AWS (EC2)

Thinfinity® Cloud Manager connects to Amazon Web Services using long-term IAM credentials — an Access Key ID and Secret Access Key — scoped to an IAM user with EC2 permissions. This article documents the Cloud Manager credential form for AWS, the minimum permissions the IAM user must have, and common configuration errors.

Info

All API calls from Cloud Manager originate from the Thinfinity® Workspace server. Ensure outbound HTTPS (port 443) is open from that host to ec2.<region>.amazonaws.com. See Prerequisites for the full network requirements.

Prerequisites

Before adding AWS credentials in Cloud Manager, the following must be in place on the AWS side:

An IAM user with programmatic access enabled. Cybele Software recommends a dedicated IAM user rather than an administrative or root account.
An Access Key ID and Secret Access Key generated for that user. The secret key is shown only once at creation — store it in a secrets manager.
The IAM user must have the EC2 permissions listed in Minimum IAM Permissions below.
The target EC2 instances must reside in a region reachable from the Thinfinity Workspace server, and EC2 service quotas in that region must be sufficient for the number of instances you plan to manage or provision.

For how to create an IAM user, generate an access key, and attach a policy, refer to the AWS IAM documentation.

Minimum IAM Permissions

The IAM user must be granted the following EC2 actions. Attach them as a custom inline policy or a managed policy.

Action	Required For
`ec2:DescribeInstances`	All operations
`ec2:DescribeInstanceStatus`	All operations
`ec2:DescribeRegions`	All operations
`ec2:DescribeAvailabilityZones`	All operations
`ec2:DescribeImages`	All operations
`ec2:DescribeKeyPairs`	All operations
`ec2:DescribeSecurityGroups`	All operations
`ec2:DescribeSubnets`	All operations
`ec2:DescribeVpcs`	All operations
`ec2:DescribeTags`	All operations
`ec2:StartInstances`	All operations
`ec2:StopInstances`	All operations
`ec2:RebootInstances`	All operations
`ec2:CreateTags`	All operations
`ec2:RunInstances`	VDI/DaaS Models only (provisioning new instances)
`ec2:TerminateInstances`	VDI/DaaS Models only (provisioning new instances)

Info

If Cloud Manager will only manage existing VMs (Managed VMs), ec2:RunInstances and ec2:TerminateInstances can be omitted. To further restrict the policy to a specific region or resource set, replace the wildcard resource with an ARN condition — see the AWS IAM policy reference.

Authentication Method

Cloud Manager authenticates to AWS exclusively with the IAM Access Key ID and Secret Access Key pair. IAM Roles attached to the underlying EC2 instance, AWS STS temporary credentials, and AssumeRole flows are not currently supported — always create a dedicated IAM user with long-term keys for Cloud Manager.

Add the Credentials in Cloud Manager

In Cloud Manager, go to Credentials and click + New.
Select AWS as the provider.
Fill in the fields below and click Save.

For the full Add / Edit / Delete procedure, see Managing Credentials.

AWS Credential Fields

Cloud Manager validates the Access Key and Secret Key values client-side against the AWS format. The Access Key is 20 characters from the uppercase letters and digits alphabet and starts with AK. The Secret Key is 40 characters from the base64 alphabet (uppercase and lowercase letters, digits, /, and +).

Field	Description
Access Key	The Access Key ID for the IAM user. Acts as the public identifier. Example: `AKIAIOSFODNN7EXAMPLE`.
Secret Key	The Secret Access Key for the IAM user. Used to sign API requests. Never displayed again after creation in the AWS console.
Region	Dropdown of AWS regions. Select the region where your target EC2 instances reside (e.g., `us-east-1`, `eu-west-1`). Cloud Manager uses this region as the default for all API calls associated with this credential set.

Info

Each credential set in Cloud Manager is scoped to a single AWS region. To manage EC2 instances in multiple regions, create one credential set per region.

Verification

After saving, Cloud Manager validates the credentials by calling ec2:DescribeInstances against the selected region. If validation succeeds, the credential status shows as Ok. If it fails, review the error message and refer to Common Errors below.

Common Errors

Error	Likely Cause	Resolution
`AuthFailure` / `InvalidClientTokenId`	Access Key ID is incorrect or has been deactivated.	Verify the key in the AWS IAM console. Regenerate if necessary.
`SignatureDoesNotMatch`	Secret Access Key is incorrect.	Secret keys cannot be retrieved — delete the key pair in AWS and create a new one.
`UnauthorizedOperation`	The IAM user lacks one or more required permissions.	Review the IAM policy attached to the user against the Minimum IAM Permissions table.
`AuthorizationFailure` (region)	The selected region is not enabled for the AWS account.	Enable the region in AWS account settings, or select a different region.
Connection timeout / no response	The Workspace server cannot reach `ec2.<region>.amazonaws.com:443`.	Check firewall rules and proxy settings on the Workspace server. See Prerequisites.

Security Recommendations

Rotate keys regularly. AWS IAM supports up to two active access keys per user, allowing zero-downtime rotation. Update the credentials in Cloud Manager immediately after rotation.
Do not use root account credentials. Always use a dedicated IAM user with the minimum required permissions.
Monitor API usage. Enable AWS CloudTrail in the target region to audit all API calls made by the Cloud Manager IAM user.

See Also