How to authorise a user during an AppStream session

For future reference, It's also not possible to invoke a Lambda function in the start script, at least not using CLI levigating IAM security. The AWSPowertool module takes over 60 seconds (!) to initiate, and 60 seconds is the max duration of the start script before AppStream forces it to close.

Start initiate AWSPowerShell:2024-05-29 14:00:08
The session script has not completed within the configured waiting time of 60000 ms. Logs will be truncated shortly after this point.

I could make it a HTTP endpoint I guess and call it without the CLI using http, but in the end I found a better way. When creating the streaming URL, I copy a credential to the users home folder. Then in the start script I wait for the home folder to mount, pick up the credential and then deletes it.

$regHive = "HKLM:\SOFTWARE\Amazon\AppStream\Storage\$Env:AppStream_UserName"

function Get-HomeFolderMountStatus {
  Get-ChildItem -Path $regHive `
  | Where-Object { $_.Name.EndsWith('HomeFolder') } `
  | Get-ItemPropertyValue -Name MountStatus
}

while ("$(Get-HomeFolderMountStatus)" -ne '2') {
  Start-Sleep -Seconds 3
  Write-Output "Homefolder mount status: $(Get-HomeFolderMountStatus)"
}

To authorize a user during an AppStream session, you can leverage the AppStream session context feature. The session context allows you to pass user-specific information to the AppStream instance during the session start-up process.

Here's a step-by-step approach you can consider:

1. Retrieve user's license information:

   • When your API is called to create a streaming URL, retrieve the user's license information from your backend.
   • You can store this information in a secure way, such as encrypting it and attaching it to the session context.

2. Pass the user's license information in the session context:

   • When creating the streaming URL using the aws appstream create-streaming-url command, include the user's license information in the --session-context parameter.
   • The session context can be a JSON-encoded string that contains the user's license details.

   Example:

   aws appstream create-streaming-url --stack-name my-stack --fleet-name my-fleet --user-id 10 --application-id my-app-xyz --session-context '{"licenses": ["trial", "regular"]}'
   

3. Retrieve the user's license information in the start script:

   • In the start script of your AppStream image, you can access the session context information using the $APPSTREAM_SESSION_CONTEXT environment variable.
   • Parse the session context JSON and retrieve the user's license information.

   Example start script:

   #!/bin/bash
   
   # Retrieve the session context
   SESSION_CONTEXT=$APPSTREAM_SESSION_CONTEXT
   
   # Parse the session context and extract the user's licenses
   licenses=$(echo $SESSION_CONTEXT | jq -r '.licenses[]')
   
   # Validate the user's licenses and perform any necessary actions
   for license in $licenses; do
     case $license in
       "trial")
         # Grant access to trial applications
         ;;
       "regular")
         # Grant access to regular applications
         ;;
       # Add more license types as needed
     esac
   done
   
   # Start the application
   /path/to/application

By using the session context, you can securely pass the user's license information to the AppStream instance during the session start-up process. This allows you to validate the user's licenses and grant or deny access to the appropriate applications within the start script, before the application is launched.

Remember to ensure that the user's license information is stored securely in your backend and that the session context is protected from tampering by the end-user.