RDP Desktop module

[bpmct]

A discussion dedicated to the RDP Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	18 / 20	N/A	10 / 10	85 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides three clear examples: basic usage with defaults, custom display name, and generated credentials. Each demonstrates a distinct configuration mode with sensible defaults.
Visual preview	5	0	No image, GIF, or video present in README. The icon reference does not count as a visual preview.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The password variable is marked sensitive = true in main.tf. README examples avoid inline secrets: basic example uses the default (not shown inline), custom example shows placeholder values, and the generated credentials example uses random_password resource without exposing the value.
Non-hardcoded auth path	4	2	README shows random_password resource as an alternative to hardcoded credentials, which is a helper pattern. However, this is the only documented path and still requires the password to flow through Terraform state. No external auth, IAM, or API key helper integration documented.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads nothing; it only configures Windows RDP via PowerShell script and creates a coder_app resource.
Bring-your-own binary	10	N/A	Module downloads nothing; RDP is a Windows built-in feature being configured, not an external tool being installed.
Egress transparency	3	N/A	Module makes no external network calls during install or runtime. It configures local Windows services and creates Coder resources via the provider.
Runs without sudo	2	N/A	Module has no scripts that execute on the Coder server or client. The PowerShell script runs on Windows where sudo is not applicable; it uses Windows-native admin commands.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided for username, password, display_name, order, and group. The password variable is properly marked sensitive. No validation blocks present, but the inputs are straightforward strings/numbers that don't require complex validation.
Test coverage	4	4	Strong testing story: .tftest.hcl covers business logic including default password handling and special character escaping in both PowerShell and URL encoding. TypeScript tests in main.test.ts provide comprehensive end-to-end coverage including app creation, script generation, custom values, sensitive variables, and URI format validation.

Overall — 85 / 100

Raw 40 / 47 → round(40 / 47 × 100) = 85

---

Scored against SCORECARD.md on 2026-08-31 with claude-sonnet-4-5.