Deploy RC-Scanner on AWS

^{Last updated: 2026-10-01}

Purpose

This article describes how to deploy RC-Scanner as a virtual appliance in AWS.

Introduction

AWS cannot boot an ISO image directly. The RC-Scanner ISO must first be installed in a virtual machine and converted into a supported virtual disk image. This guide uses Microsoft Hyper-V to prepare the disk and AWS CLI to upload and import it.

The deployment consists of five phases:

1. Prepare the RC-Scanner VHD in Hyper-V.

2. Upload the VHD to an Amazon S3 bucket.

3. Import the VHD as an EC2 AMI.

4. Launch and validate an EC2 instance.

5. Connect over SSH and change the default password.

6. Complete the RC-Scanner bootstrap.

Prerequisites

• Access to the latest RC-Scanner ISO from the OUTSCAN Portal under Configurations → RC SCANNER.

• Microsoft Hyper-V and permission to create and manage virtual machines.

• Windows PowerShell access.

• An account for your organization's AWS access portal, such as https://<yourcompany>.awsapps.com/start/.

• AWS CLI version 2 installed and available in PowerShell.

• Permission to use Amazon S3, Amazon EC2, and AWS Identity and Access Management (IAM).

• An existing vmimport IAM role, or access to an AWS administrator who can create or update it.

• Network access for SSH and the RC-Scanner communication ports.

Review the applicable RC-Scanner system requirements and sizing guidance before selecting the EC2 instance type.

Phase 1: Prepare the VHD in Hyper-V

The AWS VM Import process requires a supported virtual disk format. This procedure creates a Generation 2 Hyper-V VM, installs RC-Scanner from the ISO, and converts its disk to a fixed VHD.

Create the Virtual Machine

To create a Virtual Machine:

1. Download the latest RC-Scanner ISO from the OUTSCAN Portal.

2. Open Hyper-V Manager.

3. Select New → Virtual Machine.

4. Configure the VM with the following settings:

5. Finish the wizard to create the VM.

Configure Secure Boot

To configure a secure boot:

1. Right-click the new VM and select Settings.

2. Select Security.

3. Ensure Enable Secure Boot is selected.

4. Set the template to Microsoft UEFI Certificate Authority.

5. Select Apply, then OK.

Run the Installation

The installation is fully automatic and sets up the Debian base operating system and RC-Scanner packages unattended.

To run the installation:

1. Right-click the VM and select Start.

2. Open the VM console by selecting Connect.

3. Allow the installer to run.

4. Wait for the VM to shut down when installation is complete.

5. Start the VM again and confirm that it reaches the login prompt.

6. Shut down the VM before converting the disk.

Convert the Disk to a Fixed VHD

PowerShell

Open PowerShell as Administrator and run:

Convert-VHD -Path "C:\Path\To\RC-Scanner-Prep.vhdx" -DestinationPath "C:\Path\To\RC-Scanner-AWS.vhd" -VHDType Fixed

Hyper-V Manager

1. Select Edit Disk….

2. Locate the Hyper-V .vhdx file.

3. Select Convert.

4. Choose VHD as the disk format.

5. Choose Fixed size as the disk type.

6. Select the destination path and complete the wizard.

Use the resulting RC-Scanner-AWS.vhd file in the next phase.

Phase 2: Upload the VHD to Amazon S3

Install and Verify AWS CLI

In PowerShell, run:

aws --version

If PowerShell reports that aws is not recognized, install AWS CLI v2 for Windows from AWS Command Line Interface. Close all PowerShell windows, open a new one, and run the version command again.

If the command still fails, check whether the executable exists:

Test-Path "C:\Program Files\Amazon\AWSCLIV2\aws.exe"
& "C:\Program Files\Amazon\AWSCLIV2\aws.exe" --version

Configure AWS Credentials

To configure AWS credentials:

1. Open your organization's AWS access portal.

2. Select Accounts, then open the appropriate AWS account.

3. Select Access keys.

4. Use the PowerShell instructions to obtain the access key ID, secret access key, and session token.

5. Configure the AWS CLI:

   PowerShell

   aws configure
   

6. Verify the credentials:

   PowerShell

   aws sts get-caller-identity
   aws s3 ls
   

Create the S3 Bucket

To create a S3 bucket:

1. Choose a globally unique bucket name and create it:

   PowerShell

   aws s3 mb s3://<bucket-name>;
   

2. Verify that the bucket exists:

   PowerShell

   aws s3 ls
   

Upload the VHD

To upload the VHD:

1. Locate the generated VHD, then upload it to the bucket:

   PowerShell

   aws s3 cp `
   "C:\Path\To\RC-Scanner-AWS.vhd" `
   "s3://<bucket-name>/"
   

2. Verify the object and its size:

   PowerShell

   aws s3 ls s3://<bucket-name>/
   

Phase 3: Import the VHD as an AMI

Verify EC2 import access

In the AWS CLI run:

aws ec2 describe-import-image-tasks

An empty ImportImageTasks result is acceptable.

Verify the vmimport Role

In the AWS CLI run:

aws iam get-role --role-name vmimport

The command should return a role named vmimport.

If the role does not exist, contact an AWS administrator.

