To connect to a Windows EC2 instance with Remote Desktop, launch a Windows AMI with a key pair, allow inbound TCP 3389 only from your administrator’s IP address, retrieve the initial Administrator password using the matching private key, then open the downloaded RDP profile in a desktop client. If you do not want a public IPv4 endpoint, AWS also supports an RDP connection through an EC2 Instance Connect Endpoint and a local tunnel.
Choose how the instance will be reached
| Connection path | Network exposure and requirements | When it fits |
|---|---|---|
| RDP to a public endpoint | Needs an appropriate public endpoint, a security-group rule allowing inbound RDP from your IP, an RDP client, and the launch key pair to retrieve a generated Windows password. | Use when a public endpoint is acceptable and you can restrict access to your administrator IP. |
| RDP through an EC2 Instance Connect Endpoint | Does not require a public IPv4 address or public DNS name. Requires an endpoint, AWS CLI configuration, and a local tunnel to remote TCP port 3389. | Use when the instance should not have a public endpoint and you can configure the private access path. |
| Fleet Manager or Session Manager | AWS lists these managed connection methods with IAM permissions and an instance profile role as prerequisites; their setup differs from conventional RDP. | Consider these AWS-managed alternatives if their requirements match your environment. |
AWS’s EC2 connection-method comparison outlines the managed options. Neither public RDP nor the endpoint tunnel is the right choice for every environment; select based on network policy and what you can configure.
As an Amazon Associate I earn from qualifying purchases.
Launch a Windows EC2 instance
- Open the EC2 console and select the AWS Region where the instance should run.
- Start the launch workflow, choose a Windows Amazon Machine Image (AMI), and select an instance type.
- Choose or create a key pair and retain its private key securely. It is used to decrypt the generated initial Administrator password. If you launch without a key pair, AWS says that password cannot be retrieved through this method.
- Configure networking for the connection path you selected. For public RDP, arrange an appropriate public endpoint and a security-group rule for inbound RDP from your administrator IP. For a private connection, plan to use an EC2 Instance Connect Endpoint instead.
- Review the configuration and launch the instance. AWS’s EC2 launch tutorial describes the Region, AMI, instance type, key pair, public-IP, and security-group choices.
- Wait until the instance’s status checks pass before attempting to connect.
The default security group does not allow inbound RDP. For the conventional route, permit TCP port 3389 from your IP address rather than opening it to all sources. AWS’s traditional RDP guidance identifies port 3389 and the security-group requirement.
Free tools Windows power users keep installed
One-click scans. No signup required.
Retrieve the initial Windows password
- In the EC2 console, select the instance and choose Connect, then open the RDP client tab.
- Choose the Administrator username that matches the language of the Windows AMI.
- Choose Get password. Upload the
.pemprivate key corresponding to the key pair selected when launching this instance, then choose the option to decrypt the password. - Save the decrypted password securely. The IAM user or role performing this action needs permission for
ec2:GetPasswordData.
Password data may not be ready immediately. For one “not available yet” error, AWS’s Windows instance troubleshooting guidance says to wait at least four minutes before retrying. The AWS CLI reference for get-password-data recommends waiting up to 15 minutes. These are separate recommendations, not a guaranteed universal wait time.
#1 Best Overall
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
If password retrieval does not work
- For a “not available yet” message, wait several minutes and try again.
- Check that your IAM identity is allowed to call
ec2:GetPasswordData. - Confirm that you supplied the private key matching the key pair chosen at launch.
- Check whether the instance uses a custom AMI that disables password generation or already has a password configured; the generated-password workflow may not apply.
- If no key pair was specified at launch, this method cannot retrieve the generated Windows password.
Connect from a desktop RDP client
- On the instance’s RDP client tab, download the remote desktop file.
- On Windows, open Remote Desktop Connection by running
mstsc.exe, then open the downloaded.rdpfile. AWS names Windows App for Mac for macOS and Remmina for Linux. - Review the target and username before connecting. For the public-endpoint route, AWS says the default Computer value is the instance’s public IPv4 DNS name.
- Connect and enter the decrypted Administrator password when prompted.
A certificate warning can appear because the instance may use a self-signed certificate. If you need to verify the instance’s identity, AWS describes comparing the certificate thumbprint with the value in the instance system log in its RDP connection instructions.
