(2026.06) VDIs are not assigned an SSH key pair at launch

## Bug description

Newly launched virtual desktops (VDIs) are not assigned an SSH key pair. For Windows VDIs, this prevents users from retrieving the administrator password via the EC2 console ("Get Windows Password" feature). For Linux VDIs, SSH access using the key pair is unavailable.

## Affected versions
2026.06

## Mitigation
> Tip: We recommend running the following commands in [AWS CloudShell](https://console.aws.amazon.com/cloudshell) in the same account and region where RES is deployed. CloudShell comes with pre-installed dependencies and helps eliminate other local environment conditions that may affect the patching process.

1. Set up a Python 3.12 virtual environment and install all dependencies:
```
sudo yum install -y python3.12
python3.12 -m venv /tmp/patch-env
source /tmp/patch-env/bin/activate
pip install boto3
```

2. Create an S3 bucket with ACLs disabled. If you already have an S3 bucket with ACLs disabled, you can skip this step. Otherwise, create one using either the console or the CLI:
1. Option A (AWS Console):
1. Follow the [Creating a bucket guide](https://docs.aws.amazon.com/AmazonS3/latest/userguide/GetStartedWithS3.html#creating-bucket) in the Amazon S3 User Guide. When configuring the bucket:
2. Enter a bucket name and select the region where RES is deployed
3. Under Object Ownership, keep the default setting ACLs disabled (Bucket owner enforced)
4. Configure the remaining settings as needed (block public access, versioning, etc.)
5. Click Create bucket
2. Option B (CLI):
1. Replace `` and `` with your values and run the command:
```
aws s3api create-bucket \
--bucket \
--region \
--create-bucket-configuration LocationConstraint= \
--object-ownership BucketOwnerEnforced
```
Note: If your region is us-east-1, omit the `--create-bucket-configuration` parameter.

3. Download `res_lambda_tool_2026.06.py` and updated function code for version `2026.06` by replacing `` with the directory to download the patch script, `` with the name of your RES environment, `` with the name of a ACLs disabled S3 bucket under the account/region where RES is deployed, and `` with `Classic` or `GovCloud`:
1. The patch applies to 2026.06
2. Configure the AWS CLI for the account / region where RES is deployed, and make sure that you have [Lambda permissions to update function code](https://docs.aws.amazon.com/lambda/latest/api/API_UpdateFunctionCode.html).
```
OUTPUT_DIRECTORY=
ENVIRONMENT_NAME=
PARTITION=
BUCKET_NAME=

mkdir -p ${OUTPUT_DIRECTORY}
curl https://research-engineering-studio-us-east-1.s3.us-east-1.amazonaws.com/releases/2026.06/patch_scripts/res_lambda_tool_2026.06.py --output ${OUTPUT_DIRECTORY}/res_lambda_tool_2026.06.py

curl https://research-engineering-studio-us-east-1.s3.us-east-1.amazonaws.com/releases/2026.06/patch_scripts/patches/backend-lambda-c4326583.zip --output ${OUTPUT_DIRECTORY}/backend-lambda-c4326583.zip
```

4. Update the lambda function code by running the following patch command by replacing `` with the RES environment name, and `` with the root RES environment CloudFormation stack name:
```
ENVIRONMENT_NAME=
STACK_NAME=

python3 ${OUTPUT_DIRECTORY}/res_lambda_tool_2026.06.py --zip-file ${OUTPUT_DIRECTORY}/backend-lambda-c4326583.zip --lambda-name ${ENVIRONMENT_NAME}-backend-lambda --s3-bucket ${BUCKET_NAME}
```

Once the patches have been applied, the Last modified attribute of the Lambda function should be recent, and newly launched VDIs will have the SSH key pair assigned correctly.

## Rollback
The patch scripts saved the original lambda function code within the S3 bucket you provided. To rollback, re-run the exact commands from the patching step with an extra `--rollback` flag.

1. If you are running this in a new terminal session, make sure to set up the variables again:
```
OUTPUT_DIRECTORY=
ENVIRONMENT_NAME=
PARTITION=
BUCKET_NAME=
STACK_NAME=

python3 ${OUTPUT_DIRECTORY}/res_lambda_tool_2026.06.py --zip-file ${OUTPUT_DIRECTORY}/backend-lambda-c4326583.zip --lambda-name ${ENVIRONMENT_NAME}-backend-lambda --s3-bucket ${BUCKET_NAME} --rollback
```

Start by locating the backend Lambda responsible for launching VDIs and compare it with the referenced 2026.06 patch artifact, backend-lambda-c4326583.zip. Confirm the change against newly launched Windows and Linux VDIs: Windows users should be able to retrieve the administrator password, and Linux users should be able to use the assigned SSH key pair.

Written by the indexing model from the issue text.