Skip to main content
Version: Developer

Configure AWS AutoScale for Kasm Workspaces on EC2

Overview​

Kasm Workspaces deployments on AWS often face workspace demand that rises and falls through the day. This guide configures AutoScale to provision and destroy EC2 agents automatically in response to that demand. The result is a deployment that meets peak demand while reducing the idle compute cost of standing capacity. AutoScale governs the full lifecycle, so administrators size the infrastructure once and let demand drive capacity.

Prerequisites​

Confirm the following before you begin:

  • A working Kasm Workspaces deployment with administrator access.
  • An AWS account with permission to manage IAM, VPC, and EC2 resources.
  • An AutoScale configuration in Kasm. Create one with AutoScale settings for an agent pool or AutoScale settings for a server pool.
  • Familiarity with zones and pools, which group Kasm services for geographical segmentation and group agents for load balancing.

Solution approach​

This guide progresses through the following phases:

  1. Prepare the AWS account and network.
  2. Configure the AWS VM provider in Kasm.
  3. Validate that provisioning and downscaling work.

Detailed steps​

Prepare the AWS account and network​

Kasm interfaces with AWS through an access key, which AWS issues to an IAM user. The steps below register that user, grant the required permissions, and build the network resources that EC2 agents need.

  1. Open the IAM service in the AWS portal.
AWS IAM service selection in the console
AWS IAM Selection
  1. Select Users under Access Management, then select Create User in the upper right.
Create User screen in AWS IAM
Create User
  1. Give the user a human-readable name, such as Kasm Workspaces.
  2. Select Attach policies directly, then select AmazonEC2FullAccess.
  3. Review the information and create the user.
  4. Create an access key for the user. From the list of users, select the new user.
  5. Select Create access key in the Summary section.
  6. Select the Third-party service use case, then create the access key.
  7. Copy the Access Key ID and the Secret Access Key for use in Kasm. AWS does not display the secret access key again.

Next, create an IAM role and the inline policy that lets the user pass that role to EC2.

  1. In IAM, select Roles under Access Management, then select Create Role.
  2. Select AWS Service with a use case of EC2.
  3. Add the permissions AmazonS3ReadOnlyAccess and AmazonSSMManagedInstanceCore.
  4. Enter a human-readable role name and description, then create the role.
  5. In IAM, select Users under Access Management, then select the user created earlier.
  6. In the Permissions policies section, open the Add permissions dropdown and select Create inline policy.
  7. In the Visual policy editor, select the IAM service.
  8. Under Actions allowed, expand Write and select PassRole.
  9. Under Resources, with Specific selected, select Add ARNs.
  10. Leave This account selected and enter the new role name in Resource Role Name with Path.
  11. Under Request conditions, select Add another condition.
  12. Select the condition iam:PassedToService.
  13. Select the operator StringEquals.
  14. Enter the value ec2.amazonaws.com, then select Add condition.
  15. Select Add more permissions.
  16. Select the IAM service.
  17. Under Actions allowed, expand Read and select GetInstanceProfile and GetRole.
  18. Under Resources, with Specific selected, select Add ARNs for each resource, the instance profile and the role.
  19. Leave This account selected and enter the role name in Resource Role Name with Path.
  20. Select Next, review, and create the policy.

Now build the network resources. Start with a Virtual Private Cloud to manage networking.

  1. In VPC, select Your VPCs under Virtual Private Cloud, then select Create VPC.
  2. Select VPC only and give the VPC a human-readable name tag.
  3. Enter an IPv4 CIDR, then select Create VPC.

Add a subnet inside the new VPC.

  1. In VPC, select Subnets under Virtual Private Cloud, then select Create Subnet.
  2. Select the new VPC.
  3. Give the subnet a human-readable name tag.
  4. Select the Availability Zone.
  5. Enter an IPv4 subnet CIDR block, then select Create Subnet.

Create a security group in EC2 to control inbound and outbound traffic.

  1. In EC2, select Security Groups under Network & Security, then select Create Security Group.
  2. Give the security group a human-readable name and description.
  3. Select the new VPC.
  4. Add inbound rules based on your needs. Common rules open destination ports 4902 for the Kasm Manager to send session and file commands, 443 for the Kasm Manager to reach agents securely, and 3389 for RDP access to agents.
  5. Add outbound rules based on your needs.

Configure the AWS VM provider in Kasm​

With the AWS resources in place, register the AWS VM provider config in Kasm. From an existing AutoScale configuration, open the All VM Provider Configs page, select Add, then select Add New in VM Provider Configs. Configure the following settings.

