Configure AWS Cloud
Last modified on August 17, 2023
To manage access to your AWS cloud environment via StrongDM, you must have an AWS Access Key ID and AWS Secret Access Key prepared. The scope of this key determines which AWS CLI commands your users can execute through StrongDM, so consider that when generating the key.
Once you have your AWS key, you can set up a cloud resource in the StrongDM Admin UI. Users also need to have StrongDM Desktop and the AWS CLI installed to access the cloud resource.
Admin UI Setup
To set up your AWS cloud in StrongDM, go to Admin UI > Infrastructure > Clouds and click Add cloud.
The minimum fields that need to be populated for the AWS cloud type are:
- Access Key ID
- Secret Access Key
- Healthcheck Region (the AWS region so that the healthcheck can check whether it is currently up or down)
The following field is optional:
- Assume Role ARN (if you want the user to assume a specific role after connecting)
In the Cloud Logs section of the Admin UI, you can find all of the activities of your users that accessed the cloud resource. Note that any secrets displayed in the cloud logs are placeholder values. No actual keys or secrets are ever exposed in plaintext in the Admin UI.
- In order to access the AWS cloud resource via StrongDM, users first need to do the following:
- Install the StrongDM Desktop application (desktop app).
- Install the latest version of the StrongDM CLI. If the CLI is already installed, you can run
sdm updatein the CLI to update it. Alternatively, in the desktop app, you can go to the Account menu and select Update and restart. That option is only shown when an update is available.
- Install the AWS CLI. We support both v1 and v2 but encourage the use of v2.
- Set up or update the AWS-CLI configuration file to include a region, as explained in the AWS documentation.
- Make sure to exit and restart your desktop app before connecting for the first time.
- In the desktop app, select the AWS cloud resource to which you want to connect.
After user setup is complete, you may open a terminal and use the AWS CLI through StrongDM, using the base syntax of
sdm aws cli where you normally would start a command with
The general syntax is
sdm aws cli <COMMAND>.
To test that everything is working, try:
sdm aws cli s3 ls sdm aws cli ec2 describe-instances
Commands are always the same as they are with the AWS CLI, just with the
sdm aws cli prefix instead.
Connection to Multiple AWS Cloud Resources
If your organization has multiple AWS cloud resources, and you are connected to them at the same time, you may specify a
--name value in commands in order to specify which you intend to execute the command on. For example,
sdm aws --name <YOUR_RESOURCE_NAME> cli. The flag must come before the
cli portion of the command in order to preserve the ability to use the command as normal with a single AWS cloud resource connected.