Cloud servers: AWS, DigitalOcean, Azure

Your servers at AWS (EC2 and Lightsail), DigitalOcean and Azure can sit on the Connections page next to your other hosts. The app reads them from your account, and you can start, stop and reboot them from their menu. One place for your cloud servers and your PCs explains why that helps and how the keys you give it are handled.

Add a cloud account

On the Connections page, open Hosts, click Import and choose Cloud accounts…. Pick the provider and fill in:

• AWS: the Access key ID and Secret access key of an IAM user, a Session token only for temporary credentials, EC2 instances and/or Lightsail instances, and the regions (or All regions enabled for the account). The guide to manage AWS EC2 and Lightsail servers shows how to create that IAM user and its access key.
• DigitalOcean: a Personal access token. The guide to manage DigitalOcean Droplets from Windows walks through creating one with custom scopes.
• Azure: the Directory (tenant) ID, the Application (client) ID and the client secret's Value (not its Secret ID) of an app registration. Subscription IDs are optional: leave them empty for every subscription the app can see. To register the app and give it a role, follow manage Azure VMs from one Windows app.

Click Test connection to check it, then Save.

Give it only what it needs

Read access is enough to import. Add start and stop permissions only if you want them.

• AWS: Copy read-only policy gives you a policy to paste in IAM. Copy policy with start/stop adds the start, stop and reboot permissions.
• DigitalOcean: a token with custom scopes. droplet:read imports; add droplet:update to power on, shut down and reboot.
• Azure: the Reader role on the subscription or a resource group imports; Virtual Machine Contributor also starts, stops, restarts and deallocates.

If a permission is missing, the message names it.

Import the servers

Click Import servers… in Cloud accounts, or Import from the cloud… in the Add host menu. Tick the servers you want and click Import.

• Linux servers become SSH hosts and Windows servers Remote Desktop hosts. The user name comes from the provider or the image, and you can change it.
• Key for the Linux servers adds your key file (.pem or .ppk) to your key list once and uses it for the imported SSH hosts.
• For servers you reach over a VPN, tick the option to connect to their private addresses instead of public ones.
• Hosts already saved: importing again updates the same hosts. Only the address changes; the name, user, folder, saved password and key you chose stay.

Imported servers count toward the free plan's saved hosts, like any other host. To bring in hosts saved in other apps, a CSV file or your SSH config, see import saved sessions and hosts.

Start, stop and reboot

An imported host has a small AWS, Lightsail, DO or Azure badge, with its state when it isn't running. Right-click the host and open the submenu named after the badge:

• Start runs straight away.
• Stop… and Reboot… ask first. On Azure, Stop… keeps the VM allocated and billed; Deallocate… releases it.
• Refresh from cloud reads the state and address again. A server that was stopped and started often has a new public address.

The state on the row follows along for up to 3 minutes after an action.

Where your keys are kept

Your PC talks to the provider directly. Nothing goes through RemoteAccessApp's servers. Secrets are stored encrypted for your Windows account, never shown again after you save them, and never written to logs. For what RemoteAccessApp does keep about you, see privacy and your data.

With Save to my vault on and your password vault syncing (Pro), the account is also kept in your end-to-end encrypted vault, so your other PCs get it. Otherwise it stays on the PC where you added it. On another PC without the account, Start and Stop tell you to add it there or turn on your vault.

Settings → Vault lists the cloud accounts in your vault. You can delete one there, but its secret is never shown.