SSH into GCP, AWS, Azure, Hetzner, and Box sandboxes

Cloud inventory goes stale the moment you bookmark it

Teams keep EC2 and GCE hosts in notes, SSH config stubs, or GUI session lists. Instances get replaced. Private IPs change. Bastion paths evolve. The bookmark stays wrong.

Provider consoles can open a session, but they do not organize the fleet the way a terminal-first engineer actually works.

Provider CLIs and APIs in, OpenSSH out

Bast sync pulls hosts through gcloud, AWS CLI v2, Azure CLI, the ASCII Box box CLI, the Upstash Box API, the Vercel Sandbox API, or the Hetzner Cloud API. Synced hosts are read-only reflections of cloud inventory. When sync runs again, the list updates instead of rotting.

Cloud VMs still use your system ssh binary. Vercel Sandboxes open a PTY shell instead, because they are not OpenSSH hosts.

Import a cloud account

1. Authenticate the provider CLI on your machine (gcloud, aws, az, or box), store an Upstash Box API key with bast upstash key, a Vercel token with bast vercel token, or a Hetzner Cloud token with bast hetzner key.
2. Run bast sync gcp, bast sync aws, bast sync azure, bast sync box, bast sync upstash, bast sync vercel, or bast sync hetzner (or use the Sync tab in the TUI).
3. Open Bast, find the imported hosts, and connect. Start with the GCP, AWS, Azure, box.ascii.dev, Upstash Box, Vercel Sandbox, or Hetzner Cloud guide for provider notes.

Keep cloud credentials out of your SSH client

Bast writes local OpenSSH config for imported hosts. GCP, AWS, Azure, and box.ascii.dev authenticate through their CLIs. Upstash Box, Vercel, and Hetzner Cloud store tokens in local 0600 files, not in SSH config or Vault. Vercel connect is a WebSocket PTY rather than OpenSSH.