Note: Please go to to access the current RightScale documentation set. Also, feel free to Chat with us!
Home > ServerTemplates > v12.11 LTS > Supplemental > Deployment Prerequisites (Windows)

Deployment Prerequisites (Windows)


To complete the necessary prerequisite steps before building a deployment with RightScale's Windows ServerTemplates.

Table of Contents


The following steps should be performed before you attempt to build a multi-tier deployment such as the 3 Tier Deployment Setup (IIS and SQL) setup tutorial.


Create a Deployment

Prerequisites: Requires 'actor' user role privileges in the RightScale account.

The first step is to create a new deployment for the project. It's not recommended that you use the "Default" deployment or an existing deployment for new development because you do not want to accidentally inherit any unknown configuration settings. Therefore, it's recommended to always create a new deployment when you start a new project. Be sure to use a unique and descriptive nickname for each deployment. (e.g. My Project Name)

  1. Go to Manage > Deployments. Click New and provide the following information:
    • Nickname - User-defined name for the deployment. 
    • Description - A short, internal-only description of the deployment.

Tip: Most users find it useful to create a bookmark in the left-hand pane of the dashboard that links to the deployment's Servers tab.

Create DNS Records

In a typical 3-tier architecture setup, DNS A records are used to create fully qualified domain names (FQDNs) that map to a particular server or tier of servers. The digram below shows a typical example of a 3-tier website architecture.

For example, the application servers locate the standalone or principal SQL database server by using the database server's FQDN (e.g.,, which points to the server's private IP address. Similarly, front-end web traffic can be routed to a FQDN (e.g. where each load balancer server has a DNS record for that FQDN so that incoming requests are routed to one of the load balancer servers. Since the IP address of an instance in the cloud is often dynamically assigned at launch time, you are required to use a DNS provider that supports dynamic DNS (i.e. the ability to dynamically update the IP address of an A record) for the standalone/principal server (at a minimum). You can also use the same DNS provider for creating FQDNs for the load balancer servers. However, since they do not require the use of dynamic DNS, any DNS provider can be used.


When you create the DNS records, it's important to set appropriate TTLs to ensure that servers will not stay connected to an old IP address that is no longer assigned to a functional server. For example, the DNS record that points to the standalone/principal database server should have a low TTL to ensure that the application servers will connect to the correct server within a reasonable amount of time. It's strongly recommended that you use a TTL of 60 seconds for the DNS record that points to the standalone/principal database server.

Note: If you are using Rackspace's Cloud DNS service, you must use a TTL of 300 seconds because that is the lowest allowable TTL. Be sure to change the 'DNS_TTL' input from 60 (default) to 300.


You will need to create DNS records for the following servers:

  • Each HAProxy Load Balancer Server
  • Standalone/Principal Database Server
  • Mirror Database Server (Optional)

RightScale's ServerTemplates contain scripts that support one of the following DNS providers. Create an account with one of the DNS providers below and set up the A records accordingly.

Important! The tutorials below assume that you are creating records for a Linux-based architecture. However, you can follow the general steps to create the DNS records that are required for Windows.

Create Common Credentials

Prerequisites: Requires 'designer' user role privileges in the RightScale account to create a new credential.

Note: Only the user who created the credential and any 'admin' users will be able to view and modify an existing credential. 

Credentials are a way of passing sensitive information to a script (as an input) in a discrete manner without making the actual value visible in the Dashboard. As a best practice, many of the ServerTemplates published by RightScale are preconfigured to use certain credentials. It's recommended that you create these common credentials in your own account. If they already exist and apply to a different deployment, you might want to create a new set of credentials to avoid any conflicts. In such cases, it's helpful to use a common prefix to group the credentials together. (e.g. ProjectX-SQL_APPLICATION_USER)

If you try to launch a server where one of the inputs references a credential that does not exist in the RightScale account, you will receive an error message and will not be able to launch the server. Therefore, it's best to create any required credentials before you configure and launch a server. Depending on your cloud provider and backup storage selections, you may want to create additional credentials.

At a minimum, create the following credentials. See Create a New Credential for more information.


By default, when you launch a Windows server in the cloud, an initial password is automatically generated for the Windows 'Administrator' user. However, each Windows-based ServerTemplate published by RightScale contains a boot script ('SYS Set admin account') that allows you to change the password for the 'Administrator' user with the ADMIN_PASSWORD input or create a new user with administrative privileges by using the ADMIN_ACCOUNT_NAME input. It's strongly recommended that you create a credential and use that value for the ADMIN_PASSWORD input in order to use your own password instead of the randomly generated one. Use the username and password to start a Remote Desktop Protocol (RDP) connection.

  • WINDOWS_ADMIN_PASSWORD - Password for the Windows 'Administrator' user (default) or specified user with administrative privileges. You must specify a value that satisfies the minimum password requirements, otherwise the initial Windows password will be used instead. For example, a valid password should contain at least 7 characters and include at least one upper case letter, one lower case letter, and one digit. See Password Policy for details.

