Cloudformation CFN-Init Windows Powershell Issue

Question

We are having an issue passing multiple Powershell commands in CFN-Init while launching a bastion host via Cloudformation.

The first command to install the windows features is working, but the the second command (and subsequent ones) are not running. We have tried basic "echo hello> file.txt" and it's not working. We've tried backslashes for escaping the quotes. At this point, we're at a loss.

Here is the resource

  BastionServer:
    Type: AWS::EC2::Instance
    Metadata:
      AWS::Cloudformation::Init:
        configSets:
          config:
            - setup
            - installADDS
            - finalize
        setup:
          files:
            c:\cfn\cfn-hup.conf:
              content: !Sub |
                [main]
                stack=${AWS::StackId}
                region=${AWS::Region}
            c:\cfn\hooks.d\cfn-auto-reloader.conf:
              content: !Sub |
                [cfn-auto-reloader-hook]
                triggers=post.update
                path=Resources.BastionServer.Metadata.AWS::CloudFormation::Init
                action=/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource LaunchConfig --configsets full_install --region ${AWS::Region}
          services:
            windows:
              cfn-hup:
                enabled: 'true'
                ensureRunning: 'true'
                files:
                  - c:\cfn\cfn-hup.conf
                  - c:\cfn\hooks.d\cfn-auto-reloader.conf


        installADDS:
          commands:
            1-install-prereqs:
              command: powershell.exe -Command "Install-WindowsFeature RSAT-AD-Powershell RSAT-ADDS-Tools; "
              waitAfterCompletion: '0'

            2-create-user:
              command: powershell.exe -ExecutionPolicy Bypass -Command "New-ADUser -Name '${DomainAdminUser}' -UserPrincipalName '${DomainAdminUser}'@'{$DomainDNSName}' -AccountPassword (ConvertTo-SecureString ${DomainAdminPassword} -AsPlainText -Force) -Enabled:$true -PasswordNeverExpires:$true"


        finalize:
            1-signal-success:
              command: powershell.exe -Command "Write-AWSQuickStartStatus"
              waitAfterCompletion: '0'

    Properties:
      ImageId:
        Fn::FindInMap:
        - "AWSAMIRegionMap"
        - Ref: "AWS::Region"
        - "WS2016FULLBASE"
      InstanceType: t2.medium
      SsmAssociations: 
        -
          DocumentName: 
            Ref: "SSMDoc"

      KeyName: !Ref 'KeyPair'
      UserData: !Base64
        Fn::Join:
          - ''
          - - "<script>\n"
            - 'cfn-init.exe -v -c config -s '
            - !Ref 'AWS::StackId'
            - ' -r BastionServer'
            - ' --region '
            - !Ref 'AWS::Region'
            - "\n"
            - "</script>\n"

Answer 1

Assuming you are passing the required variables (DomainAdminUser, DomainDNSName and DomainAdminPassword) as parameters within your template, then you just need to utilise the intrinsic substitution function so that CloudFormation knows what to replace your variables with:

installADDS:
  commands:
    1-install-prereqs: ...
    2-create-user:
      command: !Sub >-
        powershell.exe -ExecutionPolicy Bypass -Command
        "New-ADUser -Name '${DomainAdminUser}' -UserPrincipalName '${DomainAdminUser}'@'${DomainDNSName}' -AccountPassword (ConvertTo-SecureString ${DomainAdminPassword} -AsPlainText -Force) -Enabled:$true -PasswordNeverExpires:$true"

To assist with troubleshooting you can save the script on the Bastion to see if the substitution is working as expected:

installADDS:
  files:
    'C:\cfn\scripts\CreateUser.ps1':
      content: !Join
        - ''
        - - "New-ADUser -Name '${"
          - !Ref DomainAdminUser
          - "}' -UserPrincipalName '${"
          - !Ref DomainAdminUser
          - "}'@'${"
          - !Ref DomainDNSName
          - "}' -AccountPassword (ConvertTo-SecureString ${"
          - !Ref DomainAdminPassword
          - "} -AsPlainText -Force) -Enabled:$true -PasswordNeverExpires:$true"
  commands:
    1-install-prereqs: ...
    2-create-user:
      command: >-
        powershell.exe -ExecutionPolicy Bypass -Command
        C:\cfn\scripts\CreateUser.ps1

Answer 2

There is a problem with the "AWS::Cloudformation::Init" element. It should be "AWS::CloudFormation::Init" . (Capital "F" )