# Hosts from your cloud > Keep hosts in step with Vallic Cloud, AWS, Google Cloud, Azure, Hetzner Cloud or DigitalOcean, while your cloud sign-in stays on your computer. MorphGate can keep a set of hosts in step with your cloud: the environments of Vallic Cloud, or the virtual machines of an AWS, Google Cloud, Azure, Hetzner Cloud or DigitalOcean account. A refresh brings what the cloud decides: which machines exist, their addresses, whether they run. What you change in MorphGate stays: names, keys, schemes, tags, notes and groups. A machine the cloud no longer lists is marked, never deleted. Your cloud credentials stay on your computer. Cloud sources are set up and refreshed in the desktop app; the hosts they make sync to your other devices like any others. ## What you need - **Vallic Cloud**: A Vallic account. Nothing to install. - **AWS**: The AWS CLI (`aws`), signed in on this computer: `aws configure`, or `aws sso login` for single sign-on. To reach machines through Session Manager, also AWS's session-manager-plugin. - **Google Cloud**: The Google Cloud CLI (`gcloud`), signed in with `gcloud auth login`. - **Azure**: The Azure CLI (`az`), signed in with `az login`. - **Hetzner Cloud**: The `hcloud` CLI with a context for your project (`hcloud context create`). - **DigitalOcean**: The `doctl` CLI, signed in with `doctl auth init`. MorphGate looks for each CLI on your `PATH` and in the folders its installer uses. If it can't find one, the form says so and asks where it is: type the path under **Where aws is on this computer** (or the CLI's name) and choose **Use it**. This computer remembers it. ## Connect Vallic Cloud 1. Choose **Hosts** at the top of the sidebar, then **Clouds…**. 2. If you can write to more than one vault, pick the **Vault** the hosts go into. Then choose **Connect Vallic Cloud**. 3. MorphGate shows a code and opens Vallic Cloud's sign-in page in your browser. Type the code there and approve. The **Open** button beside the code opens the page again; **Cancel** stops. 4. Once you've approved, the source appears and its hosts come in. Vallic Cloud's sessions list the app as "MorphGate on" and your device's name. To add a second Vallic account, choose **Connect another Vallic account**. What becomes hosts: - a group per project; - a host per environment, named after the project and the environment, such as `Shop · Production`; - a host per machine of an environment that runs on several, and a host per worker. They sign in the way `vallic ssh` does. Vallic Cloud's SSH has no SFTP and no port forwarding, so these hosts have no **Files**, and tunnels through them don't work. Environments where your role has no shell, or that don't run yet, are listed after the refresh, not made into hosts. Each device signs in to Vallic Cloud itself. On another device the source shows **Sign in on this device**; until you do, that device has the hosts but can't refresh them. **Sign out on this device** ends this device's sign-in, at Vallic too; the source and its hosts stay. Under **Its hosts sign in with**, choose a key from your vault, or **The SSH agent**. Then **Add** … **to your Vallic account** (with the key's name) puts its public half on your Vallic account. Vallic Cloud doesn't take security keys: choose an Ed25519 key. ## Add AWS, Google Cloud, Azure, Hetzner Cloud or DigitalOcean 1. On the **Clouds** page, pick the **Vault** if you have more than one, and choose **Add AWS**, **Add Google Cloud**, **Add Azure**, **Add Hetzner Cloud** or **Add DigitalOcean**. 2. MorphGate asks the CLI who it's signed in as, and shows the answer, or what the CLI said went wrong. 3. Fill in the settings below and choose **Add and list machines**. - **Profile (optional), Context (optional)**: The AWS CLI's profile, or the `hcloud` or `doctl` context. Empty: the CLI's default. - **Regions (optional), Projects (optional), Subscription ids (optional)**: For AWS, Google Cloud and Azure: which to list, separated by commas. Empty: every enabled region, every project, or every enabled subscription your sign-in can see. - **Reach its machines by**: **Their public address** (machines without one are left out), **Their private address, through a jump host** (then pick the **Jump host**, a host in the same vault), or on AWS **AWS Session Manager** or **An EC2 Instance Connect Endpoint**, on Google Cloud **IAP (Identity-Aware Proxy)**. See below. - **Log in as (where a machine doesn't say)**: The user for machines that don't name their own. Empty: `ec2-user` on AWS, the VM's admin user on Azure, `root` on Hetzner Cloud and DigitalOcean. On Google Cloud, your OS Login user if your account has one; otherwise fill this in. - **Group by tag (optional)**: Groups the hosts by this tag's or label's value. Empty: by region (AWS, DigitalOcean), project (Google Cloud), resource group (Azure) or location (Hetzner Cloud). - **Its hosts sign in with**: A key from the vault, or **The SSH agent**. On AWS, a machine started with a key pair signs in with the vault's key of that name, if you have one. A machine can say how to reach it with tags (on Google Cloud and Hetzner Cloud, labels): - its user: `morphgate:user` on AWS, `morphgate-user` on Google Cloud, Azure and Hetzner Cloud, and a `morphgate-user:` tag with the name on DigitalOcean (`morphgate-user:ubuntu`); - its SSH port, when it isn't 22: `morphgate:port` on AWS, `morphgate-port` elsewhere (`morphgate-port:2222` on DigitalOcean). To change a source later, choose **Settings…** on it, then **Save and refresh**. ## How machines become hosts - A host is named after the machine: on AWS its `Name` tag, or the instance id without one. Rename it in MorphGate and it keeps your name. - Its address is the machine's public one (on AWS its public DNS name, on Azure its DNS name where it has one), or its private one if the source says so. - A stopped machine keeps its last address, and the Hosts page shows it as **stopped** (or the cloud's word for it). On AWS a machine gets a new public address when it starts again: refresh to get it. - A machine with no address the source can use isn't added, and the refresh lists it: a running machine without a public address, or a new machine that's stopped. - Windows machines and terminated EC2 instances are left out. - Hosts go into a group per region, project, resource group or location (or tag), made if the vault doesn't have one by that name. ## Refresh Choose **Refresh** on a source to bring its hosts up to date. It doesn't happen by itself. Any desktop can refresh a source: for Vallic Cloud once it's signed in there, for the others where the CLI is signed in. - **Follows the cloud**: Which machines exist and whether they run, their address, port and user, and the name until you rename a host. For a source that uses private addresses, the jump host too: one you set by hand on such a host is replaced at the next refresh. - **Stays yours**: How a host signs in (key, identity or agent), its terminal scheme, VPN, tags, notes and group, agent forwarding, recording and keeping the session on the server. - **Gone from the cloud**: A machine the cloud no longer lists stays as a host, marked **gone from** and the cloud's name on the Hosts page, and **gone** in the sidebar. Delete it when it's gone for good (see [Hosts, groups and identities](https://morphgate.com/docs/hosts.md)). If the machine comes back, the mark goes away. Afterwards the source says what changed, for example "2 hosts added, 1 updated, 1 gone from the cloud", or "Nothing changed", and lists what it skipped: machines without an address, and regions, projects or subscriptions your sign-in couldn't list. ## Session Manager, Instance Connect and IAP Machines without a public address can be reached through the cloud itself: on AWS through **AWS Session Manager** or **An EC2 Instance Connect Endpoint**, on Google Cloud through **IAP (Identity-Aware Proxy)**. With one of these, every machine of the source is reached that way, address or not, and its host is named by its instance id or name. Each time you connect, MorphGate runs the cloud's CLI on this computer, signed in as you've set it up. Session Manager needs AWS's session-manager-plugin installed. The command is built on your computer from the machine's ids, which MorphGate checks look like the cloud's ids. A shared vault can't make your computer run anything else, so, unlike a [proxy command](https://morphgate.com/docs/jump-hosts.md) you add yourself, there's nothing to allow. An AWS profile used this way can only contain letters, digits, `_`, `.` and `-`. ## Your credentials stay on your device - A cloud source in your vault says only what to list and how. It holds no cloud password, key or token, and nothing about your cloud account goes to MorphGate's servers: the app talks to the cloud from your computer. - Vallic Cloud: each device signs in itself. Its sign-in is kept on that device, encrypted with your vault, and never synced. - AWS, Google Cloud, Azure, Hetzner Cloud and DigitalOcean: MorphGate runs their CLI as you've set it up, with your profiles, single sign-on and MFA, and doesn't change its configuration. When your session expires, MorphGate shows the CLI's own message, which says what to run (such as `aws sso login`). - The sources and their hosts sync like other items. In a team's vault, everyone with access sees the hosts and can connect to them, signing in the way the hosts say. Refreshing needs the sign-in or the CLI on the device that refreshes. ## Remove a source Choose **Remove…** on the source, then **Remove it and its hosts**, or **Remove it, keep the hosts** to keep them as ordinary hosts. Removing a Vallic Cloud source signs this device out first. Groups the source made stay. ## Limits - Cloud sources are in the desktop app only. Phones and tablets don't have **Clouds…** and can't refresh. The hosts sync there and connect, except those reached through Session Manager, Instance Connect or IAP, which need the CLI on a computer: the phone says to connect from the desktop app. - Refreshing is by hand, one source at a time. Each CLI call has a minute to answer. - A Vallic Cloud source brings every project your sign-in reaches, grouped by project. Vallic Cloud's database and cache tunnels aren't offered. - Azure Bastion and Azure's Microsoft Entra ID sign-in to VMs aren't supported. Windows machines are left out. - [Moving](https://morphgate.com/docs/shared-vaults.md#move-items-to-another-vault) a source to another vault doesn't take its hosts along. Move them together, or remove the source and connect the cloud again in the other vault.