AWS Cloud
Browse community images, manage private AMIs, and deploy EC2 instances
AWS takes its credentials from BeyondTrust Workload Credentials, so there is no static key to fix here. Check the personal access token and the dynamic-secret names under Settings → Integrations → BeyondTrust → Workload Credentials, then use Check on that panel to see the state of each lease.
Make sure AWS CLI is configured: aws configure
Community Images
Free-tier-compatible public AMIs from Amazon, Canonical, and Debian. Copy one to your account to use it as a private AMI.
| OS | Name | AMI ID | Arch | Size | Created | Actions |
|---|---|---|---|---|---|---|
| ✓ |
Private AMIs
AMIs owned by your AWS account, including any copied from community images.
| AMI Name | AMI ID | State | Arch | Size | Created | Actions | |
|---|---|---|---|---|---|---|---|
| ⚠ No ENA ✓ ENA |
Deployed EC2 Instances
| Status | Name | Instance ID | Type | Region | Public IP | Private IP | Launched | Actions | |
|---|---|---|---|---|---|---|---|---|---|
| No instances in . | |||||||||
|
|
|||||||||
Copy to Private AMI
Export to portable VHD
Administrator password
SSH Key
Key pair:
Key not found
Store the .pem contents in Secrets Manager with the name shown above, then try again.
Replace <key-file> with the path to your saved .pem file,
and adjust the username for your AMI (e.g. ubuntu,
ec2-user, admin).
Save Instance as Image
·
Deploy AMI
Edit to deploy from any AMI ID your AWS account can access (Marketplace, BYOL, cross-account share, etc.).
⚠ This AMI ID is not among the images
owns. AMI IDs are
per-region — if it isn't shared with your account in that region the launch
will fail with InvalidAMIID.NotFound.
⚠ This AMI does not have ENA enabled
The selected instance type ()
requires Enhanced Networking (ENA). This deployment will fail unless you first click
Enable ENA (creates a new -ena copy of the AMI), or select a t2.* instance type instead.
Bulk Deploy AMIs
deployments queued successfully!
Each instance is deploying in the background. Track each job below.
Edit the name for each instance before launching.
⚠ of these AMIs are not owned by . AMI IDs are per-region — copy them to that region first, or pick the region they were listed in.
No security groups found.
Select at least one security group.
Any Secrets Manager secret. Must be JSON with a public_key — validated on launch.
BeyondTrust PRA options — shared; fall back to the configured defaults.
No PRA Asset Groups/Gateways returned — the shell jump falls back to the configured defaults.
Overrides bt_client_secret for this batch's shell jumps.
Requires Entitle registration enabled; private instances also need a provisioned Entitle agent.
Requires Password Safe registration enabled. AWS uses the cloud-native AWS Systems Manager plugin by default (configurable in Settings → Integrations → BeyondTrust).
After the deploy, a follow-up job onboards the server to Azure Arc over OpenSSH and installs AADLoginForWindows, so Entra users with Virtual Machine Administrator/User Login can RDP in. Needs Windows Server 2025 or later with Desktop Experience and outbound 443 to Azure. A server joins Entra ID or an AD domain, not both. Hybrid join: the server joins the on-prem domain picked above, into its synced OU, and Entra Connect brings it into Entra ID; a follow-up check watches for it.
Windows servers get a PRA Shell Jump over OpenSSH (port 22, PowerShell), switched on at first boot. Tick this for a Remote RDP jump as well. If OpenSSH does not come up, the server gets an RDP jump anyway and the job says why.
Starts at this time, and is marked missed if it has not started within the grace period — it will never run late.
No change windows are defined yet. An administrator can add them in Settings.
Next:
–
UTC
Build AMI with Packer
Provision a source AMI with a shell script and register the result as a new private AMI in your account. Runs as a tracked background job (typically 5–15 min).
A preset resolves to the newest public AMI of that family at build time (like the GCP build's source family) — or paste any AMI ID from your account or the AWS console.
Shell script run on the build instance. Leave empty to build a base image with no provisioning.
