Distributing Runtime Resources Across a Segmented Network
A logistics company is installing Blue Prism across two data centres. The application server and database sit in data centre A. Digital workers will run on runtime resource machines in data centre B, where the target business applications also live, because those applications cannot be reached across the WAN with acceptable latency. Firewalls between the data centres permit only specific ports and are managed by a separate network team with a two-week change lead time. The runtime resource machines are built from a gold image that was captured before the application server hostname was finalised. During the first pilot, the runtime resource registers but shows as offline, and the engineer notices the machine is contacting an old hostname. The gold image also has the Blue Prism client installed, which the security team objects to because operators should not run processes from those machines.
1. Explain the registration and offline symptom and describe how to correct the runtime resource configuration at scale.
Read the worked answer
The runtime resource is pointing at a stale application server address baked into the gold image. Registration can appear to succeed against a cached or resolvable name while the live connection to the real application server never establishes, so the resource shows offline.
Correct it at the image level, not machine by machine:
- Confirm the exact connection configuration the runtime resource uses and where it is stored on the machine.
- Update the gold image with the final application server name, then rebuild or re-image the pilot machines so every future build is correct.
- For machines already deployed, apply the corrected configuration through a scripted or configuration-management push rather than manual edits, so drift cannot recur.
- Verify each resource transitions to online and can accept work before scaling out.
Also confirm the firewall rules allow the runtime resource to reach the application server on the required ports in the direction of the connection - a rule that permits the application server to initiate to data centre B does not help if the resource initiates outbound.
2. The security team wants the Blue Prism client removed from runtime resource machines. Evaluate this request and describe the implications for installation and support.
Read the worked answer
The request is reasonable and should be accommodated, but it changes the support model.
Why it is reasonable. Runtime resource machines execute processes under service accounts and hold credentials in memory. An interactive client on those hosts gives a human a route to run or inspect processes outside change control, and widens the attack surface in the trust zone.
What must be true instead. The runtime resource still needs its service component installed and configured; removing the interactive client must not remove the service. Operators who need to observe or intervene must do so from a controlled workstation that connects to the application server, with their own audited credentials.
Support implications. Troubleshooting on the runtime resource becomes remote and log-based rather than interactive. Ensure log collection and remote management are in place before removing the client, or the first incident will force an exception. Update the gold image, the build documentation and the runbook together, and confirm with the security team in writing that the service-only build satisfies their requirement. Get the firewall and remote-access paths approved during the same change window to avoid a second two-week lead time.