# EC2 Cloud Connector

<figure><img src="https://3357255970-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fb7weUpu7VBcMnESSH8vG%2Fuploads%2FCEMfhZlTpq56ZOIHBfOw%2FKCM-AWSEC2.jpg?alt=media&#x26;token=e9ee2d80-a0cc-4470-8383-802271f29ad7" alt=""><figcaption></figcaption></figure>

## About

You can store SSH Keys and Windows passwords in your Keeper vault for connecting to EC2 instances alongside the KCM Cloud Connector.

See the [AWS EC2 Discovery documentation](/en/keeper-connection-manager/vault-integration/ec2-cloud-connector.md) for more details on connecting KCM with AWS EC2 instances.

## Setup

### Enable

The feature must first be enabled using either the Docker environment variable or the guacamole properties.

#### Docker Environment Variable

For Auto Docker Install and Docker Compose Install methods, in the `keeper/guacamole-db-mysql` image, a new environmental variable must be defined:

`AWS_DISCOVERY_KSM_CONFIG`

This must contain a Keeper Secrets Manager configuration. It can be the same config used with the `KSM_CONFIG` variable.

For example:

```
    guacamole:
        image: keeper/guacamole:2
        restart: unless-stopped
        ......
        AWS_DISCOVERY_KSM_CONFIG: "eyJob3N0bmFtZSI6ICJrZWVwZX.....=="
```

For Advanced Linux Install method, update the guacamole.properties file.

<table><thead><tr><th width="269.3333333333333">Property Name</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><code>aws-discovery-ksm-config</code></td><td>false</td><td>Enable the use of Cloud Connect credentials from KSM connected vaults</td></tr></tbody></table>

#### Remove volume mount for PEM key files

If you are using Keeper to store the PEM key files, you can remove the volume mount in the Docker Compose file that references the location `/var/lib/guac_keys/` as this will not be used.

### Configure a Record for use with Cloud Connect

The EC2 cloud connector recognizes Keeper records with specific fields automatically.

To create a record for use with the EC2 Cloud connector, you can either create a record that contains a pem file attachment containing your key, or a record that contains the key as text.

### PEM File Record

Create a new record which will contain the pem file. The File Attachment record type is a good match, but any type other than General will work.

The record can have any title, In this example we're using "AWS key: my-machine"

<figure><img src="https://3357255970-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fb7weUpu7VBcMnESSH8vG%2Fuploads%2FN50OmXOsnTUHFud8yvQR%2Fimage.png?alt=media&#x26;token=aad2beba-71ab-4224-92c4-073fd9a7c08b" alt=""><figcaption><p>Create a new record to attach your pem file to</p></figcaption></figure>

With the record created, attach the pem file.

<figure><img src="https://3357255970-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fb7weUpu7VBcMnESSH8vG%2Fuploads%2FltSBtMIzqWNy6e2Q7781%2Fimage.png?alt=media&#x26;token=991fec1f-3705-4941-a38e-e4b9c8ab8c3a" alt=""><figcaption><p>Attach your pem file to the new record</p></figcaption></figure>

{% hint style="info" %}
Optionally, if you include a Hostname/IP and Port field in your record, KCM will automatically associate the pem file with EC2 connections having a matching Hostname/IP.
{% endhint %}

Lastly, ensure that the new record is in a shared folder that is accessible to KCM via the Secrets Manager vault connection.

<figure><img src="https://3357255970-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fb7weUpu7VBcMnESSH8vG%2Fuploads%2F5cb6vD6IEixcgFnbFP9L%2Fimage.png?alt=media&#x26;token=42e42c48-e364-4136-a42c-a1c907fee3d4" alt=""><figcaption><p>Move the new record to a shared folder attached to Secrets Manager</p></figcaption></figure>

### Private Key Record

Create a new record which will contain your machine's private key. The record is required to have a "private key" field. The SSH standard record type can be used for this.

The record can have any title.

<figure><img src="https://3357255970-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fb7weUpu7VBcMnESSH8vG%2Fuploads%2FhMIYfDgvG5k3rCcnnCxL%2Fimage.png?alt=media&#x26;token=3f8e1cb2-bea5-46c8-862b-3190f7e5bf26" alt=""><figcaption><p>Create a new record with a private key field (standard SSH type works)</p></figcaption></figure>

The new record will need a custom text field named "Instance ID". Add a "Text" type custom field from the Custom Field menu, click "Edit Label" and enter "Instance ID".

{% hint style="info" %}
The Instance ID field can also be titled anything which begins with "AWS" or "EC2"
{% endhint %}

<figure><img src="https://3357255970-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fb7weUpu7VBcMnESSH8vG%2Fuploads%2F9qHQBnsk78fgqHbNqKyM%2Fimage.png?alt=media&#x26;token=3ed65ed0-f85c-4364-a87f-b855855ee011" alt=""><figcaption><p>Add a custom text field labeled "ID Instance"</p></figcaption></figure>

With the record ready, enter your machine's private key into the Private Key field, and your AWS instance ID in the new custom field.

Lastly, make sure that the record is in a shared folder that is accessible to KCM via Secrets Manager integration.

<figure><img src="https://3357255970-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fb7weUpu7VBcMnESSH8vG%2Fuploads%2FDd1qDwNALb3nDauPJ694%2Fimage.png?alt=media&#x26;token=b9677e2b-d3ec-4c14-b27b-23c0853d11c2" alt=""><figcaption><p>Fill in the record details and place the record in a Secrets Manager accessible shared folder</p></figcaption></figure>

{% hint style="info" %}
Optionally, if you include a Hostname and Port field in your record, KCM will automatically associate the private key with EC2 connections with a matching IP address
{% endhint %}

{% hint style="success" %}
The record is now complete, and will be picked up automatically by KCM if the feature is enabled.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/en/keeper-connection-manager/vault-integration/ec2-cloud-connector.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.