Skip to main content

Cloud Provider Setup | AWS, GCP, and Azure Configuration Guide

This guide provides detailed setup instructions for integrating AWS, Google Cloud Platform (GCP), and Microsoft Azure with Nife VM Management.

AWS Setup Guide​

Prerequisites​

  • AWS account with billing enabled
  • IAM user with appropriate permissions
  • EC2 instances already created in your AWS account

Instead of using root credentials, create a dedicated IAM user for Nife.

  1. Log in to AWS Console

  2. Create New User

    • Click Create user
    • Enter username: nife-vm-management (or your preference)
    • Click Next

  3. Set Permissions

    • Select Attach policies directly
    • Search for and attach: AmazonEC2FullAccess
    • Optionally: Create custom policy with minimal permissions (see below)
    • Click Next

  4. Review and Create

    • Review user details
    • Click Create user

Step 2: Create Access Keys​

  1. Select the User

    • Click on the user you just created
    • Go to Security credentials tab

  2. Generate Access Key

    • Scroll to Access keys section
    • Click Create access key
    • Select Command Line Interface (CLI)
    • Check the confirmation checkbox
    • Click Next

  3. Save Credentials

    • Copy Access Key ID (starts with AKIA)
    • Copy Secret Access Key
    • Important: Save these securely; you won't see the secret key again
    • Download CSV file as backup

  4. Complete

    • Click Done

Step 3: Find Your EC2 Instance Details​

  1. Navigate to EC2 Dashboard

    • Go to EC2 → Instances

  2. Note Instance Information

    • Instance ID: Shows as i-xxxxxxxxxxxx
    • Region: Displayed at top (e.g., us-east-1)
    • Availability Zone: Shows as zone within region

  3. Gather Information

    • Instance ID
    • Region (e.g., us-east-1, us-west-2)
    • Ensure instance is in Running state

AWS IAM Policy (Minimal Permissions)​

For security, create a custom policy with only necessary permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeInstanceStatus",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:RebootInstances",
        "ec2:DescribeRegions",
        "ec2:DescribeSnapshots",
        "ec2:CreateSnapshot",
        "ec2:DescribeVolumes",
        "ec2:DescribeSecurityGroups"
      ],
      "Resource": "*"
    }
  ]
}

Troubleshooting AWS Setup​

Invalid Access Key Error

  • Verify Access Key ID format (starts with AKIA)
  • Check Secret Key for typos
  • Ensure user is not disabled
  • Verify user has EC2 permissions

Instance Not Found

  • Confirm instance exists in AWS console
  • Verify instance is in the correct region
  • Check instance ID format (should be i-xxxx)
  • Ensure instance is not terminated

Permission Denied Error

  • Verify IAM user has EC2 permissions
  • Check if attached policy is active
  • Verify access keys are from correct user
  • Wait 1-2 minutes for IAM changes to propagate

GCP Setup Guide​

Prerequisites​

  • Google Cloud Platform account
  • Active project with billing enabled
  • Compute Engine API enabled
  • Existing VM instances in your project

Step 1: Enable Compute Engine API​

  1. Go to Google Cloud Console

  2. Select Your Project

    • Click project selector at top
    • Choose or create a project

  3. Enable API

    • Go to APIs & Services → Library
    • Search for "Compute Engine API"
    • Click on it
    • Click Enable

  4. Wait for Activation

    • API activation takes a few moments
    • Proceed once enabled

Step 2: Create Service Account​

  1. Go to Service Accounts

    • Navigate to APIs & Services → Credentials
    • Click Create Credentials → Service Account

  2. Fill Service Account Details

    • Service account name: nife-vm-management (or your choice)
    • Service account ID: Auto-generated
    • Description: "Service account for Nife VM Management"
    • Click Create and Continue

  3. Grant Permissions

    • Select role: Compute Instance Admin (v1)
    • This grants necessary permissions for VM management
    • Click Continue

  4. Complete Creation

    • Click Done
    • Service account is now created

Step 3: Create and Download Service Account Key​

  1. Open Service Account

    • Go to APIs & Services → Credentials
    • Under "Service Accounts," click on your service account

  2. Go to Keys

    • Click Keys tab
    • Click Add Key → Create new key

  3. Select JSON Format

    • Choose JSON format
    • Click Create
    • File automatically downloads (keep it safe)

  4. Secure the Key

    • Important: This file contains sensitive credentials
    • Store it securely
    • Never commit to version control
    • Don't share with others

Step 4: Find Your Instance Details​

  1. Go to Compute Engine

    • Navigate to Compute Engine → VM instances

  2. Note Instance Information

    • Instance Name: Click instance to see details
    • Zone: Shows in the instances list (e.g., us-central1-a)
    • Copy these details for later

  3. Verify Permissions

    • Service account has permission to access instances
    • Usually automatic within same project

GCP Security Best Practices​

  1. Rotate Keys Regularly: Create new keys every 90 days
  2. Disable Unused Keys: Remove old service account keys
  3. Monitor Access: Check Cloud Audit Logs
  4. Use Resource Hierarchy: Organize projects and folders
  5. Minimal Permissions: Only grant necessary roles

