This Packer template builds AWS AMIs that support login with SSH public key auth. When using instances created from this template you don't have to ever retrieve, worry about or use a Windows password. You can log in with SSH directly using your SSH key.

The public key is provisioned using the AWS EC2 key infrastructure. The template doesn't use WinRM at all, SSH is also used by the Packer builder.

packer build -var "branch=$(git rev-parse --abbrev-ref HEAD)" -var 'docker_version=17.03.0' -var 'docker_compose_version=1.11.2' -var 'git_version=2.12.2.windows.1' .\docker-ci\docker-ci.json
...
--> amazon-ebs: AMIs were created:
us-west-2: <ami-id>

$instanceid = aws ec2 run-instances --image-id <ami-id> --block-device-mapping '[{""DeviceName"": ""/dev/sda1"", ""Ebs"": {""VolumeSize"": 100, ""VolumeType"": ""gp2""}}]' --ebs-optimized --count 1 --instance-type c4.xlarge --key-name <key-name> --security-group-ids <security-group-id> --query "Instances[*].InstanceId" --output=text
aws ec2 describe-instances --instance-ids $instanceid --query "Reservations[*].Instances[*].PublicIpAddress" --output=text ; `
<ip-address>

Wait for the instance to come up.

ssh -i <key-path> Administrator@<ip-address>

The chief concern when using these templates and building on AMIs generated with them, is making sure that the public key from the AWS metadata service is writte to the Administrator user's ~\.ssh\authorized_keys directory on boot. There are two general ways to achieve this:

• Do sysprep and make sure the key is written when an instance is launched from the sysprepped AMI. The key will only be re-written if another sysprep is done.
• Pass in userdata script that writes the key from metadata. This has to be passed on every boot.

• Clean up the Packer builder to better support Windows
• Don't restart at the end of builder-userdata.ps1 if possible
• Figure out startup script that fetches public key from metadata API (perhaps using local group policy)
• Disable WinRM and RDP after first boot (probably requires disabling the EC2 instance initialization since it relies on those services)

• http://jen20.com/2015/04/02/windows-amis-without-the-tears.html
• http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2launch.html
• https://github.com/jhowardmsft/docker-w2wCIScripts (Jenkins setup)