AWS Cloud

Learn how to configure and manage AWS cloud resources in StrongDM.

Overview

This guide explains what capabilities StrongDM can provide for managing command line access to the AWS cloud. It also provides setup and configuration instructions to add AWS as a resource in StrongDM and begin using StrongDM to control access for users who wish to access your cloud via the AWS CLI. StrongDM users are authenticated with AWS and granted the level of access that you configure on the AWS side.

In addition to access control and auditing, AWS access through StrongDM can be a part of a variety of use cases and access control methodologies:

Least Privilege: For AWS clouds, least privilege can be accomplished by setting up multiple instances of the console as StrongDM resources. Each resource would connect to AWS using a different set of credentials with different permissions granted to it.
Just-in-Time Access: StrongDM users are able to use any access workflows you set up to request access to AWS, allowing you the choice between granting Just-in-Time (JIT) access with requests, or providing standing access to particular users or roles within your StrongDM organization. For more details, see the Access Workflows section.

To avoid confusion during access requests, if there are multiple AWS cloud resources in StrongDM, it may be useful to name them in such a way that indicates the level of access, so that users know the name of the resource to request.

Context-Based Policy: StrongDM policies that restrict or enable users' ability to connect to AWS cloud resources based on their context can be used to limit availability of your AWS CLI to users in particular geographic locations or with good device trust scores. Policies can also be used to provide an MFA challenge prior to connection, and help solve for many more use cases. For more details, see the Policies section.

This resource type is nearly the same as the AWS (Instance Profile) cloud resource type, except that it supports only static keys for authentication. Please see Configure AWS (Instance Profile) if you wish to use other default authentication methods to manage access to your AWS cloud environment via StrongDM.

Note that this is the method by which to set up your AWS cloud as a resource in StrongDM and manage it with AWS CLI. If you intend to connect to a specific AWS-hosted resource, such as Athena or an EC2 instance, those resources need to be set up separately in the appropriate areas of the Admin UI.

Limitations

Note that sdm aws cli ssm start-session is not currently supported when using the AWS CLI via StrongDM due to an AWS technical limitation. If you wish to use ssm sessions, you can set up the AWS Console resource type and use the web interface to initiate a session with ssm.
The AWS driver does nothing to limit privilege escalation. It is the responsibility of the resource creator not to provide credentials that can be used to create more credentials.

Prerequisites

In StrongDM, you must have the Admin [permission level].
To manage access to your AWS cloud environment via StrongDM, you must have an AWS key pair (Access Key ID and AWS Secret Access Key) prepared. The scope of this key determines which AWS CLI commands your users can execute through StrongDM, so consider that when generating the key. Once you have your AWS key, you can set up a cloud resource in the StrongDM Admin UI.
Your gateways or relays must be running at least version 31.10 to support usage of the AWS CLI to administer your AWS cloud.

Resource Configuration in StrongDM

This section provides instructions for adding the resource in either the StrongDM Admin UI, CLI, Terraform provider, or SDKs.

Set up and Manage With the Admin UI

If using the Admin UI to add the resource to StrongDM, use the following steps.

Log in to the Admin UI and go to Resources > Clouds.
Click Add cloud.
For Cloud Type, set AWS Cloud.
Set all other required resource properties.
Click create to save the resource.
Click the resource name to view status, diagnostic information, and setting details. After the server is created, the Admin UI displays that resource as unhealthy until the health checks run successfully. When the resource is ready, the Health icon indicates a positive, green status.

Set up and Manage With the CLI

This section provides general steps on how to configure and manage the resource using the StrongDM CLI. For more information and examples, please see the CLI Reference documentation.

In your terminal or Command Prompt, log in to StrongDM:
```
sdm login
```

Run sdm admin clouds add aws --help to view the help text for the command, which shows you how to use the command and what options (properties) are available. Note which properties are required and collect the values for them.

NAME:
   sdm admin clouds add aws - create AWS cloud

USAGE:
   sdm admin clouds add aws [command options] <name>

OPTIONS:
   --access-key-id value       (required, secret)
   --bind-interface value      bind interface (default: "127.0.0.1")
   --egress-filter value       apply filter to select egress nodes e.g. 'field:name tag:key=value ...'
   --healthcheck-region value  Enter the AWS region healthcheck requests should attempt to connect to. (required)
   --port-override value       port profile override (default: -1)
   --proxy-cluster-id value    proxy cluster id
   --role-arn value            The role to assume after logging in. (secret)
   --role-external-id value    (secret)
   --secret-access-key value   (required, secret)
   --secret-store-id value     secret store id
   --subdomain value, --bind-subdomain value           DNS subdomain through which this resource may be accessed on clients (e.g. "app-prod" allows the resource to be accessed as "app-prod.<your-org-name>.<sdm-proxy-domain>"). Only applicable to HTTP-based resources or resources using virtual networking mode.
   --tags value                tags e.g. 'key=value,...'
   --template, -t              display a JSON template
   --timeout value             set time limit for command

