Deploy RC-Scanner on AWS

Purpose

This article describes how to deploy RC-Scanner as a virtual appliance in AWS. It covers preparation of the installation image, upload to Amazon S3, import into Amazon EC2, instance configuration, SSH access, and bootstrap registration in the OUTSCAN Portal.

Introduction

AWS cannot boot an ISO image directly. The RC-Scanner ISO must first be installed in a virtual machine and converted into a supported virtual disk image. This guide uses Microsoft Hyper-V to prepare the disk and AWS CLI to upload and import it.

The deployment consists of five phases:

1. Prepare the RC-Scanner VHD in Hyper-V.

2. Upload the VHD to an Amazon S3 bucket.

3. Import the VHD as an EC2 AMI.

4. Launch and validate an EC2 instance.

5. Connect over SSH and complete the RC-Scanner bootstrap.

Prerequisites

• Access to the latest RC-Scanner ISO from the OUTSCAN Portal under Configurations → RC SCANNER.

• Microsoft Hyper-V and permission to create and manage virtual machines.

• Windows PowerShell access.

• An account for your organization's AWS access portal, such as https://<yourcompany>.awsapps.com/start/.

• AWS CLI version 2 installed and available in PowerShell.

• Permission to use Amazon S3, Amazon EC2, and AWS Identity and Access Management (IAM).

• An existing vmimport IAM role, or access to an AWS administrator who can create or update it.

• Network access for SSH and the RC-Scanner communication ports.

Review the applicable RC-Scanner system requirements and sizing guidance before selecting the EC2 instance type.

Phase 1: Prepare the VHD in Hyper-V

The AWS VM Import process requires a supported virtual disk format. This procedure creates a Generation 2 Hyper-V VM, installs RC-Scanner from the ISO, and converts its disk to a fixed VHD.

Create the virtual machine

1. Download the latest RC-Scanner ISO from the OUTSCAN Portal.

2. Open Hyper-V Manager.

3. Select New → Virtual Machine.

4. Configure the VM with the following settings:

5. Finish the wizard to create the VM.

Configure Secure Boot

1. Right-click the new VM and select Settings.

2. Select Security.

3. Ensure Enable Secure Boot is selected.

4. Set the template to Microsoft UEFI Certificate Authority.

5. Select Apply, then OK.

Run the unattended installation

1. Right-click the VM and select Start.

2. Open the VM console by selecting Connect.

3. Allow the installer to run. It installs the Debian base operating system and RC-Scanner packages automatically.

4. Wait for the VM to shut down when installation is complete.

5. Start the VM again and confirm that it reaches the login prompt.

6. Shut down the VM before converting the disk.

Convert the disk to a fixed VHD

AWS requires a fixed VHD for this workflow. Do not upload the dynamic .vhdx file.

PowerShell

Open PowerShell as Administrator and run:

Convert-VHD -Path "C:\Path\To\RC-Scanner-Prep.vhdx" -DestinationPath "C:\Path\To\RC-Scanner-AWS.vhd" -VHDType Fixed

Hyper-V Manager

1. Select Edit Disk….

2. Locate the Hyper-V .vhdx file.

3. Select Convert.

4. Choose VHD as the disk format.

5. Choose Fixed size as the disk type.

6. Select the destination path and complete the wizard.

Use the resulting RC-Scanner-AWS.vhd file in the next phase.

Phase 2: Upload the VHD to Amazon S3

Install and verify AWS CLI

In PowerShell, run:

aws --version

If PowerShell reports that aws is not recognized, install AWS CLI v2 for Windows from AWS Command Line Interface. Close all PowerShell windows, open a new one, and run the version command again.

If the command still fails, check whether the executable exists:

Test-Path "C:\Program Files\Amazon\AWSCLIV2\aws.exe"
& "C:\Program Files\Amazon\AWSCLIV2\aws.exe" --version

Configure AWS credentials

1. Open your organization's AWS access portal.

2. Select Accounts, then open the appropriate AWS account.

3. Select Access keys.

4. Use the PowerShell instructions to obtain the access key ID, secret access key, and session token.

5. Configure the AWS CLI:

aws configure

Verify the credentials:

aws sts get-caller-identity
aws s3 ls

Create the S3 bucket

Choose a globally unique bucket name and create it:

aws s3 mb s3://<bucket-name>;

Verify that the bucket exists:

aws s3 ls

Upload the VHD

Locate the generated VHD, then upload it to the bucket:

aws s3 cp `
"C:\Path\To\RC-Scanner-AWS.vhd" `
"s3://<bucket-name>/"

Verify the object and its size:

aws s3 ls s3://<bucket-name>/

Phase 3: Import the VHD as an AMI

Verify EC2 import access

aws ec2 describe-import-image-tasks

An empty ImportImageTasks result is acceptable.

