chore(e2e): Added windows based boundary worker scenario and module (#5973)

* Added windows based boundary worker scenario and module * powershell script to run boundary on startup * merged member server scenario
2025-08-18 07:53:24 -07:00
1 parent 71fc7a5ec4
commit f39e0b07c7
@@ -127,6 +127,10 @@ module "aws_windows_client" {
  source = "./modules/aws_windows_client"
 }

+module "aws_rdp_member_server_with_worker" {
+  source = "./modules/aws_rdp_member_server_with_worker"
+}
+
 module "vault" {
  source = "./modules/aws_vault"

@@ -52,18 +52,19 @@ scenario "e2e_aws_windows" {
    }
  }

-  step "read_boundary_license" {
-    module = module.read_license
+  step "create_base_infra" {
+    module = module.aws_vpc_ipv6
+
+    depends_on = [
+      step.find_azs,
+    ]

    variables {
-      license_path = local.boundary_license_path
+      availability_zones = step.find_azs.availability_zones
+      common_tags        = local.tags
    }
  }

-  step "create_db_password" {
-    module = module.random_stringifier
-  }
-
  step "build_boundary_linux" {
    module = matrix.builder == "crt" ? module.build_crt : module.build_local

@@ -77,7 +78,7 @@ scenario "e2e_aws_windows" {
    module = matrix.builder == "crt" ? module.build_crt : module.build_local

    depends_on = [
-      step.build_boundary_linux
+      step.build_boundary_linux,
    ]

    variables {
@@ -90,19 +91,6 @@ scenario "e2e_aws_windows" {
    }
  }

-  step "create_base_infra" {
-    module = module.aws_vpc_ipv6
-
-    depends_on = [
-      step.find_azs,
-    ]
-
-    variables {
-      availability_zones = step.find_azs.availability_zones
-      common_tags        = local.tags
-    }
-  }
-
  step "create_windows_client" {
    module = module.aws_windows_client

@@ -119,6 +107,14 @@ scenario "e2e_aws_windows" {
    }
  }

+  step "read_boundary_license" {
+    module = module.read_license
+
+    variables {
+      license_path = local.boundary_license_path
+    }
+  }
+
  step "create_vault_cluster" {
    module = module.vault
    depends_on = [
@@ -142,13 +138,29 @@ scenario "e2e_aws_windows" {
    }
  }

+  step "create_db_password" {
+    module = module.random_stringifier
+  }
+
+  step "create_rdp_domain_controller" {
+    module = module.aws_rdp_domain_controller
+    depends_on = [
+      step.create_base_infra,
+    ]
+
+    variables {
+      vpc_id         = step.create_base_infra.vpc_id
+      server_version = matrix.rdp_server
+    }
+  }
+
  step "create_boundary_cluster" {
    module = module.aws_boundary
    depends_on = [
      step.create_base_infra,
-      step.create_windows_client,
      step.create_db_password,
      step.build_boundary_linux,
+      step.create_windows_client,
      step.create_vault_cluster,
      step.read_boundary_license
    ]
@@ -210,15 +222,29 @@ scenario "e2e_aws_windows" {
    }
  }

-  step "create_rdp_domain_controller" {
-    module = module.aws_rdp_domain_controller
+  step "create_windows_worker" {
+    module = module.aws_rdp_member_server_with_worker
    depends_on = [
      step.create_base_infra,
+      step.create_rdp_domain_controller,
+      step.build_boundary_windows,
+      step.create_boundary_cluster,
    ]

    variables {
-      vpc_id         = step.create_base_infra.vpc_id
-      server_version = matrix.rdp_server
+      vpc_id                              = step.create_base_infra.vpc_id
+      server_version                      = matrix.rdp_server
+      boundary_cli_zip_path               = step.build_boundary_windows.artifact_path
+      kms_key_arn                         = step.create_base_infra.kms_key_arn
+      controller_ip                       = step.create_boundary_cluster.public_controller_addresses[0]
+      iam_name                            = step.create_boundary_cluster.iam_instance_profile_name
+      boundary_security_group             = step.create_boundary_cluster.boundary_sg_id
+      active_directory_domain             = step.create_rdp_domain_controller.domain_name
+      domain_controller_aws_keypair_name  = step.create_rdp_domain_controller.keypair_name
+      domain_controller_ip                = step.create_rdp_domain_controller.private_ip
+      domain_admin_password               = step.create_rdp_domain_controller.password
+      domain_controller_private_key       = step.create_rdp_domain_controller.ssh_private_key
+      domain_controller_sec_group_id_list = step.create_rdp_domain_controller.security_group_id_list
    }
  }

