Skip to content

cfn

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

cfn

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
AlmaLinux-NICE-DCV.yaml
AlmaLinux-NICE-DCV.yaml
 
 
AmazonLinux2-NICE-DCV.yaml
AmazonLinux2-NICE-DCV.yaml
 
 
AmazonLinux2023-NICE-DCV.yaml
AmazonLinux2023-NICE-DCV.yaml
 
 
CentOS7-NICE-DCV.yaml
CentOS7-NICE-DCV.yaml
 
 
CentOSstream8-NICE-DCV.yaml
CentOSstream8-NICE-DCV.yaml
 
 
CentOSstream9-NICE-DCV.yaml
CentOSstream9-NICE-DCV.yaml
 
 
DLAMI-AL2023-NICE-DCV.yaml
DLAMI-AL2023-NICE-DCV.yaml
 
 
DLAMI-Ubuntu-NICE-DCV.yaml
DLAMI-Ubuntu-NICE-DCV.yaml
 
 
Debian-NICE-DCV.yaml
Debian-NICE-DCV.yaml
 
 
G4ad-CentOS7-NICE-DCV.yaml
G4ad-CentOS7-NICE-DCV.yaml
 
 
KaliLinux-NICE-DCV.yaml
KaliLinux-NICE-DCV.yaml
 
 
README.md
README.md
 
 
RHEL-NICE-DCV.yaml
RHEL-NICE-DCV.yaml
 
 
RockyLinux-NICE-DCV.yaml
RockyLinux-NICE-DCV.yaml
 
 
SLES-NICE-DCV.yaml
SLES-NICE-DCV.yaml
 
 
Ubuntu-NICE-DCV.yaml
Ubuntu-NICE-DCV.yaml
 
 
VPC-NICE-DCV.yaml
VPC-NICE-DCV.yaml
 
 
WIndowsServer-NICE-DCV.yaml
WIndowsServer-NICE-DCV.yaml
 
 

README.md

About CloudFormation templates

Notice

Operating systems such as AlmaLinux, Debian, Kali Linux, and those that have reached end of life are not supported by DCV and may not work.

Refer to DCV Requirements page for list of supported operating systems.

Requirements

  • EC2 instances must be provisioned in a subnet with outbound IPv4 internet connectivity
  • To use Amazon CloudFront, VPC DNS attributes enableDnsSupport and enableDnsHostnames must be enabled.

Above configuration are enabled in default VPC

Availability

  • Verify instance type Region and AZ availability.
  • Check the On-Demand Instance quota value of your desired instance type and request quota increase where necessary.
  • MarketPlace AMI (AlmaLinux, CentOS, Kali Linux, Rocky Linux): subscribe before using. Some Marketplace AMIs may only support specific instance types, visit the corresponding page to view available options.
  • Deep Learning AMI: verify Region availability before using. You can use AWS CLI command aws ssm get-parameters-by-path --recursive --path /aws/service/deeplearning/ami --region <REGION_CODE>). DLAMIs are not available if it returns aws/service/deeplearning is not a valid namespace error message.

License Agreement

Usage indicate license agreement acceptance of all software that is installed on EC2 instance, which include (but not limited to) the following

Deploying from CloudFormation console

Download <OS>-NICE-DCV.yaml CloudFormation file where <OS> is the desired operating system.

Login to AWS CloudFormation console.

Creating CloudFormation stack

To create CloudFormation stack, choose Create stack at top right of the Stacks page, and then choose With new resources (standard). Choose Upload a template file, click Choose File to select your downloaded .yaml file, and click Next. Enter a Stack name and specify parameters values.

CloudFormation Parameters

In most cases, the default values are sufficient. You will need to specify values for vpcID, subnetID and ec2KeyPair (Linux). For security reasons, configure ingressIPv4 and ingressIPv6 to your IP address.

