One Login Page in Front of Every Server
Someone on the team needs into a Windows box in a private subnet. The options are familiar: give the instance a public IP and open 3389 to the world (no), set up a VPN and walk them through the client (an afternoon), or hand over the bastion's SSH key and hope they know what a tunnel is.
Apache Guacamole is the fourth option. They open a URL, log in, click the machine, and the desktop appears in a browser tab.
Apache Guacamole on AWS Marketplace by Meetrix packages that gateway as an AMI you launch with CloudFormation into your own AWS account. The stack takes 5 to 10 minutes. If you want every click with screenshots, the Guacamole developer guide has them.
The Quick Verdict
Private EC2 instances, mixed OS
This is the sweet spot. One gateway for RDP, SSH, and VNC, and the targets keep no public IP.
Users who can't install software
Contractors, support staff, locked-down laptops. A browser is the whole client.
Only Windows, only admins
AWS Fleet Manager may be enough, if 60-minute sessions and console-only access don't bother you.
Whole networks, not single machines
A VPN fits better. Guacamole gives access to specific machines, not to a subnet.
What Apache Guacamole Is
Apache Guacamole is a clientless remote desktop gateway from the Apache Software Foundation, released under the Apache License 2.0. "Clientless" is the whole idea: the user's browser renders the session over HTML5, and a server-side daemon called guacd speaks RDP, SSH, VNC, or Telnet to the real machine.
That split matters on AWS. The connection to the target starts from the gateway, inside your VPC, so the target only has to accept traffic from the Guacamole instance. Nothing on the internet ever talks to your Windows server directly.
Beyond that, the Guacamole manual covers what you'd expect from a gateway people actually use day to day: per-user and per-group connection permissions, file transfer (SFTP over SSH, a virtual drive inside RDP), session recording, and sign-in extensions for LDAP, TOTP, Duo, SAML, and OpenID Connect.
Why run it in your own AWS account
A note on the current release: Guacamole 1.6.0 was released on June 22, 2025, and remains the latest stable version as of October 2026. That's an unusually long gap between releases for Guacamole, and Apache's security reports page lists no vulnerabilities fixed since. If you're running Guacamole 1.5.5 or older, upgrading to 1.6.0 is strongly recommended: that version fixed CVE-2024-35164, where the terminal emulator didn't properly validate console codes, allowing arbitrary code execution with the privileges of the guacd process.
How the Deployment Works
A manual install means building guacd, deploying the web app, wiring up a database for users and connections, and putting a reverse proxy with SSL in front. The AMI ships Guacamole 1.6.0 and guacd in Docker on Ubuntu, behind nginx, so the login page is up when the stack finishes.
- Launch the CloudFormation Stack Subscribe to the Apache Guacamole listing, pick a region, and launch. You'll need an EC2 key pair and an S3 bucket for backups in that region. Set AdminPassword carefully: it becomes the guacadmin password. New account and hitting a vCPU error? Raise your vCPU quota first.
- Point Your Domain Copy PublicIp from the stack's Outputs tab and create an A record. If the domain is on Route 53, the instance sets up SSL by itself. On another DNS provider, run the certificate script described in the developer guide.
- Log In as guacadmin Open DashboardUrl. Before DNS and SSL are ready, DashboardUrlIp works over plain HTTP, which is fine for a first look and nothing more. A 502 means it's still starting, so give it 5 minutes.
- Add Connections Settings, then Connections, then New Connection. Pick RDP, SSH, or VNC, enter the target's private IP and credentials, and grant it to users or groups.
One nice detail: PublicIp is an Elastic IP, so stopping and starting the instance doesn't break your DNS record.
The Part That Actually Trips People Up
The gateway is easy. The first connection that won't open is where the time goes, and it's almost always one of two things.
The target's security group
Each machine has to allow its protocol's port from the Guacamole instance: 3389 for RDP, 22 for SSH, 5900 for VNC. Use the Guacamole security group as the source rather than an IP, so the rule survives if the gateway is ever replaced. And don't open those ports to 0.0.0.0/0 "just to test." That defeats the reason you deployed a gateway.
RDP certificates and security mode
A fresh Windows server presents a self-signed certificate, and an RDP connection that won't trust it simply fails to connect. In the connection's settings, the RDP parameters include a security mode and an "Ignore server certificate" option. Inside a private VPC, ticking that option is a common and reasonable choice.
The ignore-cert parameter is documented in Guacamole's manual: when set to true, the certificate returned by the server is ignored even if it can't be validated. The typical combination is ignore-cert set to true and security set to any. That said, ignore-cert only skips certificate validation. When a connection still fails with it on, the cause is usually the security mode or NLA settings on the Windows side, and the error shows up in guacd's logs, not in the browser. Check them with sudo docker ps, then sudo docker logs on the guacd container.
A more permanent fix is to push a proper certificate to the Windows server via Group Policy. Once the certificate is trusted, you can set ignore-cert back to false. That's more work, but it's the right answer if the gateway is going to be around for a while.
One more Windows gotcha
AWS's own docs point out that a standard Windows Server licence allows two concurrent RDP connections. A third user on the same server needs Remote Desktop Services licences, whichever gateway they come through.
What the Meetrix AMI Gives You
- A running gateway. Guacamole 1.6.0 and guacd in Docker on Ubuntu, behind nginx, ready when the stack completes.
- SSL on Route 53 domains, set up automatically, with a script as the fallback.
