是否可通过IaC方式自动化创建Windows Workspace镜像并实现灾备重建？

一、镜像管理与灾备重建方案 #

针对AWS账户丢失后仍能重建自定义镜像的需求，核心思路是将镜像构建过程完全代码化，依赖AWS官方源镜像而非自定义镜像备份：

• 采用AWS EC2 Image Builder实现无接触镜像构建
  • 无需远程连接Workspace，所有软件安装、系统配置步骤都通过PowerShell脚本（Windows环境）定义为Image Builder组件，嵌入到镜像构建流水线中。
  • 流水线可通过代码仓库提交、定时任务等方式触发，每一次构建都生成可追溯的镜像版本，同时在脚本中记录所有软件版本、配置变更细节，确保构建过程完全可重复。
• 灾备保障措施
  • 将Image Builder的配置代码（包括组件脚本、流水线定义、依赖清单）托管在独立于AWS账户的代码仓库中（比如本地Git仓库或第三方托管仓库），确保AWS账户丢失时能获取到构建逻辑。
  • 重建时，只需在新AWS账户中部署这套代码，触发Image Builder基于AWS官方Windows Workspaces源镜像重新执行构建，即可还原出与原镜像一致的自定义镜像。

二、IaC自动化创建Windows Workspace镜像的方法 #

目前主流的IaC工具（Terraform、AWS CloudFormation）都支持自动化创建Windows Workspace镜像，核心是通过代码定义Image Builder的流水线和组件：

Terraform实现示例 #

通过aws_imagebuilder相关资源定义构建流程，将软件安装脚本嵌入组件：

# 定义Windows Workspace镜像组件（软件安装脚本）
resource "aws_imagebuilder_component" "windows_workspace_apps" {
  name       = "windows-workspace-apps"
  platform   = "Windows"
  version    = "1.0.0"
  data       = <<EOF
schemaVersion: 1.0
phases:
  - name: build
    steps:
      - name: InstallChrome
        action: ExecutePowerShell
        inputs:
          commands:
            - "Invoke-WebRequest -Uri 'https://dl.google.com/tag/s/dl/chrome/install/googlechromestandaloneenterprise64.msi' -OutFile 'C:\\chrome.msi'"
            - "msiexec /i C:\\chrome.msi /qn /norestart"
      - name: InstallChocolatey
        action: ExecutePowerShell
        inputs:
          commands:
            - "Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))"
EOF
}

# 定义镜像配方，关联AWS官方Windows Workspaces源镜像与自定义组件
resource "aws_imagebuilder_image_recipe" "windows_workspace" {
  name         = "windows-workspace-recipe"
  parent_image = "arn:aws:imagebuilder:us-east-1:aws:image/windows-server-2019-workspaces/latest"
  version      = "1.0.0"

  components {
    component_arn = aws_imagebuilder_component.windows_workspace_apps.arn
  }
}

# 定义基础设施配置（指定实例类型、IAM角色等）
resource "aws_imagebuilder_infrastructure_configuration" "windows_workspace" {
  name = "windows-workspace-infra-config"
  instance_types = ["t3.large"]
  iam_role_arn   = aws_iam_role.imagebuilder_role.arn
}

# 定义镜像构建流水线
resource "aws_imagebuilder_image_pipeline" "windows_workspace" {
  name                    = "windows-workspace-pipeline"
  image_recipe_arn        = aws_imagebuilder_image_recipe.windows_workspace.arn
  infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.windows_workspace.arn
}

AWS CloudFormation实现 #

使用CloudFormation的AWS::ImageBuilder::*资源类型，以YAML格式定义构建流程：

Resources:
  WindowsWorkspaceAppsComponent:
    Type: AWS::ImageBuilder::Component
    Properties:
      Name: windows-workspace-apps
      Platform: Windows
      Version: 1.0.0
      Data: |
        schemaVersion: 1.0
        phases:
          - name: build
            steps:
              - name: InstallChrome
                action: ExecutePowerShell
                inputs:
                  commands:
                    - "Invoke-WebRequest -Uri 'https://dl.google.com/tag/s/dl/chrome/install/googlechromestandaloneenterprise64.msi' -OutFile 'C:\\chrome.msi'"
                    - "msiexec /i C:\\chrome.msi /qn /norestart"

  WindowsWorkspaceImageRecipe:
    Type: AWS::ImageBuilder::ImageRecipe
    Properties:
      Name: windows-workspace-recipe
      ParentImage: arn:aws:imagebuilder:us-east-1:aws:image/windows-server-2019-workspaces/latest
      Version: 1.0.0
      Components:
        - ComponentArn: !Ref WindowsWorkspaceAppsComponent

  WindowsWorkspaceInfraConfig:
    Type: AWS::ImageBuilder::InfrastructureConfiguration
    Properties:
      Name: windows-workspace-infra-config
      InstanceTypes: ["t3.large"]
      IamRoleArn: !Ref ImageBuilderIamRole

  WindowsWorkspaceImagePipeline:
    Type: AWS::ImageBuilder::ImagePipeline
    Properties:
      Name: windows-workspace-pipeline
      ImageRecipeArn: !Ref WindowsWorkspaceImageRecipe
      InfrastructureConfigurationArn: !Ref WindowsWorkspaceInfraConfig

关键注意事项 #

• 所有软件安装必须采用静默方式，避免人工交互，比如使用msiexec /qn参数、Chocolatey包管理器的无交互安装命令。
• 确保Image Builder使用的IAM角色拥有足够权限（如S3读取、EC2实例操作、Image Builder资源管理权限），避免构建过程中出现权限错误。

内容的提问来源于stack exchange，提问作者aphexlog