Connect AWS

Connect with one command

1

Open AWS CloudShell

Sign in to the AWS account you want to use as an administrator of that account (it must be allowed to create IAM roles and users), then open CloudShell from the console toolbar.
Open AWS CloudShell
2

Run the command from CloudPloy

On the CloudPloy connect screen, copy the command and run it in CloudShell. It creates the EC2 instance role and the cloudploy user, attaches Power User access and the pass-role policy, and prints one line that starts with cloudploy:v1. The access key secret appears only in your terminal.
3

Paste the output into CloudPloy

Paste the line back on the connect screen. CloudPloy connects as soon as it reads it. Running the command again rotates the key for the same account instead of adding a second connection.
Open CloudPloy

Set up by hand

1
Create the EC2 instance role

Stay signed in as an administrator. Power User cannot create roles. In IAM, create a role for EC2 and name it exactly as the CloudPloy connect screen shows. The name looks like CloudPloyEc2SsmRole-4. Paste this trust policy, then attach AmazonSSMManagedInstanceCore. The console creates the instance profile with the same name.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```
2
Attach the instance policy

On that role, attach this managed policy by pasting the ARN.
```
arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
```
3
Create the IAM user

In AWS IAM, create a user named cloudploy. Attach the managed policy by pasting this ARN. That policy is Power User access. It can run AWS services, and it leaves out IAM user administration and AWS Organizations.
```
arn:aws:iam::aws:policy/PowerUserAccess
```
4

Paste the extra policy

On that user, add an inline policy named CloudPloyPassInstanceRole and paste the document on this page. Power User cannot pass a role to EC2. CloudPloy needs that permission to launch a server.
Jump to the policy
5

Create the access key

Open the cloudploy user, choose Security credentials, then Create access key. Choose Application running outside AWS. Copy the access key ID and the secret access key, then paste both into CloudPloy.
Open CloudPloy and paste the key

Policy to paste

Pass the instance role to EC2

Name the inline policy CloudPloyPassInstanceRole. Paste this document as-is.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CloudPloyPassInstanceRole",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "ec2.amazonaws.com"
        }
      }
    }
  ]
}