- The admin password from your stack parameters, so there's no default credential sitting on a public login page.
- Backups to your own S3 bucket, in your account.
- A plain upgrade path. When a new version is listed, back up, delete the stack, launch the new one.
- Support at aws@meetrix.io, and the Apache Guacamole store page with the protocol and port table in one place.
Right after first login, do what the developer guide's warning says: create a non-admin user for yourself and stop using guacadmin day to day. If your team already has an identity provider, the SAML or OpenID Connect extension can sit in front. Our Keycloak developer guide and Authentik developer guide both launch an IdP on AWS the same way.
Who Is Guacamole on AWS Right For?
I'd point a sysadmin or DevOps lead here when they look after a handful to a few dozen EC2 instances, some Windows and some Linux, and they're tired of managing who has which key. It also fits:
- Support and helpdesk teams that need to get onto customer or internal machines from any laptop
- Companies giving contractors time-limited access to specific servers, without handing out VPN profiles
- Training labs and classrooms, where every student gets a desktop in a browser tab
- Anyone replacing an SSH-only bastion who also needs Windows desktops behind it
Guacamole vs Fleet Manager, Teleport, and a VPN
| Feature | Guacamole on AWS by Meetrix | AWS Fleet Manager Remote Desktop | Teleport | Self-hosted VPN |
|---|---|---|---|---|
| Protocols | RDP, SSH, VNC, Telnet | RDP to Windows Server only | SSH, RDP, Kubernetes, databases, MCP servers | Anything on the network |
| User needs | A browser | AWS console access and IAM permissions | Web UI or the tsh client | A VPN client |
| Session limits | None set by Guacamole | Disconnects after 60 minutes by default (renewable), 10-minute idle timeout, 5 concurrent connections per account and region by default | Configurable | None |
| Agent on targets | None, standard protocols | SSM Agent | Teleport agent | None |
| SAML and OIDC sign-in | Yes, via extensions | Through IAM Identity Center | Enterprise only | Depends on the VPN |
| Licence | Apache 2.0 | Part of AWS Systems Manager | Community Edition free under 100 employees and US$10M revenue | Varies |
| Access scope | Specific machines you grant | Managed Windows instances | Specific resources you grant | The whole network segment |
Fleet Manager limits are from the AWS Systems Manager docs; Teleport details are from its feature matrix.
On Fleet Manager: a session disconnects after 60 minutes unless you choose Renew session, it drops after 10 minutes of idle time, and you can have up to 5 concurrent RDP connections per account and region by default. You can request a quota increase to 50. It's also console-only and doesn't support command-line connections.
On Teleport: the Community Edition is free for companies with fewer than 100 employees and less than US$10 million in annual revenue. The feature matrix sets no limit on Linux servers or simultaneous sessions, but non-AD Windows hosts are capped at 5, and registering more than 5 blocks connections to all of them. SSO with SAML and OIDC is an Enterprise feature.
My honest take: if every user is an AWS admin and every target is Windows Server, try Fleet Manager first, since it costs you nothing to set up. The moment you need Linux desktops, VNC, or people outside your AWS accounts, Guacamole is simpler. Teleport is the stronger tool for database and Kubernetes access, but SSO is an Enterprise feature and the free edition has company-size limits.
Want network-level access instead? Our roundup of the best self-hosted VPNs and OpenVPN on AWS Marketplace cover that route. And if users need a native desktop client with good video performance, self-hosted RustDesk is worth a look.
Resources
Where I'd Start
First hour
Launch the stack, point the domain, log in, and add one SSH and one RDP connection to private instances.
Same day
Lock target security groups to the Guacamole security group, and create a non-admin user for yourself.
That week
Add TOTP or your identity provider, set up groups, and grant connections by group instead of user by user.
Before more people join
Check the S3 backups restore, and size the instance up if lots of people will connect at once.
Guacamole releases are infrequent (1.6.0 came out in June 2025 and remains current), so security comes down to what you control: patch the instance, keep guacadmin's password strong, and keep target ports closed to everything but the gateway.
Frequently Asked Questions
What is Apache Guacamole?
An open-source, clientless remote desktop gateway. Users access RDP, SSH, VNC, or Telnet sessions through a web browser, with no client software installed.
Is Apache Guacamole free to use on AWS?
The software is Apache 2.0 licensed and free. You pay for the EC2 instance and whatever licence fee the Marketplace listing shows.
What are the default login details?
The admin password is whatever you set as AdminPassword in the CloudFormation parameters. The username is guacadmin.
Which instance type does the Guacamole AMI need?
The guide uses t3a.small as the starting instance type. Size up if many users will connect at once.
Can Guacamole replace a bastion host?
For specific machines, yes. Guacamole gives browser-based access to the hosts you grant. It doesn't provide network-level access to a subnet; a VPN does that.
Why does my RDP connection fail when SSH works?
Almost always the RDP certificate. Enable "Ignore server certificate" in the connection settings, or push a trusted certificate to the Windows server. If it still fails, check the guacd container logs.
How is Guacamole different from AWS Fleet Manager Remote Desktop?
Fleet Manager is free, console-only, Windows-only, and by default limited to 60-minute sessions and 5 concurrent connections. Guacamole supports RDP, SSH, and VNC, works from any browser, and sets no session limits of its own.
Put One Gateway in Front of Your Servers
Launch Apache Guacamole in your own AWS account and reach RDP, SSH, and VNC machines from any browser, with no client to install.
Deploy on AWS Marketplace
