Connect your AWS account

Step 1 Create the IAM policy

Sign in to the AWS Management Console and open IAM. In the left menu, choose Policies, then Create policy.

In the Policy editor, switch to JSON, delete the example and paste the policy below. Choose Next, name the policy (for example NuvloServers) and choose Create policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "NuvloRead",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeImages",
        "ec2:DescribeInstanceTypeOfferings",
        "ec2:DescribeInstances",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVolumes",
        "ec2:DescribeVpcs",
        "pricing:GetProducts"
      ],
      "Resource": "*"
    },
    {
      "Sid": "NuvloUbuntuImageLookup",
      "Effect": "Allow",
      "Action": "ssm:GetParameters",
      "Resource": "arn:aws:ssm:*::parameter/aws/service/canonical/ubuntu/server/*"
    },
    {
      "Sid": "NuvloCreate",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateImage",
        "ec2:CreateSecurityGroup",
        "ec2:RunInstances"
      ],
      "Resource": "*"
    },
    {
      "Sid": "NuvloTagOnCreate",
      "Effect": "Allow",
      "Action": "ec2:CreateTags",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:CreateAction": [
            "CreateImage",
            "CreateSecurityGroup",
            "RunInstances"
          ]
        }
      }
    },
    {
      "Sid": "NuvloManagedResourcesOnly",
      "Effect": "Allow",
      "Action": [
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:DeleteSnapshot",
        "ec2:DeregisterImage",
        "ec2:ModifyInstanceAttribute",
        "ec2:ModifyInstanceCreditSpecification",
        "ec2:RebootInstances",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:TerminateInstances"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/nuvlo:managed": "true"
        }
      }
    }
  ]
}

The same policy is in Nuvlo’s Connect AWS dialog, with a button that copies it.

What the policy allows:

• Read: list Ubuntu images, instance types, instances, security groups, subnets, volumes and VPCs, and read AWS list prices so Nuvlo can show what each plan costs.
• Create: launch instances, create the nuvlo security group and take snapshots. Everything is tagged nuvlo:managed when it is created.
• Change and delete: only on resources tagged nuvlo:managed.

Step 2 Create an IAM user for Nuvlo

In IAM, choose Users, then Create user. Name it something you will recognize, such as nuvlo. Leave console access turned off: this user only needs an access key.

On the permissions page, choose Attach policies directly, search for the policy you created in step 1, select it and choose Next. Then choose Create user.

Step 3 Create an access key

Open the new user and go to the Security credentials tab. Under Access keys, choose Create access key.

AWS asks for a use case. Choose Other and then Next. You can add a description such as “Nuvlo”, then choose Create access key.

On the Retrieve access keys page, copy the Access key ID and the Secret access key, or choose Download .csv file. AWS shows the secret only once. If you lose it, create a new access key and replace it in Nuvlo (see “Replace or remove the key” below).

Step 4 Open Server providers in Nuvlo

In Nuvlo, open Integrations → Server providers (go there). Choose Add provider, then AWS.

Step 5 Enter the access key

The Connect AWS dialog asks for:

• Account label (optional): a name for this connection, such as “AWS Production”. If you leave it empty, Nuvlo calls it “AWS key”.
• Access key ID: starts with AKIA.
• Secret access key: the secret from step 3.

Choose Connect account. Nuvlo checks the key with AWS before it saves anything.

Step 6 Check that the account is connected

The account now appears under Connected accounts with the status Not in use. It changes to In use once a server is linked to it.

Step 7 Create your first AWS server

Open Servers and create a server (start here). Choose AWS as the provider and the account you connected, then choose what you will host.

On Region & plan, pick a region and an instance type. The monthly price includes the instance, its public IPv4 address and a 30 GB gp3 disk. Outbound traffic is billed by AWS per GB, so the Transfer column shows Billed per GB.

Finish the remaining steps and choose Create server. The full walkthrough is in Create a server.