Loaded from ; edit in place if needed.
BeyondTrust provisioner options — used by the bt-ready scripts; ignored by other provisioners.
Storage pins the version you synced and doesn't need BeyondTrust reachable from the build — sync it first on the Storage page. Not available on local-filesystem storage.
EPM-L is installed at build; activation runs post-deploy via the EPM-L integration.
Environment variables — passed to the provisioner script.
Secret refs are resolved at build start and passed via Packer sensitive variables — never written to the generated or archived template.
Starts at this time, and is marked missed if it has not started within the grace period — it will never run late.
No change windows are defined yet. An administrator can add them in Settings.
Next:
–
UTC
OT Demo Cell
Deploy a simulated plant cell — a Modbus PLC simulator (:502) + FUXA web HMI (:1881) from the Packer-baked ot-sim AMI — into the private sandbox subnet, with BeyondTrust access auto-wired: Web Jump → HMI, protocol tunnel → PLC port, plus the Shell Jump and optional Password Safe onboarding every EC2 deploy gets. Bake the AMI first on the Build Image tab (Debian 12 preset + provisioners/ot/ot-sim-debian.sh).
Deploy a cell
No ot-sim AMI yet — build one on the Build Image tab, or tick "show all".
Pick the PRIVATE sandbox subnet — EC2 has no per-instance public-IP switch here, and a public cell deflates the air-gap story.
No security groups found.
What the image you picked was baked with. The dashboard cannot read this off an image — both runtimes produce an ot-sim image — so it is your assertion, and it decides whether the cell's own platform endpoints can be brokered at all.
The cell itself
The cell simulates every PLC protocol at once — each gets its own PRA protocol tunnel, so access can be granted per vendor. It also runs those simulators on k3s, so the cell's own Kubernetes API can be brokered the same way: a recorded kubectl into the plant cluster, with no other route in. Protocols the image does not simulate (e.g. DNP3) stay available on the standalone tunnel card below.
BeyondTrust PRA placement — where the cell's jump items land; defaults are the configured bt_jump_group_name / bt_jumpoint_name.
Pick the pair matching the cell's region. With a Gateway override the deploy skips the shared-gateway size check — the host behind that Gateway needs ≥2 GB RAM for the Web Jump.
The agent that brokers this access runs in the plant, on its own industrial-DMZ host deployed beside the cell — not in a cluster somewhere else. On AWS the two zones are security groups, and the cell's replaces the ones you picked above: groups union their allows, so a zone that merely joined them would restrict nothing. Needs the Purdue zoning on (ot_purdue_firewall_enabled) and the Gateway host's group in bt_ecs_jumpoint_security_group_id; the deploy refuses with the remedy if anything is missing.
No AMI with broker in its name yet — bake one with OT_ROLE=broker and name it e.g. ot-broker (see provisioners/ot/README.md), or tick "show all".
8 GB or more: the agent requests 1Gi on its own.
The gateway backing the Web Jump needs ≥2 GB RAM (bt_ecs_host_instance_type t3.small minimum, t3.medium preferred — Settings → Integrations → Privileged Remote Access) — the deploy checks and refuses early with the remedy otherwise.
Cells
No OT cells yet.
Standalone OT Protocol Tunnel
A generic-TCP PRA protocol tunnel to any host the gateway can reach — for demoing against your own lab gear without deploying a cell.
Edit tags
Nothing removable — the tags on this selection are the dashboard's own.
Updated .
Queued for agent — this connection is reached through one, so the change lands when the job runs.
— view job
could not be updated:
—
already had it.
PRA access —
Creates a BeyondTrust PRA Shell Jump to this VM, so you reach it over SSH through the representative console. Blank fields use the configured defaults. Destroying the VM removes the jump.
This VM has Shell Jump . Re-apply replaces it with one built from the options below.
PRA is not configured (bt_api_host / bt_client_id / bt_client_secret). Set it on Settings — the dropdowns stay empty and the job will fail until then.
Resolved to a bt_client_secret override for this jump's provisioning.