You can use VPC-NICE-DCV.yaml to create a dual-stack public subnet

EC2

  • ec2Name : name of EC2 instance
  • ec2KeyPair (Linux) : EC2 key pair for SSH access. Create a key pair if you do not have one
  • osVersion (where applicable) : operating system version and processor architecture (Intel/AMD x86_64 or Graviton arm64). Default is latest version and arm64
  • imageId (where applicable) : System Manager Parameter path to AMI ID
  • instanceType : appropriate instance type. The instance type you specify must matches the selected processor architecture. Default is t4g.medium and t3.medium for arm64 and x86_64 architecture respectively
  • ec2TerminationProtection : enable EC2 termination protection to prevent accidental deletion. Default is Yes

DCV

  • driverType (Windows) : graphics driver to install

IDD, DCV and NVIDIA GRID driver supports custom display resolution, up to four monitors and 4K resolution.

NVIDIA Tesla driver operates in headless TCC (Tesla Compute Cluster) mode, and only support compute workloads. NVIDIA GRID and Gaming drivers operate in WDDM (Windows Display Driver Model) mode, and support both compute and graphics workloads.

If GPU driver installation does not work, you can select DCV-IDD or none option, and install driver manually. Refer to Prerequisites for accelerated computing instances for GPU driver installation and configuration guidance.

Templates configure multi-user.target run level for virtual* session, and graphical.target run level for console* and virtual*GPU_sharing session types.

Due to various combinations of drivers, OSs and instance types, GPU driver installation may not work. You can troubleshoot the installation, or select console or virtual option to install driver manually. Refer to Prerequisites for Linux DCV servers for GPU driver installation and configuration guidance.

  • teslaDriverVersion (where applicable) : Tesla driver version to install when NVIDIA-Tesla or *-NVIDIA_runfile_Driver option is selected
  • listenPort : DCV server TCP and UDP listen ports. Number must be higher than 1024 and default is 8443
  • installReverseProxy (Windows and most Linux): install reverse web proxy to allow DCV access on standard HTTPS port 443. This option does not support QUIC UDP transport protocol. Default is No

Network

  • vpcID : VPC with internet connectivity. Select default VPC if unsure
  • subnetID : subnet in selected VPC with internet connectivity. Select subnet in default VPC if unsure. Ensure your specified instanceType is available in your selected subnet AZ
  • displayPublicIP : set this to No for EC2 instance in a subnet that will not receive public IPv4 address. EC2 private IP will be displayed in CloudFormation Outputs section instead. Default is Yes
  • assignStaticIP : associates a static public IPv4 address using Elastic IP address to prevent assigned IPv4 address from changing every time EC2 instance is stopped and started. Associated charges are listed on Elastic IP Addresses on Amazon EC2 Pricing, On-Demand Pricing page. Default is Yes

Remote Access

  • ingressIPv4 : allowed IPv4 source prefix to DCV, SSH(Linux), RDP(Windows) and Webmin(Linux) ports, e.g. 1.2.3.4/32. Get your source IP from https://checkip.amazonaws.com. Default is 0.0.0.0/0
  • ingressIPv6 : allowed IPv6 source prefix to DCV, SSH(Linux), RDP(Windows) and Webmin(Linux) ports. Default is ::/0. Subnets in default VPC do not have IPv6 CIDR blocks associated. Specify ::1/128 to block all inbound IPv6 access.
  • allowRDPport (Windows) : allow inbound RDP. Option is not related to Fleet Manager Remote Desktop access. Default is No
  • allowSSHport (Linux) : allow inbound SSH. Option is not related to EC2 Instance Connect access. Default is Yes
  • installWebmin (some Linux OS) : install Webmin web-based system administration tool. Default is No

Web Server

  • enableCloudFront: create a Amazon CloudFront distribution to your EC2 instance. Associated charges are listed on Amazon CloudFront pricing page. Default is No
  • originType: either EC2 custom origin or VPC origin. Most AWS Regions support VPC Origins, which allow CloudFront to deliver content even if your EC2 instance is in a VPC private subnet. Enable assignStaticIP if using EC2 origin. Default is EC2
  • allowWebServerPorts : allow inbound HTTP/HTTPS to EC2 instance. This option is not related to enableCloudFront

CloudFormation template does not install web server on EC2 instance.

