⛵ Keel

Appearance

Getting Started ​

Prerequisites ​

  • An AWS account
  • An IAM access key able to create IAM users, roles, and policies — needed once, pasted into keel auth setup
  • Docker (for local builds)
  • OpenTofu (auto-downloaded on first use)

The AWS CLI is not required

Keel never reads ~/.aws/credentials, profiles, or the SSO cache — every AWS call uses Keel's own per-project credentials under ~/.keel/contexts/, and the OpenTofu subprocess actively strips ambient AWS CLI configuration so it can't leak in. You can bootstrap Keel on a machine that has never run aws configure.

One current limitation: keel auth setup accepts a key ID and secret only, with no session-token field, so SSO/temporary STS credentials cannot be used for the one-time setup. Use a long-lived IAM access key with IAM-admin permissions, then keep it somewhere safe — it's also your recovery path if you lose your MFA device.

Install ​

bash
brew install devtide-llc/tap/keel

Or build from source:

bash
git clone https://github.com/devtide-llc/cloud-pilot.git
cd cloud-pilot
make build          # build to bin/keel
./bin/keel version

Your first deploy ​

bash
# Initialize a new project (interactive: name, region, mode, port, pipeline)
keel init

# Edit keel.yml to match your app
vim keel.yml

# Set up IAM roles, your Keel admin user, and its MFA device (admin, one-time)
keel auth setup

# Start a session — prompts for a one-time code
keel auth login

# Provision infrastructure
keel up

# Deploy your application
keel deploy

# Check status
keel status

# Launch the interactive dashboard
keel dashboard

What just happened ​

  1. keel init wrote a keel.yml describing your app — its name, region, infrastructure mode, services, and pipeline source — plus an annotated keel.yml.example listing every option Keel understands, to copy from as the app grows.
  2. keel auth setup is a one-time, guided flow that creates three least-privilege IAM roles (keel-admin, keel-developer, keel-viewer), an IAM user for you that can assume keel-admin and nothing else, and an MFA device for that user. See The Auth Model.
  3. keel auth login exchanged your key + MFA code for an 8-hour STS session.
  4. keel up generated OpenTofu HCL from keel.yml and applied it: VPC, cluster, registry, load balancer, and any add-ons.
  5. keel deploy built your image (via CodeBuild by default), registered a task definition revision per service, ran your release: command, and promoted each service.

TIP

Run keel auth setup --dry-run first to preview every IAM policy document Keel would create, without touching AWS.

Next steps ​

Keel — the AWS CLI you've always wanted.