Then run sdm admin clouds add aws <RESOURCE_NAME> and set all required properties with their values. For example:

$ sdm admin clouds add aws "aws-cloud-prod"
  --access-key-id "AKIAIOSFODNN7EXAMPLE"
  --secret-access-key "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
  --role-arn "arn:aws:iam::123456789012:role/StrongDMAccessRole"
  --role-external-id "ext-id-aws-prod-2025"
  --healthcheck-region "us-west-2"
  --bind-interface "default"
  --port-override -1
  --egress-filter 'field:name tag:env=prod tag:region=us-west'
  --proxy-cluster-id "plc_0123456789abcdef"
  --secret-store-id "ss_abcdef0123456789"
  --subdomain "aws-cloud-prod01"
  --tags "env=prod,cloud=aws,auth=static,team=devops"
  --timeout 30

Check that the resource has been added. The output of the following command should show the resource's name:
```
sdm admin clouds list
```

Set up and Manage With Terraform

This section provides an example of how to configure and manage the resource using the Terraform provider. For more information and examples, please see the Terraform provider documentation.

# Install StrongDM provider
terraform {
  required_providers {
    sdm = {
      source  = "strongdm/sdm"
      version = "5.1.0"
    }
  }
}

# Configure StrongDM provider
provider "sdm" {
  # Add API access key and secret key from the Admin UI
  api_access_key = "njjSn...5hM"
  api_secret_key = "ziG...="
}

# Create AWS cloud resource
resource "sdm_resource" "aws_cloud_prod" {
  aws {
    # Required
    name               = "aws-cloud-prod"                                # <name>
    access_key_id      = "AKIAIOSFODNN7EXAMPLE"                          # --access-key-id (use secret store in prod)
    secret_access_key  = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"      # --secret-access-key (use secret store in prod)
    healthcheck_region = "us-west-2"                                     # --healthcheck-region (region used for health checks)

    # Optional authentication
    role_arn          = "arn:aws:iam::123456789012:role/StrongDMAccess"  # --role-arn (optional)
    role_external_id  = "ext-id-aws-prod-2025"                           # --role-external-id

    # Common networking options
    bind_interface = "default"                                           # --bind-interface ("default" | "loopback" | "vnm")
    port_override  = -1                                                  # --port-override (-1 = auto-allocate)
    egress_filter  = "field:name tag:env=prod tag:region=us-west"        # --egress-filter
    subdomain      = "aws-cloud-prod01"                                  # --subdomain / --bind-subdomain (optional, for VN access)

    # Optional integrations
    proxy_cluster_id = "plc_0123456789abcdef"                            # --proxy-cluster-id
    secret_store_id  = "ss_abcdef0123456789"                             # --secret-store-id (recommended for credentials)

    # Tags
    tags = {                                                             # --tags
      env   = "prod"
      cloud = "aws"
      auth  = "static"
      team  = "devops"
    }
  }
}

Resource Properties

The AWS cloud type has the following properties.

Property

Requirement

Description

Display Name

Required

Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >)

Cloud Type

Required

AWS

Proxy Cluster

Required

Defaults to "None (use gateways)"; if using proxy clusters, select the appropriate cluster to proxy traffic to this resource

Connectivity Mode

Required

Select either Virtual Networking Mode, which lets users connect to the resource with a software-defined, IP-based network; or Loopback Mode, which allows users to connect to the resource using the local loopback adapter in their operating system; this field is shown if Virtual Networking Mode enabled for your organization

IP Address

Optional

If Virtual Networking Mode is the selected connectivity mode, an IP address value in the configured Virtual Networking Mode subnet in the organization network settings; if Loopback Mode is the selected connectivity mode, an IP address value in the configured Loopback IP range in the organization network settings (by default, 127.0.0.1); if not specified, an available IP address in the configured IP address space for the selected connectivity mode will be automatically assigned; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization

Port Override

Optional

If Virtual Networking Mode is the selected connectivity mode, a port value between 1 and 65535 that is not already in use by another resource with the same IP address; if Loopback Mode is the selected connectivity mode, a port value between 1024 to 64999 that is not already in use by another resource with the same IP address; when left empty with Virtual Networking Mode, the system assigns the default port to this resource; when left empty for Loopback Mode, an available port that is not already in use by another resource is assigned; preferred port also can be modified later from the Port Overrides settings