Connect without a public IPv4 address
AWS documents RDP through an EC2 Instance Connect Endpoint using a local tunnel to the instance’s remote port 3389. This is an alternative to connecting to a public endpoint, not a prerequisite for ordinary public RDP. You still need the Windows password and RDP profile described above.
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
- Set up an EC2 Instance Connect Endpoint and the AWS CLI prerequisites for your environment. AWS lists relevant requirements in its EC2 Instance Connect prerequisites.
- Open a local tunnel with
aws ec2-instance-connect open-tunnel, specifying the instance, remote port3389, and a local port you choose. Follow the command’s AWS CLI options and your endpoint configuration. - Edit the downloaded RDP profile so its computer target is
localhost:<local-port>, using the local port you selected. - Connect with your desktop RDP client and authenticate using the decrypted Administrator password.
See AWS’s EC2 Instance Connect Endpoint connection instructions for the tunnel workflow. The extra endpoint and CLI configuration make this path more involved than connecting directly to a public RDP endpoint.
Secure the Windows account after connecting
After the first login, change the default Administrator password and create a second user with administrator capability and remote access. A second authorized account provides a recovery option if the original account becomes unavailable. AWS recommends both steps in its Windows RDP guidance.
Rank #3
- EFFORTLESS EVERYDAY PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 Home system, delivering reliable, low-power efficiency for daily tasks like document editing, email, online classes, and web browsing
- 15.6-INCH FULL HD DISPLAY: Enjoy immersive visuals on the 15.6" FHD (1920x1080) anti-glare screen with micro-edge bezels. Delivers clear details and comfortable viewing for long study sessions, working on spreadsheets, and video playback
- RESPONSIVE MULTITASKING & STORAGE: Built with 4GB LPDDR4 RAM and 128GB eMMC storage for smooth daily essential use. Expand your storage by up to 1TB via the integrated TF card slot to easily store movies, photos, and working files
- ADVANCED CONNECTIVITY: Outfitted with 2x Full-Featured Type-C ports for data transfer, fast charging, and dual-monitor output, alongside 2x USB 3.2 Gen1 ports and a 3.5mm audio jack for complete peripheral compatibility
- LIGHTWEIGHT & SILENT OPERATION: Slim and portable for effortless travel or commuting. Features a 1MP HD webcam for remote meetings, 38Wh battery with 45W Type-C fast charging, and a fanless silent design for peaceful work environments.
Windows Server connection licensing
For Windows Server, AWS says the included license permits two simultaneous remote connections for administrative purposes. More than two simultaneous connections require an RDS license. This statement is specific to Windows Server administrative use; do not apply it as a general rule to other operating systems or licensing arrangements. See AWS’s Windows instance RDP documentation.
Quick Recap
Rank #4
- WINDOWS 11 | STABLE PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 system, this laptop delivers stable performance for everyday computing tasks. It supports web browsing, online learning, document editing, email communication, and basic office work with optimized power efficiency, providing a practical and reliable experience for essential daily use for daily use.
- 15.6” FHD IPS DISPLAY: Features a 15.6-inch Full HD IPS display with narrow bezels, offering wider viewing angles and clearer image details compared to standard panels. The improved screen-to-body ratio enhances visual experience for study, reading, document work, and video playback, making it suitable for both productivity and entertainment use.
- 4GB DDR4 + 128GB eMMC STORAGE: Equipped with 4GB DDR4 memory and 128GB eMMC storage for everyday basics such as browsing, documents, email, and online learning platforms. The built-in TF card slot supports storage expansion up to 1TB, giving you more flexibility for files, photos, videos, and daily documents. TF card not included.
- CONNECTIVITY & PORTS: Includes 1× TF card slot, 2× USB 3.2 Gen1 ports, and 2× full-featured Type-C ports (USB 3.2 Gen1). The Type-C ports support data transfer, charging, and video output, enabling flexible connection with external devices such as monitors, storage, and peripherals for daily work and study use.
- LIGHTWEIGHT DESIGN | ONLINE COMMUNICATION: Designed with a slim, portable profile, this laptop is easy to carry for school, commuting, and travel. A built-in 1MP front camera supports online classes, video meetings, remote communication, and everyday conferencing. The 3300mAh battery works with the low-power system design to support practical daily use, while thermal optimization helps maintain quieter operation during extended tasks.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
