ShellYard

Cloud Shells

Per-Space AWS, GCP, and Azure terminals with the provider CLI pre-authenticated from vault credentials. Pro tier.

Cloud is its own destination in the left rail. Each profile opens a local terminal with aws, gcloud, or az already authenticated from the Space’s stored credentials. Pro tier and above.

This is a local CLI console, not the browser cloud shell. Your files, your tools, your shell — with the provider CLI already logged in.

How credentials get in

Injected server-side, so secrets never reach the UI layer:

  • AWS — access keys into the process environment
  • GCP — service-account JSON written to a 0600 temp key, cleaned up when the tab closes
  • Azure — service principal, followed by an az login

AWS named profiles

If you already maintain ~/.aws/config, point the profile at a named profile instead of injecting keys. Sets AWS_PROFILE, so SSO and assume-role chains work exactly as they do in your own terminal — ShellYard doesn’t need to hold the credential at all.

This is the better option when your organization uses AWS SSO. Store keys in the vault only where a long-lived key is genuinely the auth model.

The welcome banner

Every shell clears and prints provider · profile · region, then the resolved identity:

  • aws sts get-caller-identity
  • az account show
  • gcloud config list

It’s a nicety that doubles as a credentials check. If the identity line is wrong or missing, you know before you run something against the wrong account — which is the actual failure mode worth designing against here.

Each provider gets subtle theming (AWS orange, Azure and GCP blue) so a wall of open tabs doesn’t blur together.

Command reference drawer

A curated, searchable reference of common aws, gcloud, and az invocations, alongside your own saved snippets grouped by folder.

Click inserts at the prompt. Nothing auto-runs — you always see the command sitting on the command line before you press Enter.

Shared profiles

Same model as connections and VPN: a Shared Space can carry a “site” cloud profile with a default credential, and any member can attach their own Personal-vault credential as a per-user override. Useful when the team shares an account but each engineer has their own IAM user.

What it isn’t

Not a cloud console and not an infrastructure manager — no resource browser, no cost dashboard, no Terraform integration. It removes the “which profile am I in, and did I remember to export it” step before you run the CLI you were going to run anyway.