DNS

Optional

If Virtual Networking Mode is the selected connectivity mode, a unique hostname alias for this resource; when set, causes the desktop app to display this resource's human-readable DNS name (for example, k8s.my-organization-name) instead of the bind address that includes IP address and port (for example, 100.64.100.100:5432)

Secret Store

Optional

Credential store location; defaults to none (credentials are stored in StrongDM resource configuration)

Access Key ID

Required

Access key ID, such as AKIAIOSFODNN7EXAMPLE, from your AWS key pair

Secret Access Key

Required

Secret access key, such as wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY, from your AWS key pair

Assume Role ARN

Optional

Amazon Resource Name (ARN) role to assume after login (for example, arn:aws:iam::000000000000:role/RoleName)

Healthcheck Region

Required

AWS region that healthchecks should attempt to connect to (for example, us-west-2)

Assume Role External ID

Optional

External ID role to assume after login (for example 12345)

Resource Tags

Optional

Enter Tags consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev)

Logs

For logs of access to an AWS cloud resource, in the Cloud logs section of the Admin UI (Logs > Cloud), you can find all of the activities of users connected through StrongDM. Note that StrongDM makes an attempt to drop the Authorization header of logs for display in the Admin UI. Note that any secrets displayed in the cloud logs are placeholder values. No actual keys or secrets are ever exposed in plaintext in the Admin UI.

CLI Usage

When the resource is created and configured, you are ready for users to connect to the resource. In order for your organization's users to access the AWS cloud resource via StrongDM, users need to install the following:

The StrongDM Desktop application
The latest version of the StrongDM CLI. If the CLI is already installed, you can run sdm update in the CLI to update it. Alternatively, if any updates are available, you can open the desktop app and click the Upgrade button.
The AWS CLI. We support both v1 and v2 but encourage the use of v2.

After installation, users must set up or update the AWS CLI configuration file to include a region, as explained in the AWS documentation. Once that is done, exit and restart the StrongDM desktop app, and then select the AWS cloud resource to connect to.

Click to connect to the resource in the desktop app, or run sdm connect <RESOURCE> in the CLI. Once connected, users can use aws through StrongDM at their terminal, with the base syntax of sdm aws instead of the usual aws.

You can use sdm aws --help to view example usage and command options:

NAME:
   sdm aws - aws commands

USAGE:
   sdm aws command [command options] [arguments...]

COMMANDS:
   cli        Execute an AWS CLI Command.
   env        Print environment variables required to access an AWS resource.
   run        Execute an external command with environment variables configured for AWS.
   terraform  Execute terraform commands with a SDM AWS proxy.

OPTIONS:
   --name value     The name of the AWS resource to access. By default if there is only one connected AWS resource, that resource is used. [$SDM_AWS_NAME]
   --help, -h  show help

aws cli

The aws cli command is followed by an AWS CLI command that you wish to run against your connected AWS resource. For more information about gcloud CLI commands, see the AWS CLI documentation.

aws env

The aws env command outputs the environment variables that are required in order to access an AWS resource. This output is a similar format of the output of the standard env command, but only contains the relevant environment variables for connecting to AWS.

aws run

The aws run command is followed by a command that you wish to run against the connected resource, which is sent along with the necessary environment variables. An example of a use for aws run would be if you have a pre-existing script for managing AWS resources that uses aws commands. Instead of altering the script to work with StrongDM, you could use aws run shellscript.sh and run the script.

--name

If your organization has multiple AWS cloud resources, and you are connected to more than one at once, you may specify a --name value in commands in order to specify which you intend to execute the command on. For example, sdm aws --name <RESOURCE_NAME> cli. The flag must come before the cli portion of the command in order to preserve the ability to use the command as normal with a single AWS cloud resource connected.

Error Cases

Should you attempt to use a cloud resource when you are not connected to it, StrongDM's CLI commands warn you. You can get around this warning in some contexts (for example, by setting environment variables in your terminal). In these cases, you may encounter SSL errors, and nothing happens when you run commands.

Last updated 18 days ago

Was this helpful?

Overview

Limitations

Prerequisites

Resource Configuration in StrongDM

Set up and Manage With the Admin UI

Set up and Manage With the CLI

Set up and Manage With Terraform

Set up and Manage With SDKs

Resource Properties

Logs

CLI Usage

aws cli

aws env

aws run

--name

Error Cases