RDP Web module

[bpmct]

A discussion dedicated to the RDP Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Utility Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	N/A	10 / 20	0 / 20	8 / 10	52 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for AWS, Google Cloud, custom Devolutions Gateway version, and native RDP mode. Each example shows sensible defaults and clear configuration patterns.
Visual preview	5	5	README includes a video thumbnail image at ./video-thumbnails/video-thumbnail.png (93.7 KB) with a link to the full video demonstration.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	The admin_password variable is marked sensitive = true in main.tf. However, README examples do not show the password variable at all, leaving users to discover the default coderRDP! only through source inspection. No example demonstrates non-inline secret handling (e.g., via data sources or external references). Half credit: sensitive marking present but documentation incomplete.
Non-hardcoded auth path	4	2	The module uses Windows local administrator credentials. While this is inherent to RDP, the README does not document alternative authentication methods (e.g., domain accounts, certificate-based auth, or integration with external identity providers). Half credit for acknowledging the limitation through the credential variables.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The module downloads Devolutions Gateway from PSGallery via Install-Module. No variable overrides the PSGallery URL or provides an alternative repository source. The devolutions_gateway_version variable only controls version selection, not the download source.
Bring-your-own binary	10	0	No documented way to skip the Install-Module step when Devolutions Gateway is pre-installed. The installation script always attempts to install the module.
Egress transparency	3	0	No dedicated README section enumerates external endpoints. The PSGallery download and NuGet package provider installation are visible only in the PowerShell template source code. Endpoints are not documented for restricted environments.
Runs without sudo	2	0	The PowerShell installation script performs system-wide operations: Install-Module for all users, modifying HKLM registry keys, configuring Windows Firewall, managing Windows services, and writing to C:\Program Files. These operations require administrator privileges. No non-privileged fallback is documented or implemented.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions, sensible defaults (e.g., display_name, admin_username, devolutions_gateway_version). Validation present for share (owner/authenticated/public) and agent_name (required when enable_native_rdp is true). Good use of nullable types and conditional validation.
Test coverage	4	2	TypeScript tests in main.test.ts cover script generation, credential injection, and special character handling. Terraform tests in windows-rdp.tftest.hcl cover native RDP enable/disable logic and agent_name validation. However, tests do not verify end-to-end RDP connectivity, Devolutions Gateway installation success, or the web client functionality. Half credit: business logic tested but no runtime verification.

Overall — 52 / 100

Raw 35 / 67 → round(35 / 67 × 100) = 52

Correction: Utility modules normalize from denominator 75 before N/A exclusions. With Restricted-Environment fully applicable (20 pts), denominator is 67. Raw score 35 / 67 = 52.24 → 52 / 100

Re-scoring with correct normalization:

• Presentation: 17 / 17
• Credential: 10 / 20
• Restricted: 0 / 20
• Engineering: 8 / 10
• Total: 35 / 67 → 52 / 100

---

Scored against SCORECARD.md on 2026-09-21 with claude-sonnet-4-5.