Amazon S3

If you are using Amazon S3 to store binary database backups or retrieve private files from an S3 bucket, you must use the following AWS credentials for authentication purposes. Fortunately, these credentials are automatically created when AWS credentials are added to a RightScale account. Although, they are available for use when you define your inputs, they will not be listed under Design > Credentials.
Note: AWS credentials are located under Settings > Account Settings > Clouds.

  • AWS_ACCESS_KEY_ID - Amazon access key ID for authentication.
  • AWS_SECRET_ACCESS_KEY - Amazon secret key corresponding to AWS_ACCESS_KEY_ID.

Rackspace Cloud Files

If you want to use Rackspace Cloud Files for storing binary database backups or retrieving files from a private container, you will need to create the following credentials.

  • RACKSPACE_USERNAME - The username used to log into Rackspace's Cloud Control Panel.
  • RACKSPACE_AUTH_KEY - The Rackspace account API key.



  • DNS_USER* - Username that's used to log into your DNS provider and update DNS records. It's commonly used to update the A record with the private IP address of the "principal" database server.
  • DNS_PASSWORD* - Password for DNS_USER.

* If you use Amazon Route 53 as your DNS provider, you do not need to set up separate DNS user name and password credentials because your AWS credentials are used for authentication purposes.

Source Control Management (SVN, GitHub)

If you are using a source control management (SCM) system to host your application code, you will need to create the following credentials to retrieve your source code from the specified repository.

  • GIT_SSH_KEY - A valid SSH Key for accessing a private repository hosted on
  • SVN_USERNAME - The SVN username that has access to the specified repository.

Microsoft IIS/SQL

If you are setting up a multi-tier deployment using ServerTemplates based on RightScale's IIS and SQL ServerTemplates, a SQL user with application privileges is required by the application to connect to the SQL database.

  • SQL_APPLICATION_USER - SQL database user with login privileges to the specified user database.
  • SQL_APPLICATION_PASSWORD - Password for the SQL database user with login privileges to the specified user database.


Secure Sockets Layer (SSL)

If you are using SSL to support HTTPS access, you should create credentials for any of the following values that apply. See How do I create an SSL certificate for my web server?

  • SSL_CERTIFICATE - Contents of the X.509/PEM-format SSL server certificate used for enabling HTTPS communications.
  • SSL_CERTIFICATE_CHAIN - The certificate authority (CA) certificate chain associated with the server certificate used to set up HTTPS communications.
  • SSL_CERTIFICATE_KEY - The SSL server certificate's private key, in PEM format.
  • SSL_PASSPHRASE - If required by an SSL certificate, you must provide the passphrase so Apache can start.

Create Cloud-specific Resources

Prerequisites: Requires 'actor' user role privileges in the RightScale account to create SSH Keys and Elastic IPs, and 'security_manager' privileges to create security groups.

Each cloud infrastructure is unique and requires different resources in order to launch a server in their cloud. Depending on the type of cloud infrastructure that you're going to use to launch servers, you will find it useful to create some of the required cloud-specific resources beforehand so that you can select them in the "Add Server Wizard" when you add servers into a deployment. Cloud resources are also cloud-specific. For example, you cannot launch an EC2 instance in the 'us-east' region with an 'us-west' security group. 

If you are following a standard 3-tier tutorial for testing and demonstration purposes only, you can create a single security group with the following permissions. If you are building a 3-tier deployment for a production environment, you should consider using more robust security group settings. See Configure Multiple Security Groups for a Multi-Tiered Deployment.


At a minimum, the security group should contain the following firewall permissions.  Note: Port 443 is only required for SSL support (HTTPS).

The example below shows the firewall permissions for an EC2 security group called '3tier-microsoft-all-tiers' that contains all of the required permissions if you used the same security group for all the servers, which should only be used in a demo or test environment.


Amazon Web Services (EC2 and S3)


  • Create a New SSH Key You are required to select an SSH Key when you launch an EC2 instance. Although it can be used to establish a remote connection with the instance, Server Login Control is used instead.
  • Create a New EC2 Security Group Although you can use the same security group for all servers in the same region, you may want to consider creating separate security groups for each tier of your site architecture for additional security. See Configure Multiple Security Groups for a Multi-Tiered Deployment.
  • Create Elastic IPs (EIP) If you are launching load balancer servers in EC2, it's recommended that you use Elastic IPs for your public facing load balancer servers if you're using RightScale's "Load Balancer" ServerTemplates. Typically, you will have two load balancers for redundancy purposes. You must create an Elastic IP for each load balancer.


Simple Storage Service (S3) is Amazon's remote object store (ROS) where you can store static files that can be used by EC2 instances in any AWS region. For example, you can store a database dump file in an S3 bucket and then launch an EC2 instance that will retrieve the file from the S3 bucket. S3 buckets are also used to store binary backups of a database. 

If S3 is not activated for your AWS account, please sign-up for the service now. (


You must to post a comment.
Last modified
00:39, 17 May 2013



This page has no classifications.



© 2006-2014 RightScale, Inc. All rights reserved.
RightScale is a registered trademark of RightScale, Inc. All other products and services may be trademarks or servicemarks of their respective owners.