Desktop and Application Streaming
How to automate Amazon AppStream 2.0 image deployment
In a previous blog, we looked at how to schedule managed image updates for Amazon AppStream 2.0 using AWS serverless services. In this blog, we describe how to automate the deployment of AppStream 2.0 images to existing fleets. By creating the automated deployment workflow, we can schedule the update of the fleets during off hours, or at a scheduled time. This automation reduces the maintenance overhead, and end-user impact to updates.
Overview
You will configure an image deployment workflow that updates fleets with an image at a defined maintenance window. Every time an AppStream 2.0 resource is tagged, Amazon EventBridge starts an AWS Lambda function. This function checks the key-value and, if needed, manages the image update process. Administrators are notified of pending image releases using Amazon Simple Email Service. The process uses an Amazon Step Function state machine to deploy the image and any scaling actions during the next defined maintenance window.
When the maintenance window is reached, the state machine runs the Lambda function again. This applies the image to the fleets it is tagged with. The fleets can be scaled down and returned to the state machine to wait by using a tag. The state machine retries the Lambda function until the fleets reach zero available instances, and then it returns the scaling targets values. Administrators are notified the image deployment is complete.
Walkthrough
In this walk-through, you perform the following tasks:
- Create an IAM Policy.
- Create an IAM Role.
- Create an AWS Lambda function.
- Create an AWS Step Functions state machine.
- Create Amazon EventBridge rule.
Prerequisites
Make sure you meet the following requirements before getting started:
- An AWS account
- AWS CloudTrail configured for the account
- A verified Amazon SES email address
- An existing Amazon AppStream 2.0 environment
Step 1. Create the IAM Policy
In this step, we create an IAM Policy, and attach it to an IAM Role that the Lambda function can assume.
- Navigate to the IAM console.
- In the navigation pane, choose Policies.
- Choose Create policy.
- Choose the JSON tab.
- Copy and paste the following JSON policy.
- When you’re done, choose Review policy.
- Enter a name of your choosing.
- Choose Create policy.
IAM Policy document example:
Step 2. Create an IAM Role
Now that the IAM Policy has been created, create the IAM Role for Lambda to assume, and attach the policy you created in step 1.8.
- Open the IAM console.
- In the navigation pane, choose Roles.
- Choose Create role.
- For Select type of trusted entity, keep AWS service selected.
- Choose Lambda, and then choose Next: Permissions.
- In the filter policies search box, type name of the policy created in the previous step. When the policy appears in the list, select the check box next to the policy name.
- Choose Next: Tags. Although you can specify a tag for the policy, a tag is not required.
- Choose Next: Review.
- Enter a name for your Role to help you identify it.
- Choose Create role.
Step 3. Create a Lambda function
In this step, we create our Lambda function that verifies the tagging, apply the image, and scale the fleet in, and back out.
- Open the Lambda console
- Choose Create function.
- Enter a meaningful name in Function name.
- Select Python 3.8 as the Runtime.
- Expand the permissions section, select Use an existing role, and from the list select the role created in step 2.
- Choose Create function.
- Under the Function code section, replace the placeholder text with the following code.
- Replace the following values in the code with your own:
- Replace <verified_ses_email_address> with your verified email address in Amazon SES.
- Replace <address_to_notify> with the email address you would like to notify of image deployments.
- Replace <numerical-day-of-the-week> with the numerical day of the week, starting with Monday as 0. Remember that the time is in UTC.
- Replace <start-time> with string time to start the image change in the format hh:mm:ss. Remember that the time is in UTC.
- The value for <State-Machine-Arn> is not known yet. You update this value in a later step.
- Choose Save.
- Make a note of the Lambda ARN for the next step.
Step 4. Create state machine
In this step, you create a state machine that coordinates the multiple executions of our Lambda function.
- Open the AWS Step Functions console.
- Do one of the following:
- If you haven’t created any state machines functions, a Getting Started page displays. Choose Getting Started, and then choose State Machines.
- If you have created a state machines function, in the upper right corner of the State machines page, choose Create state machine.
- On the Define State Machine page, keep Author from code snippet selected.
- In the Type section, keep Standard selected.
- In the State machine definition section, delete the placeholder code and paste the code that follows in the edit window.
- Replace <Lambda_Arn> in two places with the ARN recorded in the previous step.
- Choose Next.
- For Name, enter a meaningful name for identification later.
- Keep the rest of the options as default.
- Choose Create state machine.
- Note the state machine ARN for the next step.
Step 5. Modify the AWS Lambda function
In this step, you come back to the Lambda function created in step 2 to update the state machine ARN.
- Open the Lambda console
- Select the function created in step 2.
- Replace <State-Machine-Arn> with the ARN of the state machine noted in the previous step.
- Choose Save.
Step 6. Create Amazon EventBridge rule
In this step, you create an EventBridge rule to trigger a Lambda function. The rule triggers each time there is a CloudTrail event for tagging an AppStream 2.0 resource.
- Open the EventBridge console.
- Choose Create rule.
- Enter a Name, and optionally a Description.
- Select Event pattern, and then Custom pattern.
- Enter JSON that follows into the Event pattern box.
- Choose Save next to the Event pattern box.
- Under Select targets, select Lambda function, then select the function you created in the step 2.
- Choose Create.
Clean up
To avoid incurring future charges, remove the resources that you created. Delete the EventBridge rule, Lambda function, state machine, IAM Policy and IAM Role.
Conclusion
You have configured an image deployment workflow that updates fleets with an image at a defined maintenance window. The Amazon EventBridge rule triggers the AWS Lambda function each time an AppStream 2.0 resource is tagged. If the tag key is FleetName, and the fleet listed in the value exists in the account, the step functions state machine is started. At the defined maintenance window time, the state machine triggers the Lambda function to apply the image to the fleets. If the tag ScaleImmediately is set to True and the fleet is running, the scaling targets are set to zero. Finally, the state machine retries the Lambda function until the fleets reach zero available instances, and then sets the scaling targets back. The ScaleImmediately function is useful in environments where fleets are configured to use buffer of pre-created instances for new user sessions. When an updated image is applied, these buffer instances get the latest image when they are recreated.