Opal + AWS EC2

Product Overview

Amazon Elastic Compute Cloud (Amazon EC2) provides scalable computing capacity in the Amazon Web Services (AWS) Cloud. Using Amazon EC2 eliminates your need to invest in hardware up front, so you can develop and deploy applications faster. You can use Amazon EC2 to launch as many or as few virtual servers as you need, configure security and networking, and manage storage. Amazon EC2 enables you to scale up or down to handle changes in requirements or spikes in popularity, reducing your need to forecast traffic.

Integration Overview

Leveraging AWS’ SSM APIs, Opal facilitates zero trust connections to EC2 instances. This allows developers to avoid the burden of rotating their private keys and instead leverage ephemeral federated IAM sessions. In addition, all sessions will be logged for later auditing!

Use cases

1. Modern Access Management

Using Opal, customers can:

• Grant just-in-time access to critical resources that are auto-expiring and fully audited
• Enable resource owners with the most context to approve access requests and provision access automatically via Slack
• Ensure that privileged roles have the appropriate identity governance and approval configurations, such as multi-stage approvals, max duration, custom fields, and more
• Automate user access reviews so compliance teams can snapshot user listings, assign reviewers to self-service reviews, propagate access changes, and generate an auditor-friendly access report
• Automatically escalate privileges (and revoke access) when developers are on-call via integrations with PagerDuty and Opsgenie

2. Privileged Access Management

To support native developer workflows, Opal has:

• Easy way for developers to start sessions via the web or CLI
• Audit logs for user attribution
• Session logs from CloudWatch trails

Integration Setup

EC2 can be imported using Opal's AWS connectors.

1. In the Apps sidebar, click on "New App", and select Amazon Web Services

2. Opal requires an IAM user to manage your AWS Cloud on your behalf. To simplify the process of creating a user with the proper IAM policies, you can use our official CloudFormation Stack to automatically generate one.

3. Once the user is created, admins just need to fill out the form to add user access key ID and user secret access key.