EBS

  • volumeSize : EBS root volume size in GiB
  • volumeType : gp2 or gp3 general purpose EBS type. Default is gp3

Backup

  • enableBackup : EC2 data protection with AWS Backup. Associated charges are listed on AWS Backup pricing page. Default is No
  • scheduleExpression : start time of backup using CRON expression. Default is 1 am daily
  • scheduleExpressionTimezone : timezone in which the schedule expression is set. Default is Etc/UTC
  • deleteAfterDays : number of days after backup creation that a recovery point is deleted. Default is 35

Verify AWS Backup Region availability before enabling this service.

AWS Global Accelerator (AGA)

Verify AGA Region and Availability Zone (AZ) availability before enabling this service.

Others

Docker Engine is not Docker Desktop. Docker on Linux will use 172.17.0.0/16 subnet.

Route 53 must be configured as DNS service for your domain.

Continue Next with Configure stack options, Review Stack, and click Submit to launch your stack.

It may take more than 15 minutes to provision the EC2 instance. After your stack has been successfully created, its status changes to CREATE_COMPLETE.

CloudFormation Outputs and Exports

The following URLs are available in Outputs section

* SSM session manager and EC2 Instance Connect are primarily for remote terminal administration purposes. For best user experience, connect directly to DCV server using native clients.

If installReverseProxy is Yes

  • DCVhttpsUrl : DCV HTTPS reverse proxy URLs

Reverse proxy does not support QUIC and may not provide optimal user experience

If installWebmin is Yes

  • WebminUrl : Webmin URL. Login as the user specified in Description field. Default password is EC2instanceID value

If enableAGA is Yes

  • DCVagaUrl : DCV URLs through Global Accelerator
  • AGAconsole : Global Accelerator console URL link
  • AGAipv4Addresses : IPv4 addresses

When connecting to AGA using native Windows, Linux or macOS clients, you may want to explicitly select WebSocket (TCP) protocol. QUIC (UDP) is only supported for direct client-server communication where there are no intermediate proxies, gateways, or load balancers.

If enableCloudFront is Yes

  • CloudFrontConsole : CloudFront console URL link. Some adjustment of your CloudFront distribution settings may be required.
  • CloudFrontUrl : CloudFront distribution URL link, e.g. https://d111111abcdef8.cloudfront.net

The following are available as CloudFormation Exports

  • <Stack Name>-IAMRole : IAM role name
  • <Stack Name>-InstanceID : EC2 instance ID
  • <Stack Name>-SecurityGroup : Security group ID

Using DCV

Refer to DCV User Guide

DCV clients

Besides web browser client, DCV offers Windows, Linux and macOS native clients that support additional features such as QUIC UDP transport protocol, multi-channel audio, and printer redirection. Native clients can be download from https://www.amazondcv.com/.

Remove web browser client

You can restrict DCV access to native clients only by removing web browser client. On Linux instances, remove nice-dcv-web-viewer package. On Windows instances, download nice-dcv-server-x64-Release.msi and run the command msiexec /i nice-dcv-server-x64-Release.msi REMOVE=webClient from administrator command prompt.

USB remotization

DCV supports USB remotization, allowing use of specialized USB devices, such as 3D pointing devices and two-factor authentication USB dongles, on Windows and Linux OSs. To use feature on a supported Linux server OS, run the command sudo dcvusbdriverinstaller and restart EC2 instance. Feature is for installable Windows clients only.

TLS certificate

Amazon DCV server automatically generates a self-signed certificate. For Windows and some Linux OSs, the template will attempt to use Posh-ACME (Windows) or Certbot (Linux) to request and install valid Let's Encrypt IPv4 address certificate. This feature is only available if displayPublicIP is Yes and allowWebServerPorts allows HTTP.