@@ -347,4 +373,20 @@ scenario "e2e_aws_windows" {
  output "windows_client_ssh_key" {
    value = step.create_windows_client.ssh_private_key
  }
-}
+
+  output "windows_worker_admin_username" {
+    value = step.create_windows_worker.admin_username
+  }
+
+  output "windows_worker_admin_password" {
+    value = step.create_windows_worker.admin_password
+  }
+
+  output "windows_worker_public_ip" {
+    value = step.create_windows_worker.public_ip
+  }
+
+  output "windows_worker_private_ip" {
+    value = step.create_windows_worker.private_ip
+  }
+}
@@ -211,6 +211,11 @@ output "public_controller_addresses" {
  value = var.ip_version == "4" ? aws_instance.controller[*].public_ip : aws_instance.controller[*].ipv6_addresses[0]
 }

+output "boundary_sg_id" {
+  description = "A secruity group id that covers basic boundary ports and ssh"
+  value       = aws_security_group.boundary_sg.id
+}
+
 output "controller_aux_sg_id" {
  description = "A security group ID that covers the controllers for adding extra rules to"
  value       = aws_security_group.boundary_aux_sg.id
@@ -31,7 +31,7 @@ variable "worker_instance_type" {
 variable "worker_type_tags" {
  description = "Tag to set on worker for use in worker filters"
  type        = list(string)
-  default     = ["collocated", "prod", "webservers"]
+  default     = ["collocated", "prod", "webservers", "linux"]
 }

