Your clients reboot their own servers. You keep the keys.
Printed label: Your company · Client portal
CloudDeck is the white-label portal MSPs and agencies give their clients. They start, stop, snapshot and monitor their own EC2 servers under your brand, through a role in their AWS account that only touches the servers you tag.
Demo servers
- web-01
t3.medium · running
- db-01
r6g.large · running
- staging-web
t3.small · stopped
- legacy-ftp
t2.micro · running · read-only
No clouddeck:managed tag, so AWS refuses CloudDeck's start, stop and reboot calls.
Audit log every client action is recorded with who, what and when. Try a button above.
Connected in three steps
Nothing to install on the servers for power and snapshots. The client keeps the keys to their account; you get a panel they can use on their own.
- 1
Your client deploys the CloudDeck stack
A CloudFormation template creates one IAM role in their AWS account. Only CloudDeck can assume it, and only with an ExternalId unique to that client. No access keys change hands.
- 2
They tag the servers you manage
Servers tagged clouddeck:managed=true can be started, stopped, rebooted and restored from the portal. Everything else stays read-only, and the role’s own policy is what enforces it.
- 3
You invite their team
Owners, admins, operators and viewers sign in to a portal carrying your name, logo and colours. Every action they take lands in the audit log.
What clients can do on their own
The routine jobs that turn into tickets: a reboot before a meeting, a snapshot before an update, a look at why the site feels slow.
| Power | Start, stop (ACPI), force stop, graceful OS shutdown and reboot, with state checks that refuse conflicting actions. |
|---|---|
| Snapshots | Snapshot every volume, delete old snapshots, and revert a disk to a CloudDeck snapshot taken from that same server and device. |
| Health | CPU, network, disk and status-check metrics from CloudWatch, with alarm state and history. |
| ISO | Mount an ISO from an S3 bucket in the client’s account inside the guest OS, through Systems Manager. |
| Tags | Edit a server’s own tags. CloudDeck’s reserved tags stay locked. |
| People | Owner, admin, operator and viewer roles for each client, with email invites. |
| Audit | Every change recorded with who, what, when and from where. |
Your brand on every screen
Each client gets a portal with your name, your logo and your colours, applied at runtime. One CloudDeck, every client in your livery.
Pick a different cable colour in the panel above and this console follows, because it uses the same mechanism the product uses for every tenant.
Running ClientOS? CloudDeck plugs in as a module and keeps clients in sync over signed webhooks.
The boundary lives in AWS
No stored AWS keys
CloudDeck assumes the client’s role for 15 minutes at a time. Nobody hands over access keys.
An ExternalId for every client
Another CloudDeck customer can’t point us at your client’s role.
Revoked in one step
Deleting the stack ends access. No ticket, no waiting on us.
# From the role your client deploys
- Sid: EC2PowerOps
Effect: Allow
Action:
- ec2:StartInstances
- ec2:StopInstances
- ec2:RebootInstances
Resource: '*'
Condition:
StringEquals:
aws:ResourceTag/clouddeck:managed: 'true'Pricing on request
Tell us how many client AWS accounts and servers you look after, and we’ll put together a quote.
How pricing worksQuestions MSPs ask first
Which AWS services does CloudDeck cover?
Can clients see servers we haven’t tagged?
Do you store our clients’ AWS credentials?
How does a client remove access?
Put your name on it.
Your company · Client portal