Troubleshooting GCP Setup​

Service Account Key Upload Fails

  • Verify JSON file is valid
  • Check file isn't corrupted
  • Try downloading key again
  • Ensure file size is reasonable (1-3 KB)

Instance Not Found

  • Confirm instance exists in Compute Engine
  • Verify instance is in the correct zone
  • Check instance name spelling
  • Ensure instance is not deleted

Permission Denied Error

  • Verify service account has Compute Instance Admin role
  • Check project has Compute Engine API enabled
  • Confirm service account is in correct project
  • Wait 1-2 minutes for IAM changes

API Not Enabled

  • Go to APIs & Services → Library
  • Search "Compute Engine"
  • Click Enable if not already enabled

Azure Setup Guide​

Prerequisites​

  • Microsoft Azure account with active subscription
  • Administrator access to Azure AD
  • Existing Virtual Machines in your subscription
  • Azure CLI installed (optional but helpful)

Step 1: Get Subscription and Tenant Information​

  1. Navigate to Azure Portal

  2. Find Subscription ID

    • Click on Subscriptions (or search for it)
    • Copy your Subscription ID (GUID format)

  3. Find Tenant ID

    • Click on Azure Active Directory
    • Click Properties
    • Copy Tenant ID (also called Directory ID)

Step 2: Create Service Principal​

  1. Go to Azure Active Directory

    • Click Azure Active Directory in portal
    • Click App registrations
    • Click New registration

  2. Register Application

    • Name: nife-vm-management (or your choice)
    • Supported account types: "Accounts in this organizational directory"
    • Click Register

  3. Copy Application Credentials

    • Copy Application (client) ID
    • Copy Directory (tenant) ID
    • Save these values

Step 3: Create Client Secret​

  1. Go to Certificates & secrets

    • In your app registration, click Certificates & secrets
    • Click New client secret

  2. Create Secret

    • Description: nife-vm-management
    • Expires: Select appropriate duration (24 months recommended)
    • Click Add

  3. Copy Secret

    • Immediately copy the secret Value (not ID)
    • Important: You won't see this value again
    • Save it securely

Step 4: Assign Permissions​

  1. Go to Subscriptions

    • Click Subscriptions
    • Select your subscription

  2. Access Control (IAM)

    • Click Access Control (IAM)
    • Click Add → Add role assignment

  3. Assign Role

    • Role: Search and select "Virtual Machine Contributor"
    • Click Next

  4. Assign to Service Principal

    • Click Members → Select members
    • Search for your service principal name (nife-vm-management)
    • Click to select it
    • Click Select
    • Click Review + assign

Step 5: Get Resource Group and VM Details​

  1. Navigate to Resource Groups

    • Click Resource Groups
    • Note your Resource Group Name

  2. Get VM Details

    • Click into your resource group
    • Find your VM
    • Copy the VM name (if needed for reference)

  3. Verify Permissions

    • Service principal now has VM management permissions
    • Can start, stop, restart VMs

Azure IAM Role Reference​

For VM Management, assign:

  • Virtual Machine Contributor: Full VM management
  • Virtual Machine Operator: Start/stop/restart only
  • Virtual Machine User: Read-only access

Azure Security Best Practices​

  1. Rotate Secrets: Create new secrets every 90 days
  2. Limit Scope: Assign permissions at resource group level
  3. Monitor Access: Use Azure Activity Log
  4. Use Managed Identities: When available instead of secrets
  5. Enable MFA: For Azure AD accounts
  6. Review Permissions: Regularly audit role assignments

Troubleshooting Azure Setup​

Client Secret Error

  • Verify secret value (not ID) is used
  • Check secret hasn't expired
  • Create new secret if needed
  • Ensure secret is copied completely

Subscription Not Found

  • Verify subscription ID is correct
  • Confirm account has access to subscription
  • Check subscription isn't disabled
  • Try signing out and back in

Permissions Denied

  • Verify service principal has Virtual Machine Contributor role
  • Check role assignment scope
  • Confirm subscription is selected correctly
  • Wait 1-2 minutes for IAM changes to propagate

Resource Group Not Found

  • Verify resource group name spelling
  • Confirm resource group in correct subscription
  • Check it's not deleted
  • Ensure permissions to access it

General Cloud Provider Security Tips​

For All Providers​

  1. Store Credentials Securely

    • Use password managers or vaults
    • Never store in code or version control
    • Use environment variables for local development
    • Enable encryption at rest

  2. Audit Access

    • Review credential usage logs
    • Monitor API calls
    • Check for unusual activity
    • Set up alerts for critical operations

  3. Rotate Credentials

    • AWS: Rotate access keys every 90 days
    • GCP: Rotate service account keys every 90 days
    • Azure: Rotate client secrets every 90 days

  4. Principle of Least Privilege

    • Grant only necessary permissions
    • Use custom policies when possible
    • Regularly audit and remove unused permissions
    • Separate credentials by environment (dev/prod)

  5. Enable Multi-Factor Authentication (MFA)

    • Protect cloud provider console access
    • Use authenticator apps (not SMS when possible)
    • Require MFA for sensitive operations

Next Steps​