 variable "worker_ebs_iops" {
@@ -0,0 +1,290 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_version = ">= 1.1.2"
+
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+
+    tls = {
+      source = "hashicorp/tls"
+    }
+
+    archive = {
+      source = "hashicorp/archive"
+    }
+  }
+}
+
+data "enos_environment" "current" {}
+
+data "aws_caller_identity" "current" {}
+
+data "aws_kms_key" "kms_key" {
+  key_id = var.kms_key_arn
+}
+
+data "aws_ami" "infra" {
+  most_recent = true
+  owners      = ["amazon"]
+
+  filter {
+    name   = "name"
+    values = ["Windows_Server-${var.server_version}-English-Full-Base*"]
+  }
+}
+
+data "aws_vpc" "infra" {
+  id = var.vpc_id
+}
+
+data "aws_subnets" "infra" {
+  filter {
+    name   = "vpc-id"
+    values = [var.vpc_id]
+  }
+}
+
+locals {
+  username = split(":", data.aws_caller_identity.current.user_id)[1]
+}
+
+resource "random_string" "DSRMPassword" {
+  length           = 8
+  override_special = "." # I've set this explicitly so as to avoid characters such as "$" and "'" being used and requiring unneccesary complexity to our user_data scripts
+  min_lower        = 1
+  min_upper        = 1
+  min_numeric      = 1
+  min_special      = 1
+}
+
+locals {
+  domain_parts = split(".", var.active_directory_domain)
+  domain_sld   = local.domain_parts[0] # second-level domain (example.com --> example)
+  domain_tld   = local.domain_parts[1] # top-level domain (example.com --> com)
+}
+
+// Deploy a Windows EC2 instance
+resource "aws_instance" "worker" {
+  ami                    = data.aws_ami.infra.id
+  instance_type          = var.instance_type
+  vpc_security_group_ids = flatten([var.boundary_security_group, var.domain_controller_sec_group_id_list])
+  key_name               = var.domain_controller_aws_keypair_name
+  subnet_id              = data.aws_subnets.infra.ids[0]
+  iam_instance_profile   = var.iam_name
+
+  root_block_device {
+    volume_type           = "gp2"
+    volume_size           = var.root_block_device_size
+    delete_on_termination = "true"
+    encrypted             = true
+  }
+
+  user_data_replace_on_change = true
+
+  user_data = <<EOF
+                <powershell>
+                  # Set up SSH so we can remotely manage the instance
+                  ## Install OpenSSH Server and Client
+                  $timeout = 300
+                  $interval = 10
+                  # Loop to make sure that SSH installs correctly               
+                  do {
+                  try {
+                      $result = Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
+                      if ($result) {
+                          Write-Host "Successfully added openSSH server"
+                          break
+                      }
+                      } catch {
+                          Write-Host "SSH server was not installed, retrying"
+                          Start-Sleep -Seconds $interval
+                          $elapsed += $interval
+                      }
+                      if ($elapsed -ge $timeout) {
+                          Write-Host "SSH server installation failed after 5 minutes. Exiting."
+                          exit 1
+                      }
+                  } while ($true)
+
+
+                  Set-Service -Name sshd -StartupType 'Automatic'
+                  Start-Service sshd
+
+                  Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
+                  Set-Service -Name ssh-agent -StartupType Automatic
+                  Start-Service ssh-agent
+
+                  # Set PowerShell as the default SSH shell
+                  New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value (Get-Command powershell.exe).Path -PropertyType String -Force
+
+                  # Configure SSH server to use private key authentication so that scripts don't have to use passwords
+                  # Save the private key from instance metadata
+                  $ImdsToken = (Invoke-WebRequest -Uri 'http://169.254.169.254/latest/api/token' -Method 'PUT' -Headers @{'X-aws-ec2-metadata-token-ttl-seconds' = 2160} -UseBasicParsing).Content
+                  $ImdsHeaders = @{'X-aws-ec2-metadata-token' = $ImdsToken}
+                  $AuthorizedKey = (Invoke-WebRequest -Uri 'http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key' -Headers $ImdsHeaders -UseBasicParsing).Content
+                  $AuthorizedKeysPath = 'C:\ProgramData\ssh\administrators_authorized_keys'
+                  New-Item -Path $AuthorizedKeysPath -ItemType File -Value $AuthorizedKey -Force
+
+                  # Ensure the SSH agent pulls in the new key.