IP address certificates are valid for 160 hours, just over six days, and Certbot/Posh-ACME will attempt to renew them before expiry. To ensure proper operation, use assignStaticIPto associate a static IPv4 address. Renewal on Windows is managed through task scheduler; do update the tasks' user credentials if you change administrator password.

DCV also support domain-validated certificates, including AWS Certificate Manager (ACM) exportable public certificates. Refer to DCV, ACM, Certbot and Posh-ACME documentation for more details.

Secure centralized access

If you have a fleet of Amazon DCV servers, you can use Amazon DCV Connection Gateway to centralize access. Refer to blog Getting started with managing NICE DCV sessions secured behind a NICE DCV Connection Gateway and dcv-samples for more information.

Consider Research and Engineering Studio on AWS (RES) if you need to manage secure cloud-based research and engineering environments, and Amazon WorkSpaces Family if you are looking for a fully managed VDI (virtual desktop infrastructure) service.

About Windows template

Default Windows AMI is now Windows Server 2025 English-Full-Base. You can retrieve SSM paths to other AMIs from Parameter Store console, AWS CloudShell or AWS CLI. Refer to Query for the Latest Windows AMI Using Systems Manager Parameter Store blog for more information.

GPU Windows instances

The blog Building a high-performance Windows workstation on AWS for graphics intensive applications walks through use of Windows Server template to provision and manage a GPU Windows instance.

Below shows steps to provision a G6 instance with NVIDIA GRID driver in Malaysia Region

Provision-Windows-GPU-Instance-with-NVIDIA-GRID.mp4

For NVIDIA GPU instances, CUDA® Toolkit and cuDNN (CUDA® Deep Neural Network library) can be downloaded and installed from https://developer.nvidia.com/cuda-downloads and https://developer.nvidia.com/cudnn-downloads respectively.

Windows screen resolution

Template configures a default Windows screen resolution of 1920 by 1080. If you wish to modify resolution settings, refer to community article Change Windows EC2 instance default screen resolution

Updating DCV server on Windows

To update DCV Server, connect via Fleet Manager Remote Desktop console using RDPconnect link and run C:\Users\Administrator\update-DCV.cmd

About DLAMI template

DLAMI-<OS>-NICE-DCV.yaml Ubuntu and Amazon Linux 2023 templates uses AWS Deep Learning AMI (DLAMI) to build a deep learning workstation.

DLAMI options

There are two main AMI options:

  • DLAMIs: preconfigured with NVIDIA GPU driver, CUDA Toolkit, Docker with NVIDIA Container Toolkit, NVIDIA software, and optionally PyTorch or TensorFlow
  • Neuron DLAMIs: pre-installed with Neuron SDK, and support AWS Trainium and AWS Inferentia instance types. Refer to Neuron DLAMI User Guide for more information

Refer to DLAMI Developer Guide for usage guidance. Consider Amazon SageMaker if you are looking for a fully managed experience.

Demo

Deep-Learning-Desktop-With-Amazon-Dcv.mp4

About Linux templates

Login user name

The login user name depends on Linux distributions as follows:

Multiple virtual sessions

To configure multiple virtual sessions, create additional user (e.g. newuser), append user name to /opt/dcv/dcv-users.txt, and set a strong password

USER=newuser

sudo useradd -m -s /bin/bash $USER
echo $USER | sudo tee -a /opt/dcv/dcv-users.txt
sudo passwd $USER

To verify that the virtual sessions have been created

sudo dcv list-sessions

GPU instances

On GPU EC2 instances with GPU drivers installed (*-with-NVIDIA-*), DCV (dcvagent) can use GPU for hardware based video streaming encoding. Template configures Xorg console sessions direct access to GPU accelerated OpenGL graphics as illustrated in nvidia-smi screen shot below

Display resolution and multi-screen support

There are limits to display resolution and multi-screen support for Xorg console sessions depending on sessionType option:

  • console: one display of up to 4K resolution. You can modify /etc/X11/xorg.conf to support other resolutions and more than one display
  • Tesla driver (console-with-NVIDIA_repo_Driver, console-with-NVIDIA_runfile_Driver, console-with-Ubuntu_repo_Driver, console-with-AL2023_repo_Driver) : one display of up to 2560x1600 resolution
  • Gaming driver (console-with-NVIDIA_Gaming_Driver) : one display of up to 4K resolution
  • GRID driver (console-with-NVIDIA_GRID_Driver) : four displays of up to 4K resolution

Select console-(Xdcv)-with-NVIDIA* or virtual-with-NVIDIA-* when using GPU primarily for compute workloads.

