Connect AWS Account

Connect your Amazon Web Services account to OEC.sh for enterprise-grade infrastructure management.

What You'll Get

After connecting your AWS account, OEC.sh can:

Prerequisites

Before you begin, ensure you have:

• Active AWS account (Sign up here (opens in a new tab))
• IAM permissions to create users and access keys
• Understanding of AWS IAM (Identity and Access Management)

Connection Method

AWS uses IAM Access Keys for authentication. You'll create a dedicated IAM user with specific permissions for OEC.sh.

Security Best Practice: Never use your root account credentials. Always create a dedicated IAM user with minimal required permissions.

Step-by-Step Connection

Step 1: Create IAM User

1. Sign in to the AWS IAM Console (opens in a new tab)
2. In the left sidebar, click Users
3. Click Create user (top right)
4. Enter user details:
   • User name: oecsh-integration
   • Click Next

Step 2: Set Permissions

Choose one of two approaches:

Option A: Attach Managed Policies (Simpler)

For full capabilities, attach these AWS managed policies:

1. Click Attach policies directly
2. Search and select these policies:

3. Click Next, then Create user

Option B: Custom Policy (More Secure)

For minimal permissions, create a custom policy:

1. Click Attach policies directly
2. Click Create policy
3. Switch to JSON tab
4. Paste this policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "EC2Management",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeInstanceStatus",
        "ec2:DescribeImages",
        "ec2:DescribeKeyPairs",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcs",
        "ec2:DescribeRegions",
        "ec2:DescribeAvailabilityZones",
        "ec2:RunInstances",
        "ec2:TerminateInstances",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:CreateKeyPair",
        "ec2:DeleteKeyPair",
        "ec2:ImportKeyPair",
        "ec2:CreateSecurityGroup",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:CreateTags"
      ],
      "Resource": "*"
    },
    {
      "Sid": "S3Management",
      "Effect": "Allow",
      "Action": [
        "s3:ListAllMyBuckets",
        "s3:GetBucketLocation",
        "s3:CreateBucket",
        "s3:DeleteBucket",
        "s3:ListBucket",
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:GetBucketPolicy",
        "s3:PutBucketPolicy"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Route53Management",
      "Effect": "Allow",
      "Action": [
        "route53:ListHostedZones",
        "route53:GetHostedZone",
        "route53:ListResourceRecordSets",
        "route53:ChangeResourceRecordSets",
        "route53:GetChange"
      ],
      "Resource": "*"
    }
  ]
}

5. Click Next
6. Name the policy: OECshIntegrationPolicy
7. Click Create policy
8. Go back to user creation, refresh policies, and attach your new policy
9. Click Next, then Create user

Step 3: Create Access Keys

1. Click on the newly created user (oecsh-integration)
2. Go to Security credentials tab
3. Scroll to Access keys section
4. Click Create access key
5. Select Third-party service
6. Check the confirmation box
7. Click Next, then Create access key

IMPORTANT: Copy both values immediately - the Secret Access Key is shown only once!

Step 4: Add to OEC.sh

1. Go to app.oec.sh (opens in a new tab) > Settings > Cloud Accounts
2. Click Add Account
3. Under API Key Authentication, click Amazon Web Services
4. Fill in the form:

5. Click Add Account

Step 5: Verify Connection

1. Your AWS account should appear in the list
2. Status should show Active (green badge)
3. Click the refresh icon to validate credentials
4. You should see: Compute, Storage, DNS capability badges

Common AWS Regions

When specifying a default region, use these codes:

Security Best Practices

1. Use Dedicated IAM User

Never use:

• Root account credentials
• Personal IAM user credentials
• Credentials shared with other services

2. Rotate Access Keys Regularly

1. Create a new access key
2. Update OEC.sh with new credentials
3. Delete the old access key
4. Recommended: Every 90 days

3. Enable MFA for IAM User

While OEC.sh uses access keys (not console login), enabling MFA on the IAM user adds protection against unauthorized console access.

4. Use Resource Tags

OEC.sh adds tags to resources it creates:

• CreatedBy: OECsh
• Environment: <environment-name>

You can create IAM policies that restrict OEC.sh to only manage tagged resources.

5. Consider VPC Restrictions

For enhanced security, restrict EC2 actions to specific VPCs:

{
  "Condition": {
    "StringEquals": {
      "ec2:Vpc": "arn:aws:ec2:region:account:vpc/vpc-id"
    }
  }
}

Using Your AWS Account

For Server Provisioning

1. Go to Servers > Add Server
2. Choose Provision from Cloud
3. Select your AWS account
4. Choose:
   • Region (e.g., us-east-1)
   • Instance type (e.g., t3.medium)
   • VPC and subnet (if multiple available)
5. Click Provision

For Backup Storage

1. Go to Settings > Storage
2. Click Quick Setup on your AWS account (or Add Storage)
3. Select an existing S3 bucket or create new
4. Configure backup prefix (folder path in bucket)

For DNS Management

1. Go to Settings > DNS Providers
2. Click Quick Setup on your AWS account
3. Select a Route53 hosted zone
4. OEC.sh will manage A records for your domains

Troubleshooting

"Invalid credentials" Error

Cause: Access Key ID or Secret is incorrect.

Solution:

1. Verify you copied the complete Secret Access Key
2. Check for leading/trailing spaces
3. Confirm the access key is still active in IAM console
4. Create new access keys if needed

"Access Denied" Errors

Cause: IAM user lacks required permissions.

Solution:

1. Check the IAM user's attached policies
2. Use AWS Policy Simulator (opens in a new tab) to test permissions
3. Attach the missing managed policies or update custom policy

EC2 Instance Launch Fails

Cause: Could be region limits, VPC issues, or AMI availability.

Solutions:

1. Service Quotas: Check EC2 instance limits in Service Quotas console
2. VPC: Ensure the region has a default VPC or specify subnet
3. AMI: Verify the selected Ubuntu AMI exists in your region
4. Payment: Confirm your AWS account is not suspended

S3 Bucket Access Denied

Cause: Bucket policy or ACL restrictions.

Solution:

1. Check bucket permissions in S3 console
2. Verify bucket isn't in a different account
3. Ensure no bucket policy blocks the IAM user

Route53 Zone Not Found

Cause: Hosted zone doesn't exist or is in a different account.

Solution:

1. Verify the domain's hosted zone exists in Route53
2. Ensure the domain is registered and delegated to Route53 nameservers
3. Check you're using the correct AWS account

Cost Considerations

AWS charges for resources created by OEC.sh:

Tips to minimize costs:

• Use Reserved Instances for production servers
• Enable S3 lifecycle policies for old backups
• Stop non-production instances when not in use

Next Steps

• Provision your first EC2 server
• Configure S3 backup storage
• Set up Route53 DNS