+                  Set-Service -Name ssh-agent -StartupType "Automatic"
+                  Restart-Service -Name ssh-agent
+
+                  ## Open the firewall for SSH and boundary connections
+                  New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
+                  New-NetFirewallRule -Name boundary_in -DisplayName 'Boundary inbound' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 9202
+                  New-NetFirewallRule -Name boundary_out -DisplayName 'Boundary outbound' -Enabled True -Direction Outbound -Protocol TCP -Action Allow -LocalPort 9202
+
+                  ## Add computer to the domain
+                  [int]$intix = Get-NetAdapter | % { Process { If ( $_.Status -eq "up" ) { $_.ifIndex } }}
+                  Set-DNSClientServerAddress -interfaceIndex $intix -ServerAddresses ("${var.domain_controller_ip}","127.0.0.1")
+                  $here_string_password = @'
+${var.domain_admin_password}
+'@
+                  $password = ConvertTo-SecureString $here_string_password -AsPlainText -Force
+                  $username = "${local.domain_sld}\Administrator" 
+                  $credential = New-Object System.Management.Automation.PSCredential($username,$password)
+
+                  # check that domain can be reached
+                  $elapsed = 0
+                  do {
+                    try {
+                      $result = Resolve-DnsName -Name "${var.active_directory_domain}" -Server "${var.domain_controller_ip}" -ErrorAction Stop
+                      if ($result) {
+                        Write-Host "DNS resolved successfully."
+                        break
+                        }
+                      } catch {
+                          Write-Host "DNS not resolved yet. Retrying in $interval seconds..."
+                          Start-Sleep -Seconds $interval
+                          $elapsed += $interval
+                      }
+                      if ($elapsed -ge $timeout) {
+                        Write-Host "DNS resolution failed after 5 minutes. Exiting."
+                        exit 1
+                      }
+                  } while ($true)
+
+                  # add computer to domain
+                  Add-Computer -DomainName "${var.active_directory_domain}" -Credential $credential
+                </powershell>
+              EOF
+
+  metadata_options {
+    http_endpoint          = "enabled"
+    instance_metadata_tags = "enabled"
+  }
+  get_password_data = true
+
+  tags = {
+    Name = "${var.prefix}-windows-worker-${local.username}"
+  }
+}
+
+locals {
+  admin_password        = rsadecrypt(aws_instance.worker.password_data, file(var.domain_controller_private_key))
+  private_key           = abspath(var.domain_controller_private_key)
+  boundary_cli_zip_path = var.boundary_cli_zip_path != "" ? abspath(var.boundary_cli_zip_path) : ""
+  test_dir              = "C:/Test/" # needs to end in a / to ensure it creates the directory
+}
+
+
+resource "enos_local_exec" "wait_for_ssh" {
+  depends_on = [
+    aws_instance.worker,
+  ]
+  inline = ["timeout 600s bash -c 'until ssh -i ${local.private_key} -o BatchMode=Yes -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no Administrator@${aws_instance.worker.public_ip} \"echo ready\"; do sleep 10; done'"]
+}
+
+resource "enos_local_exec" "make_dir" {
+  depends_on = [
+    enos_local_exec.wait_for_ssh,
+  ]
+
+  inline = ["ssh -i ${local.private_key} -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no Administrator@${aws_instance.worker.public_ip} mkdir -Force ${local.test_dir}"]
+}
+
+# copy the boundary cli zip file onto the windows client
+resource "enos_local_exec" "add_boundary_cli" {
+  depends_on = [
+    enos_local_exec.make_dir,
+  ]
+
+  inline = ["scp -i ${local.private_key} -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no ${local.boundary_cli_zip_path} Administrator@${aws_instance.worker.public_ip}:${local.test_dir}"]
+}
+
+# create a powershell script to unzip the boundary cli zip file and add it to
+# the PATH
+resource "local_file" "powershell_script" {
+  depends_on = [
+    enos_local_exec.add_boundary_cli
+  ]
+  content = templatefile("${path.module}/scripts/setup.ps1", {
+    boundary_cli_zip_path = "${local.test_dir}/${basename(local.boundary_cli_zip_path)}"
+    test_dir              = local.test_dir
+  })
+  filename = "${path.root}/.terraform/tmp/setup_worker.ps1"
+}
+
+# create a worker config file for boundary
+resource "local_file" "worker_config" {
+  depends_on = [
+    enos_local_exec.add_boundary_cli,
+  ]
+  content = templatefile("${path.module}/scripts/worker.hcl", {
+    controller_ip    = var.controller_ip