Installing NVIDIA CUDA Toolkit and other software

CUDA® Toolkit may be installed on GPU EC2 instances with the following sessionType options:

Installing NVIDIA software

NVIDIA driver, CUDA Toolkit, NVIDIA Container Toolkit, Docker and other software installation/configuration scripts are available from the following re:Post community articles:

Depending on use case, DLAMI template may be a more better option.

Updating DCV server on Linux

Use /home/{user name}/update-dcv script to update DCV server.

Troubleshooting

To troubleshoot any installation issue, you can view contents of the following log files

  • /var/log/cloud-init-output.log
  • /var/log/install-cfn-helper.log
  • /var/log/install-dcv.log
  • /var/log/install-sw.log
  • if GPU driver install option is selected
    • /var/log/install-gpu-driver.log
    • /var/log/nvidia-installer.log (NVIDIA GRID, Gaming and Tesla driver)

About EC2

Restoring from backup

If you enable AWS Backup (enableBackup), you can restore your EC2 instance from recovery points (backups) in your backup vault. The CloudFormation template creates an IAM role that grants AWS Backup permission to restore your backup. Role name can be located in your CoudFormation stack Resources section as the Physical ID value whose Logical ID value is backupRestoreRole

Private subnet

The CloudFormation templates are designed to provision EC2 instances in public subnet. To use them for EC2 instances in private subnets with internet connectivity, set displayPublicIP value to No.

Local Zones

To use templates in AWS Local Zones, verify available services features and adjust CloudFormation parameters accordingly. You may have to change osVersion, instanceType and volumeType, and set assignStaticIP to No.

Securing

To secure your EC2 instance, you may want to

Using Cloudwatch agent

Amazon CloudWatch agent is installed in the EC2 instance, and enables collection of EC2 system-level metrics and AWS X-Ray traces. The template configures agent to collect memory, disk, and some GPU (*-with-NVIDIA-*) utilization metrics. To collect other metrics, you can configure using EC2 console or manually as follows.

Create agent configuration file

Manually create agent configuration file or use agent configuration file wizard:

  • Linux:

    • sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard

  • Windows PowerShell:

    • cd "C:\Program Files\Amazon\AmazonCloudWatchAgent"
    • .\amazon-cloudwatch-agent-config-wizard.exe

Start Cloudwatch agent

After config.json file is created, start CloudWatch agent:

  • Linux:

    • sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/bin/config.json

  • Windows PowerShell:

    • cd "C:\Program Files\Amazon\AmazonCloudWatchAgent"
    • .\amazon-cloudwatch-agent-ctl.ps1 -a fetch-config -m ec2 -c file:config.json

Refer to How do I install and configure the unified CloudWatch agent to push metrics and logs from my EC2 instance to CloudWatch? for details. To collect GPU metrics, refer to How do I send NVIDIA GPU metrics from my EC2 Linux instances to CloudWatch? and Collect NVIDIA GPU metrics

Pricing

There is no additional charge for using AWS CloudFormation. You pay for AWS resources created using the template the same as if you had created them manually. You only pay for what you use, with no minimum fees and no required upfront commitments.

Where possible, template assigns all created resources with user-defined tags of key names StackName and StackId. You can activate them as cost-allocation tags to track your AWS costs on a detailed level. Refer to AWS Billing User Guide for more information.

Clean Up

To remove created resources,

  • Disable EC2 instance termination protection (if enabled)
  • Delete any recovery points in created backup vault (if enabled)
  • Delete CloudFormation stack