AWS
Give the Sazabi agent the AWS CLI (aws) in its sandbox to interact with AWS services using access keys or an assumed role.
About
This CLI connection makes the AWS CLI (aws) available in the Sazabi agent's sandbox. The agent can interact with AWS services on your behalf using static access keys or an assumed IAM role. The tool is baked into the sandbox image; connecting it authenticates the already-installed CLI.
Prerequisites
- A Sazabi project.
- AWS credentials: either an access key pair (
AWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEY) or a role ARN to assume (AWS_ROLE_ARN). Credentials are optional only when the sandbox already has AWS access some other way (for example a custom CLI setup script that configures a profile); otherwise supply one of the methods below.
Set up in the dashboard
Configure the sandbox in the dashboard under Settings > Sandbox CLIs.
Find AWS in the catalog
In Settings > Sandbox CLIs, find AWS under Browse sandbox CLIs and choose to connect it.
Provide credentials
All credential fields are optional, but configure at least one authentication method. Optionally set AWS_ROLE_ARN to have the CLI assume a specific IAM role; AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY to authenticate with a static key pair; AWS_DEFAULT_REGION to set the default region for API calls. Save to store them securely; Sazabi injects them into the sandbox when the agent runs.
Set up with the CLI
You can also configure the AWS CLI connection with the Sazabi CLI (installed and authenticated — see CLI reference).
The AWS CLI connection has no required credentials — supply whichever authentication method you use. For a static access-key pair:
sazabi sandbox-clis set --type aws --env AWS_ACCESS_KEY_ID=<your-access-key-id> --env AWS_SECRET_ACCESS_KEY=<your-secret-access-key> --env AWS_DEFAULT_REGION=<your-region>To assume a role instead, pass --env AWS_ROLE_ARN=<your-role-arn>. To validate the configuration without saving, run the same command with test in place of set (the test command also requires the --env flags).
Verify
Ask the agent, in a thread, to run the aws CLI (for example aws sts get-caller-identity) and confirm it returns real output from your account. If the command is not found, the CLI connection may not be enabled; if it runs unauthenticated, recheck the credentials.
Troubleshooting
Command not found — Confirm the AWS CLI connection is enabled for the project under Settings > Sandbox CLIs.
Authentication fails — Recheck the credential values; a rotated or revoked token must be re-entered under Settings > Sandbox CLIs or with sazabi sandbox-clis set --type aws.