+    aws_kms_key      = data.aws_kms_key.kms_key.id
+    aws_region       = var.aws_region
+    worker_public_ip = aws_instance.worker.public_ip
+    test_dir         = local.test_dir
+  })
+  filename = "${path.root}/.terraform/tmp/worker.hcl"
+}
+
+# copy the powershell script onto the windows client
+resource "enos_local_exec" "add_powershell_script" {
+  depends_on = [
+    enos_local_exec.add_boundary_cli,
+    local_file.powershell_script,
+  ]
+
+  inline = ["scp -i ${local.private_key} -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no ${abspath(local_file.powershell_script.filename)} Administrator@${aws_instance.worker.public_ip}:${local.test_dir}"]
+}
+
+# copy the worker config script onto the windows client
+resource "enos_local_exec" "add_worker_config" {
+  depends_on = [
+    enos_local_exec.add_boundary_cli,
+    local_file.worker_config,
+  ]
+
+  inline = ["scp -i ${local.private_key} -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no ${abspath(local_file.worker_config.filename)} Administrator@${aws_instance.worker.public_ip}:${local.test_dir}"]
+}
+
+
+# run the powershell script on the windows client
+resource "enos_local_exec" "run_powershell_script" {
+  depends_on = [
+    enos_local_exec.add_boundary_cli,
+    enos_local_exec.add_powershell_script,
+    enos_local_exec.wait_for_ssh,
+    enos_local_exec.add_worker_config,
+  ]
+
+  inline = ["ssh -i ${local.private_key} -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no Administrator@${aws_instance.worker.public_ip} ${local.test_dir}/${basename(local_file.powershell_script.filename)}"]
+}
+
+resource "time_sleep" "wait_2_minutes" {
+  depends_on      = [enos_local_exec.run_powershell_script]
+  create_duration = "2m"
+}
+
+# used for debug
+resource "local_file" "powershell_script_output" {
+  depends_on = [enos_local_exec.run_powershell_script]
+  content    = enos_local_exec.run_powershell_script.stdout
+  filename   = "${path.root}/.terraform/tmp/setup_worker.out"
+}
@@ -0,0 +1,30 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+// This is the public DNS address of our instance
+output "public_dns_address" {
+  value = aws_instance.worker.public_dns
+}
+
+output "public_ip" {
+  value = aws_instance.worker.public_ip
+}
+
+output "public_ip_list" {
+  value = [aws_instance.worker.public_ip]
+}
+
+output "private_ip" {
+  value = aws_instance.worker.private_ip
+}
+
+output "admin_username" {
+  description = "The username of the administrator account"
+  value       = "Administrator"
+}
+
+// This is the decrypted administrator password for the EC2 instance
+output "admin_password" {
+  description = "Decrpted admin password for the EC2 instance"
+  value       = nonsensitive(local.admin_password)
+}
@@ -0,0 +1,29 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+# Unzip Boundary CLI to the same directory
+$destination = Split-Path -Path ${boundary_cli_zip_path}
+Expand-Archive -Path ${boundary_cli_zip_path} -DestinationPath $destination -Force
+
+# Add Boundary CLI to PATH
+$existingPath = [Environment]::GetEnvironmentVariable(
+    "Path",
+    [EnvironmentVariableTarget]::Machine
+)
+
+$newPath = $existingPath + ";" + $destination
+[Environment]::SetEnvironmentVariable(
+    "Path",
+    $newPath,
+    [EnvironmentVariableTarget]::Machine
+)
+
+# create a trigger that will run boundary at startup
+$trigger = New-JobTrigger -AtStartup
+$configPath = Join-path ${test_dir} -ChildPath "worker.hcl"
+$jobLog = Join-path ${test_dir} -ChildPath "worker.out"
+$command = "boundary server -config `"$configPath`" *> $jobLog"
+Register-ScheduledJob boundary -ScriptBlock ([ScriptBlock]::Create($command)) -Trigger $trigger
+
+# Restart the computer to apply changes
+shutdown -r -t 10
@@ -0,0 +1,62 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+# disable memory from being swapped to disk
+disable_mlock = true
+
+# Increase log level for debuggin
+log_level = "debug"
+
+# listener denoting this is a worker proxy
+listener "tcp" {
+  address = "0.0.0.0:9202"
+  purpose = "proxy"
+}
+
+# worker block for configuring the specifics of the
+# worker service
+worker {
+  public_addr = "${worker_public_ip}"
+  name = "win-worker-0"
+  initial_upstreams = ["[${controller_ip}]:9201"]
+  tags {
+    type = ["worker", "egress", "windows"]
+  }
+}
+
+# Events (logging) configuration. This
+# configures logging for ALL events to both
+# stderr and a file at ${test_dir}<boundary_use>.log
+events {
+  audit_enabled       = true
+  sysevents_enabled   = true
+  observations_enable = true
+  sink "stderr" {
+    name = "all-events"
+    description = "All events sent to stderr"
+    event_types = ["*"]
