. Keep win01 for the break lab; cleanup is at its end.