Verify the vmimport Policy

In the AWS CLI run:

aws iam get-role-policy `
--role-name vmimport `
--policy-name vmimport

The policy must allow the import service to read the S3 bucket and register the imported image. If the policy does not include the bucket, an AWS administrator can update it with a policy similar to the following:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:GetObject",
        "s3:ListBucket",
        "s3:GetBucketAcl"
      ],
      "Resource": [
        "arn:aws:s3:::<bucket-name1>",
        "arn:aws:s3:::<bucket-name1>/*"
        "arn:aws:s3:::<bucket-name2>",
        "arn:aws:s3:::<bucket-name2>/*"
        "arn:aws:s3:::<your-new-bucket>",
        "arn:aws:s3:::<your-new-bucket>/*"        
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:ModifySnapshotAttribute",
        "ec2:CopySnapshot",
        "ec2:RegisterImage",
        "ec2:Describe*"
      ],
      "Resource": "*"
    }
  ]
}

Save the approved policy as C:\Temp\vmimport-policy.json and apply it:

aws iam put-role-policy `
--role-name vmimport `
--policy-name vmimport `
--policy-document file://C:\Temp\vmimport-policy.json

Create the Disk Container Definition

Create C:\Temp\containers.json:

[
  {
    "Description": "RC Scanner VM",
    "Format": "VHD",
    "UserBucket": {
      "S3Bucket": "<bucket-name>",
      "S3Key": "RC-Scanner-AWS.vhd"
    }
  }
]

Start the Import

In the AWS CLI run:

aws ec2 import-image `
--description "RC Scanner VM" `
--disk-containers file://C:\Temp\containers.json

Save the returned ImportTaskId. You need it to monitor the conversion.

Monitor the Import

In the AWS CLI run:

aws ec2 describe-import-image-tasks `
--import-task-ids import-ami-<task-id>

When the import completes, the response includes an AMI identifier similar to:

{
  "Status": "completed",
  "ImageId": "ami-xxxxxxxxxxxxxxxxx"
}

Phase 4: Launch and Validate the EC2 Instance

Locate the AMI

To locate the AMI:

1. Open the AWS access portal and enter the appropriate account.

2. Open the AWS Management Console with the required administrative role.

3. Open EC2.

4. Confirm that the selected AWS region matches the region used for the S3 bucket and import.

5. Open Images → AMIs.

6. Locate the AMI created during the import.

7. Give the AMI a descriptive name and record its AMI ID.

Configure and Launch the Instance

To configure and launch the instance:

1. Select the AMI and choose Launch instance from AMI.

2. Enter a descriptive instance name.

3. Select an instance type that meets the RC-Scanner sizing requirements.

4. Select an existing EC2 key pair. Create or import one if required.

5. Under Network settings, select the required VPC and subnet.

6. Enable automatic public IP assignment if the instance must be reached directly over the internet.

7. Configure security group rules according to the approved RC-Scanner firewall requirements.

8. Allocate 30 GB of storage, or the amount required by the approved sizing guidance.

9. Launch the instance.

Validate the Instance

To validate the instance:

1. Open EC2 → Instances.

2. Confirm that the instance state is Running.

3. Confirm that all displayed status checks have passed.

4. Record the public IPv4 address, if one is assigned.

5. From PowerShell, test SSH connectivity:

Test-NetConnection <public-ip> -Port 22

Phase 5: Connect over SSH

Connect and Change the Default Password

To change the default password:

1. Use an SSH client or terminal to connect:

   Bash

   ssh rcscanner@<public-ip>
   

2. Use the following initial account details:
   Username: rcscanner
   Default password: outpost24

3. At first login, change the default password immediately.

4. Enter the default password when prompted, then provide and confirm a new password.

5. Store the new credential according to your organization's password-management policy.

Phase 6: Complete Bootstrap Registration

Retrieve the One-time Bootstrap Token

To retrieve the token:

1. Sign in to the OUTSCAN Portal.

2. Open Configurations → RC SCANNER.

3. Select the green + button.

4. Select Continue.

5. Copy the displayed one-time token.

Run the Bootstrap

To run the bootstrap:

1. Run the following command in the SSH session:

   Bash

   rc-scanner-bootstrap --token <your-token>
   

2. For unattended setup, use:

   Bash

   rc-scanner-bootstrap --token <your-token> --headless
   

3. During an interactive installation, follow the prompts and press F3 when requested.

Verify Registration

To verify the registration:

1. Return to Configurations → RC SCANNER in the OUTSCAN Portal.

2. Locate the new scanner.

3. Confirm that its status changes from Initializing to Connected.

4. Begin scanning only after the scanner shows as connected.

Troubleshooting

S3 access denied during import

Symptom: The import reports that the vmimport role is not authorized to perform s3:GetObject.

Cause: The role policy does not grant access to the bucket or object containing the VHD.

Resolution: Ask an AWS administrator to update the vmimport policy with access to the required bucket and object, then retry the import.

The vmimport role does not exist

Symptom: aws iam get-role --role-name vmimport returns NoSuchEntity.

Cause: The EC2 VM Import service role has not been created in the account.

Resolution: Contact an AWS administrator to create the role and its required trust and permissions policies.

Unsupported kernel version

Symptom: The import fails with an error such as Unsupported kernel version.

Cause: The kernel included in the RC-Scanner ISO is not supported by the AWS import process.

Resolution: Confirm whether a newer AWS-compatible RC-Scanner image is available. If not, escalate to the appropriate product or platform owner for guidance on a supported image.

The AWS CLI command is not recognized

Symptom: PowerShell reports that aws is not recognized.

Resolution: Install AWS CLI v2, close existing PowerShell windows, open a new session, and verify the executable path and PATH configuration.

SSH connectivity fails

Symptom: SSH connection fails.

Resolution: Check the following

• Confirm that the EC2 instance is running and status checks have passed.

• Confirm that the public IPv4 address is current.

• Confirm that TCP port 22 is allowed from the source network.

• Confirm that the correct key pair and username are being used.

• Use Test-NetConnection <public-ip> -Port 22 to isolate network reachability.