+    format = "cloudevents-json"
+  }
+  sink {
+    name = "file-sink"
+    description = "All events sent to a file"
+    event_types = ["*"]
+    format = "cloudevents-json"
+    file {
+      path = "${test_dir}"
+      file_name = "worker.log"
+    }
+    audit_config {
+      audit_filter_overrides {
+        sensitive = "redact"
+        secret    = "redact"
+      }
+    }
+  }
+}
+
+kms "awskms" {
+  purpose    = "worker-auth"
+  region     = "${aws_region}"
+  kms_key_id = "${aws_kms_key}"
+}
@@ -0,0 +1,112 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+variable "vpc_id" {
+  type        = string
+  description = "Id of VPC to add additional infra resources to."
+}
+
+# =================================================================
+# ec2 instance configuration
+# =================================================================
+variable "server_version" {
+  type        = string
+  description = "Windows version for server"
+  default     = "2025"
+}
+
+variable "instance_type" {
+  type        = string
+  description = "The AWS instance type to use for servers."
+  default     = "m7i-flex.xlarge"
+}
+
+variable "root_block_device_size" {
+  type        = string
+  description = "The volume size of the root block device."
+  default     = 128
+}
+
+variable "prefix" {
+  type        = string
+  description = "Prefix used to name various infrastructure components. Alphanumeric characters only."
+  default     = "enos"
+}
+
+# =================================================================
+# aws configuration variables
+# =================================================================
+
+variable "kms_key_arn" {
+  description = "ARN of KMS Key from enos-infra"
+  type        = string
+}
+
+variable "aws_region" {
+  description = "AWS Region to create resources in"
+  type        = string
+  default     = "us-east-1"
+}
+
+variable "controller_ip" {
+  description = "IP address of the controller instance"
+  type        = string
+  default     = ""
+}
+
+variable "iam_name" {
+  description = "Name of IAM role to assign to worker"
+  type        = string
+  default     = ""
+}
+
+variable "boundary_security_group" {
+  description = "Name of security group with boundary related ports"
+  type        = string
+  default     = ""
+}
+
+# =================================================================
+# Paths for source code
+# =================================================================
+variable "boundary_cli_zip_path" {
+  description = "Path to the boundary cli zip file (windows, amd64)"
+  type        = string
+  default     = ""
+}
+
+# =================================================================
+# Variables for the windows domain
+# =================================================================
+variable "domain_controller_aws_keypair_name" {
+  type        = string
+  description = "The AWS keypair created during creation of the domain controller."
+}
+
+variable "active_directory_domain" {
+  type        = string
+  description = "The name of the Active Directory domain to be created on the Windows Domain Controller."
+  default     = "mydomain.com"
+}
+
+variable "domain_controller_ip" {
+  type        = string
+  description = "IP of the domain controller"
+  default     = ""
+}
+
+variable "domain_admin_password" {
+  type        = string
+  description = "Domain admin password for setting up this instance in the domain"
+  default     = ""
+}
+
+variable "domain_controller_private_key" {
+  type        = string
+  description = "The file path of the private key generated during creation of the domain controller."
+}
+
+variable "domain_controller_sec_group_id_list" {
+  type        = list(any)
+  description = "ID's of AWS Network Security Groups created during creation of the domain controller."
+}
@@ -282,7 +282,7 @@ resource "local_file" "powershell_script" {
    boundary_cli_zip_path = "${local.test_dir}/${basename(local.boundary_cli_zip_path)}"
    boundary_src_zip_path = "${local.test_dir}/${basename(archive_file.boundary_src_zip[0].output_path)}"
  })
-  filename = "${path.root}/.terraform/tmp/setup_boundary.ps1"
+  filename = "${path.root}/.terraform/tmp/setup_windows_client.ps1"
 }

 # copy the powershell script onto the windows client
@@ -313,5 +313,5 @@ resource "local_file" "powershell_script_output" {
  depends_on = [enos_local_exec.run_powershell_script]
  count      = var.boundary_cli_zip_path != "" ? 1 : 0
  content    = enos_local_exec.run_powershell_script[0].stdout
-  filename   = "${path.root}/.terraform/tmp/powershell_script_output.txt"
+  filename   = "${path.root}/.terraform/tmp/setup_windows_client.out"
 }