yeti
Docs: Cloud cubes

Cloud cubes

Launch a cube in your own AWS account so your yeti keep working while your computer sleeps. Least privilege, mutual TLS only.

A cloud cube is a machine in your own AWS account that joins your cluster like any other cube, so your yeti keep working while your computer sleeps. AWS bills you directly.

What you can launch

Compute Systems Sizes
EC2 instance Linux Small to X-Large (t4g.small to t4g.xlarge, Arm)
Windows Medium to X-Large (t3.medium to t3.xlarge)
macOS Mac mini M1 (mac2.metal), Mac mini M2 (mac2-m2.metal)
Fargate task Linux Tiny to X-Large (0.25 to 4 vCPU, Arm)

EC2 cubes keep their encrypted disk and their address when they stop. Fargate cubes are containers AWS runs for you.

Regions: us-east-1 US East (N. Virginia), us-east-2 US East (Ohio), us-west-2 US West (Oregon), eu-west-1 Europe (Ireland). Cubes launch into the region's default VPC.

Step 1: connect your AWS account, safely

yeti never needs admin access. Once per AWS account, you create a CloudFormation stack named yeti-setup that makes:

  • yeti-provisioner, a least-privilege role yeti steps into for one-hour sessions. It can only touch what yeti made: resources tagged yeti:managed, or named for yeti.
  • yeti-boundary, a permissions boundary every role yeti creates must carry, so yeti can never make a role more powerful than its cubes need.
  • Optionally, yeti-desktop, an IAM user that can do one thing: step into yeti-provisioner.

Deleting the yeti-setup stack revokes yeti's access.

On Cubes, find Cloud accounts and choose Add. Pick how you sign in to AWS:

  1. Save template, then Open CloudFormation. Choose Upload a template file, name the stack yeti-setup, set CreateDesktopUser to false, tick the IAM acknowledgement and create it.
  2. In IAM Identity Center, add the inline policy yeti shows (Copy policy) to the permission set you sign in with. It allows nothing except stepping into yeti-provisioner.
  3. Enter your AWS access portal URL and Identity Center region, choose Sign in with AWS, approve the code in your browser, then pick the account and role.

Just me: a yeti user

  1. Create the yeti-setup stack as above, with CreateDesktopUser set to true.
  2. Open the yeti-desktop user, choose Create access key, then Application running outside AWS.
  3. Paste the Access key ID and Secret access key. The secret goes straight into this computer's keychain and never reaches your cluster, your logs or your other devices.

~/.aws profile

Pick a profile. yeti stores only its name; the AWS SDK reads ~/.aws when needed. Leave Use yeti's limited role on (it needs the yeti-setup stack). Without it, yeti uses the profile's own permissions, which isn't recommended.

Add an optional Name and a Default region, then choose Check and add. yeti asks AWS whose credentials these are and shows you. Root credentials are refused. The account appears on all your devices, but its credentials stay on the computer that added it.

Step 2: launch

Choose Launch in the cloud on the Cubes page.

  1. Pick the Account, a Name (2 to 32 lowercase letters, digits or dashes, starting with a letter) and a Region.
  2. Choose Compute, Operating system and Size.
  3. Set the Disk (encrypted) for EC2; it can grow later, never shrink. Fargate gets Task storage, scratch space wiped when the task stops.
  4. Under When it runs, keep Always on, or turn it off and pick active days, Starts, Stops and Time zone. AWS runs the schedule, so it holds with your computer closed.
  5. Check the cost estimate and choose Launch.

yeti ticks off each step: checking the account, creating a least-privilege role, opening only ports 7443 and 7444, sealing a single-use join token, starting the machine, connecting over mutual TLS, and joining your cluster. You can close the dialog and it keeps going, but keep the app open: an operation cut short by quitting yeti is marked failed, and you remove the cube to clean up. If a launch fails, yeti removes what it created and lists anything it couldn't.

Fargate: keep the cube across restarts

Keep this cube across restarts is on by default. The cube's identity and data live on encrypted EFS storage that only this cube can open, so scheduled restarts work with your computer off. Choose Shared with my cubes (one file system per region, each cube in its own locked directory) or Its own file system (deleted with the cube).

With it off, every restart is a brand-new cube that the yeti app on your computer has to let in again, so your computer needs to be on.

Costs

The launch dialog estimates the monthly cost from a price table built into the app; Check current AWS prices asks AWS for current EC2 rates.

A Mac is different. AWS runs it on a dedicated host that bills for at least 24 hours and can't be released sooner, even if you remove the cube a minute after launching. Stopping the Mac doesn't stop that billing, so a schedule saves nothing. You confirm this before launching.

Manage a cloud cube

Select it in the tray. Its card has three tabs: Overview (where it runs, its size, address, schedule and costs), Schedule, and Size and disk. Resizing EC2 restarts the instance; resizing Fargate starts a fresh task. A Mac's size comes with its host.

Remove deletes everything yeti made for the cube, found by its yeti tags, and takes it out of your cluster. A Mac host inside its first 24 hours is listed as left over and keeps billing until you run removal again.

Under Cloud accounts, Manage an account to Check with AWS, Forget account (remove its cubes first), or Clean up a region…, which deletes everything tagged yeti:managed=true there, from any of your clusters.

Staying up while you sleep

A cloud cube is a voting member. With this computer plus one cloud cube, the cluster stops when either is off. To keep your yeti working with this computer closed, run at least two always-on cubes besides it. See Cubes.

How cloud cubes are locked down

Only TCP 7443 and 7444 are open, and both speak mutual TLS 1.3 only. There are no SSH keys or passwords, and EC2 instances require IMDSv2. The join token is single-use and kept as an encrypted SSM parameter, and your computer checks the new cube's fingerprint, read through AWS, before letting it in.

Disks and EFS storage are encrypted with AWS-managed keys, so administrators of that AWS account can read them. Security explains what that means for your keys.