SSH into cloud VMs and sandboxes

Cloud inventory goes stale the moment you bookmark it

Teams keep EC2 and GCE hosts in notes, SSH config stubs, or GUI session lists. Instances get replaced. Private IPs change. Bastion paths evolve. The bookmark stays wrong.

Provider consoles can open a session, but they do not organize the fleet the way a terminal-first engineer actually works.

Provider CLIs and APIs in, OpenSSH out

Bast sync pulls hosts through gcloud, AWS CLI v2, Azure CLI, the Boat boat CLI, flyctl, and doctl, or through the Upstash Box, Vercel Sandbox, Hetzner Cloud, BitQate, and Railway APIs. Synced hosts are read-only reflections of cloud inventory. When sync runs again, the list updates instead of rotting.

Cloud VMs still use your system ssh binary. Vercel Sandboxes open a PTY shell instead, because they are not OpenSSH hosts.

Import a cloud account

1. Authenticate the provider CLI on your machine (gcloud, aws, az, boat, flyctl, or doctl), or store a token with bast upstash key, bast vercel token, bast hetzner key, bast bitqate key, or bast railway key. Fly.io and DigitalOcean do not store an API token in Bast.
2. Run bast sync for gcp, aws, azure, boat, upstash, vercel, hetzner, bitqate, railway, fly, or digitalocean (or use the Sync tab in the TUI). bast sync do is an alias of bast sync digitalocean.
3. Open Bast, find the imported hosts, and connect. Provider notes: GCP, AWS, Azure, Boat, Upstash Box, Vercel Sandbox, Hetzner Cloud, BitQate, Railway, Fly.io, DigitalOcean.

Keep cloud credentials out of your SSH client

Bast writes local OpenSSH config for imported hosts. GCP, AWS, Azure, Boat, Fly.io, and DigitalOcean authenticate through their CLIs. Fly.io and DigitalOcean do not store an API token. Upstash Box, Vercel, Hetzner Cloud, BitQate, and Railway store tokens in local 0600 files, not in SSH config or Vault. Vercel connect is a WebSocket PTY rather than OpenSSH.