Common Preparation Steps for Creating Windows Images for Horizon on AWS

Before importing or creating a Windows image into Amazon Web Services (AWS), you must complete a set of common preparation steps. These steps apply to all supported image import methods and ensure that your environment, permissions, and source image are ready for use with AWS EC2 Image Builder.

This topic provides a high-level overview of what the preparation involves and points you to the detailed topics for each task.

What This Preparation Covers

The common preparation steps help you ensure that:

• You are using a supported Windows ISO image
• The ISO is available to AWS services during the image build process
• Required permissions are in place for EC2 Image Builder
• The infrastructure used during image builds is properly defined

Completing these steps upfront helps avoid failures later in the image import and build process in AWS.

Preparation Tasks

Complete the following preparation tasks in order before proceeding with any image import method:

• 1 - Obtain a supported Windows ISO for Horizon on AWS
• 2 - Upload a Windows ISO to an Amazon S3 bucket
• 3 - Create an IAM role for EC2 Image Builder
• 4 - Create an EC2 Image Builder Infrastructure configuration

1 - Obtain the Windows ISO

To import and prepare a Windows desktop image for use with Horizon Cloud and AWS image workflows, you must first obtain a supported Windows ISO (International Organization for Standardization) image. This ISO serves as the installation media used during the image creation and import process.

Ensure that the Windows ISO you download matches the versions supported by your AWS and Horizon Cloud environment.

Supported Windows versions

Ensure that your virtual machine uses one of the following supported versions:

• Windows 11 Enterprise 23H2
• Windows 11 Enterprise 22H2

Procedure

Use the following steps to obtain the Windows ISO file.

1. Download the Windows ISO from Microsoft

   Download the Windows ISO directly from the official Microsoft website to ensure authenticity and integrity of the installation media.

2. Verify the supported Windows version

   Confirm that the ISO corresponds to one of the supported Windows versions listed above before proceeding.

2 - Upload the Windows ISO to an Amazon S3 Bucket

After obtaining a supported Windows ISO, you must upload the ISO file to an Amazon Simple Storage Service (Amazon S3) bucket. The S3 bucket acts as a secure and accessible location for the ISO during the AWS image import and image creation workflows.

AWS Image Builder uses the ISO stored in the S3 bucket as installation media when creating the custom Windows image.

Procedure

Use the following steps to upload the Windows ISO file to an Amazon S3 bucket.

1. Create or select an Amazon S3 bucket

   From the AWS Management Console, create a new Amazon S3 bucket or use an existing bucket that is accessible to AWS Image Builder. For detailed instructions, see the AWS documentation: Creating a general purpose bucket.

2. Upload the Windows ISO file to the S3 bucket

   Upload the Windows ISO file to the selected S3 bucket. For detailed instructions, see the AWS documentation: Upload folders and files to an S3 bucket.

   Important: The ISO file extension must be in uppercase (for example, Windows11.ISO).

3 - Create an IAM Role for EC2 Image Builder

To allow EC2 Image Builder to access required AWS resources during the image creation process, you must create an IAM (Identity and Access Management) role. This role is associated with the instance profile used by Image Builder during build and test phases.

Procedure

Use the following steps to create an IAM role for EC2 Image Builder.

1. Sign in to the AWS Management Console.

2. Navigate to IAM > Roles, and click Create role.

   

   

3. On the Selected trusted entity page, select AWS service as the trusted entity type, choose EC2 as the use case, and click Next.

   

4. On the Add permissions page, attach the following permission policies:

   

   • AmazonSSMManagedInstanceCore

     Allows Image Builder to communicate with and run automation on instances using AWS Systems Manager.

   • EC2InstanceProfileForImageBuilder

     Allows build instances to access required AWS resources, manage EC2 actions, and write logs during the image build process.

   • EC2InstanceProfileForImageBuilderECRContainerBuilds

     Required when Image Builder workflows include building or uploading container images to Amazon ECR.

5. Click Next.

6. On the Name, review, and create page, enter the following details:

   

   • Role Name – Enter a unique name for the IAM role.
   • Description – (Optional) Enter a description.

7. Click Create role.

   

4 - Create an EC2 Image Builder Infrastructure Configuration

This section describes how to create an Amazon EC2 Image Builder infrastructure configuration. The infrastructure configuration defines the AWS resources that EC2 Image Builder uses during the image build and test process, including compute, networking, and notification settings.

Procedure

Use the following steps to create an EC2 Image Builder infrastructure configuration that defines the compute, networking, and notification settings used during image build and test operations.

1. Sign in to the AWS Management Console and navigate to EC2 Image Builder.

   

2. In the navigation pane, under Saved resources, select Infrastructure configurations, and then click Create infrastructure configuration.

   

3. In the General section, provide the following information:

   • Name - Enter a unique name for the infrastructure configuration.

   • IAM role - Select the IAM role to associate with the instance profile for component permissions on the build and test instances. For more information, see Create IAM Policy and Roles.

     

     EC2 Image Builder uses these permissions to download and run components, upload logs to Amazon CloudWatch, and perform any additional actions specified in the image recipe.

4. In the AWS infrastructure section, configure the following settings:

   

   • Instance type - Specify one or more instance types to use for the image build. EC2 Image Builder selects one based on availability.

   • SNS topic - (Optional) Select an Amazon SNS topic to receive notifications and alerts them EC2 Image Builder.

     For example:

     • Instance type: c1.xlarge
     • SNS topic: aws-controltower-SecurityNotifications

5. Configure VPC, subnet, and security group settings. Image Builder uses your default VPC and subnet. For more information about configuring VPC interface endpoints, see Image Builder and AWS PrivateLink interface VPC endpoints.

   Important: If you do not supply values for the following settings, they use service-specific defaults, where applicable.

   • VPC – Select your VPC.

     Note: If no VPC exists, create a VPC. For more information, see Create a VPC.

   • Subnet ID

     • If using a public subnet, ensure that Auto-assign public IPv4 is enabled.
     • If using a private subnet, configure NAT Gateway and Internet Gateway.
     • Security groups – Select a security group that meets networking requirements.

   Ensure networking allows:

   • Outbound port 443
   • Network ACL:
     • Inbound: 1024-65535
     • Outbound: 443

   For detailed information, see Amazon documentation on IP address and port requirements for WorkSpaces Personal.

6. In other settings, leave Troubleshooting, Metadata, and Placement at their default values. Optionally, add Tags.

7. Click Create infrastructure configuration.