Verify the vmimport role

aws iam get-role --role-name vmimport

The command should return a role named vmimport. If the role does not exist, contact an AWS administrator.

Verify the vmimport policy

aws iam get-role-policy `
--role-name vmimport `
--policy-name vmimport

The policy must allow the import service to read the S3 bucket and register the imported image. If the policy does not include the bucket, an AWS administrator can update it with a policy similar to the following:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:GetObject",
        "s3:ListBucket",
        "s3:GetBucketAcl"
      ],
      "Resource": [
        "arn:aws:s3:::<bucket-name1>",
        "arn:aws:s3:::<bucket-name1>/*"
        "arn:aws:s3:::<bucket-name2>",
        "arn:aws:s3:::<bucket-name2>/*"
        "arn:aws:s3:::<your-new-bucket>",
        "arn:aws:s3:::<your-new-bucket>/*"        
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:ModifySnapshotAttribute",
        "ec2:CopySnapshot",
        "ec2:RegisterImage",
        "ec2:Describe*"
      ],
      "Resource": "*"
    }
  ]
}

Save the approved policy as C:\Temp\vmimport-policy.json and apply it:

aws iam put-role-policy `
--role-name vmimport `
--policy-name vmimport `
--policy-document file://C:\Temp\vmimport-policy.json

Create the disk container definition

Create C:\Temp\containers.json:

[
  {
    "Description": "RC Scanner VM",
    "Format": "VHD",
    "UserBucket": {
      "S3Bucket": "<bucket-name>",
      "S3Key": "RC-Scanner-AWS.vhd"
    }
  }
]

Start the import

aws ec2 import-image `
--description "RC Scanner VM" `
--disk-containers file://C:\Temp\containers.json

Save the returned ImportTaskId. You need it to monitor the conversion.

Monitor the import

aws ec2 describe-import-image-tasks `
--import-task-ids import-ami-<task-id>

When the import completes, the response includes an AMI identifier similar to:

{
  "Status": "completed",
  "ImageId": "ami-xxxxxxxxxxxxxxxxx"
}

Phase 4: Launch and Validate the EC2 Instance

Locate the AMI

1. Open the AWS access portal and enter the appropriate account.

2. Open the AWS Management Console with the required administrative role.

3. Open EC2.

4. Confirm that the selected AWS region matches the region used for the S3 bucket and import.

5. Open Images → AMIs.

6. Locate the AMI created during the import.

7. Give the AMI a descriptive name and record its AMI ID.

Configure and launch the instance

1. Select the AMI and choose Launch instance from AMI.

2. Enter a descriptive instance name.

3. Select an instance type that meets the RC-Scanner sizing requirements.

4. Select an existing EC2 key pair. Create or import one if required.

5. Under Network settings, select the required VPC and subnet.

6. Enable automatic public IP assignment if the instance must be reached directly over the internet.

7. Configure security group rules according to the approved RC-Scanner firewall requirements.

8. Allocate 30 GB of storage, or the amount required by the approved sizing guidance.

9. Launch the instance.

Validate the instance

1. Open EC2 → Instances.

2. Confirm that the instance state is Running.

3. Confirm that all displayed status checks have passed.

4. Record the public IPv4 address, if one is assigned.

From PowerShell, test SSH connectivity:

Test-NetConnection <public-ip> -Port 22

Ping is not required for this test and may be blocked by the security group.

Phase 5: Connect and Complete Bootstrap

Connect over SSH

Use the instance public IPv4 address:

ssh rcscanner@<public-ip>

Use the following initial account details:

• Username: rcscanner

• Default password: outpost24

Change the password

At first login, enter the default password when prompted, then provide a new password. Store the new credential according to your organization's password-management policy.

Retrieve the one-time bootstrap token

1. Sign in to the OUTSCAN Portal.

2. Open Configurations → RC SCANNER.

3. Select the green + button.

4. Select Continue.

5. Copy the displayed one-time token.

Run the bootstrap

Run the following command in the SSH session:

rc-scanner-bootstrap --token <your-token>

For unattended setup, use:

rc-scanner-bootstrap --token <your-token> --headless

During an interactive installation, follow the prompts and press F3 when requested.

Verify registration

1. Return to Configurations → RC SCANNER in the OUTSCAN Portal.

2. Locate the new scanner.

3. Confirm that its status changes from Initializing to Connected.

4. Begin scanning only after the scanner shows as connected.

Troubleshooting