AWS Cloud
Browse community images, manage private AMIs, and deploy EC2 instances
AWS takes its credentials from BeyondTrust Workload Credentials, so there is no static key to fix here. Check the personal access token and the dynamic-secret names under Settings → Preview features → Workload Credentials, then use Check on that panel to see the state of each lease.
Make sure AWS CLI is configured: aws configure
Community Images
Free-tier-compatible public AMIs from Amazon, Canonical, and Debian. Copy one to your account to use it as a private AMI.
| OS | Name | AMI ID | Arch | Size | Created | Actions |
|---|---|---|---|---|---|---|
| ✓ |
Private AMIs
AMIs owned by your AWS account, including any copied from community images.
| AMI Name | AMI ID | State | Arch | Size | Created | Actions | |
|---|---|---|---|---|---|---|---|
| ⚠ No ENA ✓ ENA |
Deployed EC2 Instances
| Status | Name | Instance ID | Type | Region | Public IP | Private IP | Launched | Actions |
|---|---|---|---|---|---|---|---|---|
| No instances in . | ||||||||
Copy to Private AMI
SSH Key
Key pair:
Key not found
Store the .pem contents in Secrets Manager with the name shown above, then try again.
Replace <key-file> with the path to your saved .pem file,
and adjust the username for your AMI (e.g. ubuntu,
ec2-user, admin).
Save Instance as Image
·
Deploy AMI
Edit to deploy from any AMI ID your AWS account can access (Marketplace, BYOL, cross-account share, etc.).
⚠ This AMI ID is not among the images
owns. AMI IDs are
per-region — if it isn't shared with your account in that region the launch
will fail with InvalidAMIID.NotFound.
⚠ This AMI does not have ENA enabled
The selected instance type ()
requires Enhanced Networking (ENA). This deployment will fail unless you first click
Enable ENA (creates a new -ena copy of the AMI), or select a t2.* instance type instead.
Bulk Deploy AMIs
deployments queued successfully!
Each instance is deploying in the background. Track each job below.
Edit the name for each instance before launching.
⚠ of these AMIs are not owned by . AMI IDs are per-region — copy them to that region first, or pick the region they were listed in.
No security groups found.
Select at least one security group.
Any Secrets Manager secret. Must be JSON with a public_key — validated on launch.
BeyondTrust PRA options — shared; fall back to the configured defaults.
No PRA jump groups/Gateways returned — the shell jump falls back to the configured defaults.
Overrides bt_client_secret for this batch's shell jumps.
Requires Entitle registration enabled; private instances also need a provisioned Entitle agent.
Requires Password Safe registration enabled. AWS uses the cloud-native AWS Systems Manager plugin by default (configurable in Settings → Integrations → BeyondTrust).
Build AMI with Packer
Provision a source AMI with a shell script and register the result as a new private AMI in your account. Runs as a tracked background job (typically 5–15 min).
A preset resolves to the newest public AMI of that family at build time (like the GCP build's source family) — or paste any AMI ID from your account or the AWS console.
Shell script run on the build instance. Leave empty to build a base image with no provisioning.
Loaded from ; edit in place if needed.
BeyondTrust provisioner options — used by the bt-ready scripts; ignored by other provisioners.
Storage pins the version you synced and doesn't need BeyondTrust reachable from the build — sync it first on the Storage page. Not available on local-filesystem storage.
EPM-L is installed at build; activation runs post-deploy via the EPM-L integration.
Environment variables — passed to the provisioner script.
Secret refs are resolved at build start and passed via Packer sensitive variables — never written to the generated or archived template.
OT Demo Cell
Deploy a simulated plant cell — a Modbus PLC simulator (:502) + FUXA web HMI (:1881) from the Packer-baked ot-sim AMI — into the private sandbox subnet, with BeyondTrust access auto-wired: Web Jump → HMI, protocol tunnel → PLC port, plus the Shell Jump and optional Password Safe onboarding every EC2 deploy gets. Bake the AMI first on the Build Image tab (Debian 12 preset + provisioners/ot/ot-sim-debian.sh).
Deploy a cell
No ot-sim AMI yet — build one on the Build Image tab, or tick "show all".
Pick the PRIVATE sandbox subnet — EC2 has no per-instance public-IP switch here, and a public cell deflates the air-gap story.
No security groups found.
The cell simulates all of these at once — each gets its own PRA protocol tunnel, so access can be granted per vendor. Protocols the image does not simulate (e.g. DNP3) stay available on the standalone tunnel card below.
BeyondTrust PRA placement — where the cell's jump items land; defaults are the configured bt_jump_group_name / bt_jumpoint_name.
Pick the pair matching the cell's region. With a Gateway override the deploy skips the shared-gateway size check — the host behind that Gateway needs ≥2 GB RAM for the Web Jump.
The gateway backing the Web Jump needs ≥2 GB RAM (bt_ecs_host_instance_type t3.small minimum, t3.medium preferred — Settings → Integrations → Privileged Remote Access) — the deploy checks and refuses early with the remedy otherwise.
Cells
No OT cells yet.
Standalone OT Protocol Tunnel
A generic-TCP PRA protocol tunnel to any host the gateway can reach — for demoing against your own lab gear without deploying a cell.