AWS Settings

AWS Settings
NameDescription
NameA name to use to identify the config.
AWS Access Key IDThe AWS Access Key used for the AWS API.
AWS Secret Access KeyThe AWS Secret Access Key used for the AWS API.
AWS: RegionThe AWS Region the EC2 Nodes should be provisioned in. e.g (us-east-1)
AWS: EC2 AMI IDThe AMI ID to use for the provisioned EC2 nodes. This should be an OS that is supported by the Kasm installer.
AWS: EC2 Instance TypeThe EC2 Instance Type (e.g t3.micro). Note the Cores and Memory override settings don't necessarily have to match the instance configurations. This is to allow for over provisioning.
AWS: Max EC2 NodesThe maximum number of EC2 nodes to provision regardless of the need for available free slots
AWS: EC2 Security Group IDsA Json list containg security group IDs to assign the EC2 nodes. e.g ["sg-065ae66f2d", "sg-02522kdkas"]
AWS: EC2 Subnet IDThe subnet ID to place the EC2 nodes in.
AWS: EC2 EBS Volume SizeSelect the root EBS volume size for the EC2 nodes. The admin console accepts Bytes/GiB and stores the value as bytes (aws_ec2_ebs_volume_size_bytes). API integrations must submit the number of bytes using whole GiB (2^30) increments.
AWS: EC2 EBS Volume TypeThe EBS Volume Type (e.g gp2)
AWS: EC2 IAMThe IAM to assign the EC2 Nodes. Administrators may want to assign CloudWatch IAM access.
AWS: EC2 Custom TagsA Json dictionary for custom tags to assigned on auto-scaled Agent EC2 Nodes. e.g {"foo":"bar", "bin":"baz"}
AWS: EC2 Startup ScriptWhen the EC2 Nodes are provision this script is executed. The script is responsible for installing and configuring the Kasm Agent.
Retrieve Windows VM Password from AWSWhen provisioning an AWS Windows VM Kasm can retrieve the password generated by AWS and store it in the Server configuration record created during the AutoScale provision. This will only happen if the Connection Password field from the attached AutoScale config is blank. When populated Kasm will use the defined value instead of what is returned from AWS. The Administrator may want to leave this field blank and disable retrieving the password from AWS if they wish the Kasm user to be presented with a login screen to manually enter credentials upon connecting to the Windows Workspace. NOTE: This setting only affects Windows (RDP connection type) AWS instances.
SSH KeysThe SSH Key pair to assign the EC2 node
AWS Config Override (JSON)Custom configuration may be added to the provision request for advanced use cases. Instance configuration is overridden in the 'instance_config' configuration block e.g. {"instance_config":{"EbsOptimized": true}} See EC2 Documentation for available options.
  1. Select AWS from the provider dropdown.
  2. Provide a name for the configuration.
  3. Enter the AWS Access Key ID and AWS Secret Access Key created during the AWS setup.
  4. Enter the region name. To list available regions, run the following command and use the RegionName column.
aws ec2 describe-regions --all-regions
  1. Enter the EC2 AMI ID for the image. Find this value in the AMI Catalog of the EC2 service.
  2. Enter the EC2 instance type. To list available instance types for the selected region, run the following command.
aws ec2 describe-instance-type-offerings \
    --location-type "availability-zone" \
    --filters "Name=location,Values=us-east-2a" \
    --region us-east-2 \
    --query "InstanceTypeOfferings[*].[InstanceType]" --output text | sort
  1. Enter the Max EC2 Nodes. This value caps the number of EC2 nodes this AutoScale configuration provisions.
  2. Enter the EC2 Security Group IDs created during the AWS setup as a JSON array.
  3. Enter the EC2 Subnet ID created during the AWS setup.
  4. Enter the EC2 EBS Volume Size required.
  5. Enter the EC2 EBS Volume Type required. The following types are supported.
Volume Type Name
gp3
gp2
io2
io1
st1
sc1
standard
  1. Enter the EC2 IAM role created during the AWS setup.
  2. Optionally provide additional tags for the VM. Use empty {} brackets if no additional tags are needed.
  3. For Windows deployments, provide an AutoScale PowerShell startup script. For complete Windows, Linux, and Docker Agent examples, see the AutoScale Startup Scripts in the Kasm Workspaces GitHub repository. Use PowerShell for Windows or Bash/cloud-init for Linux.
  4. Enter a Configuration Override as JSON. Use empty {} brackets if no override is needed.
  5. To use the default Administrator user and password created by AWS, toggle Retrieve Windows VM Password from AWS to true. This requires leaving Connection Password blank on the AutoScale details and setting Connection Username to Administrator.
  6. Enter an SSH private key. AWS requires this value even for Windows systems. Generate it in EC2 under Key Pairs in Network & Security.
  7. Submit the provider config.

Validate provisioning and downscaling​

After you submit the provider config, confirm that AutoScale provisions and removes agents as demand changes. Non-zero minimum available session values start provisioning immediately. Otherwise, launch enough workspaces to push resource utilization past your standby thresholds.

  1. Provision a workspace. Go to Workspaces > Registry and make multiple workspaces available.
  2. Open the Workspaces dashboard and launch enough workspace sessions to exceed your resource standby thresholds.
  3. Monitor new agents under Infrastructure > Agents.
  4. Verify the new EC2 instances in the AWS console.
  5. Confirm downscaling. Terminate sessions to reduce resource usage, then confirm that Kasm removes agents after the back-off period.

Common troubleshooting steps​

  • Agents fail to provision. Confirm the access key and secret are correct and that the IAM user holds AmazonEC2FullAccess and the PassRole inline policy.
  • EC2 instances start but agents stay unreachable. Confirm the security group opens ports 443 and 4902, and that the subnet routes to the Kasm Manager.
  • The instance type is rejected. Confirm the instance type is offered in the selected region with the describe-instance-type-offerings command above.
  • The role cannot be passed to EC2. Confirm the inline policy includes the iam:PassedToService condition set to ec2.amazonaws.com for the role.
  • Windows agents reject the connection. Confirm the credential approach matches the startup script or the Retrieve Windows VM Password from AWS toggle, and that port 3389 is open for RDP.