Interacting with AWS (VIP User)

Last updated: August 6, 2026

The Pragma managed AWS account is set up with a "VIP User" so that members of your Studio have the ability to run certain read-only AWS CLI commands along with being able to SSH onto your AWS instances or run commands through the Pragma Labs CLI.

📄 [Guide] How to SSH onto your AWS boxes

📄 Pragma Labs CLI

Setting up AWS VIP credentials

The easiest way to set these up is with the Pragma Labs CLI (v1.6.1 or newer):

  1. Request your VIP credentials download link through your Pragma Slack channel

  2. Install the AWS CLI

  3. From the pragma-engine/platform directory of your git workspace, run ./pragma-labs settings vip-user install

    1. A prompt will ask for the link, paste it into the input

  4. Verify with ./pragma-labs settings vip-user status to see that the CLI has set the credentials up correctly.

To use the profile with your own AWS commands, run export AWS_PROFILE=pragma-vip-<studio>. The Labs CLI itself automatically uses the profile whenever your shell has no AWS profile active.

Pragma rotates VIP credentials periodically. The Labs CLI warns you at startup when yours are approaching deactivation — run settings vip-user refresh to fetch the new credentials, and settings vip-user status to see which credentials are in use, their age, and whether a rotation is pending.

Setting up manually (without the Labs CLI)

  1. Request your VIP credentials through your Pragma Slack channel

  2. Install the AWS CLI

  3. Run aws configure --profile pragma-vip-<studio> replacing <studio> with your studio name (or specify another profile name that works for you)

    1. There will be a prompt for your Access Key Id, Secret Access Key, region name, and output. Pragma generally uses us-west-2 for the region and you can leave the default output format as None

  4. Run export AWS_PROFILE=pragma-vip-<studio> so that you don't have to qualify each of your AWS commands with the profile

  5. Run aws sts get-caller-identity to see that the CLI is properly set up. If not there will be an error displayed.

Troubleshooting

  • "That link looks truncated" — your shell split an unquoted link at the first &. Re-run ./pragma-labs settings vip-user install with no argument and paste the link at the prompt, or wrap the link in single quotes.

  • "Could not establish a trusted TLS connection to AWS" — your machine or network intercepts HTTPS (common with corporate proxies). This is not a credentials problem. Point the AWS CLI at your company's CA bundle with export AWS_CA_BUNDLE=/path/to/corp-ca.pem, or ask your IT team for the proxy's CA certificate.

  • "Invalid or expired AWS credentials" — if the message lists your installed VIP profiles, your key may have been rotated: run ./pragma-labs settings vip-user refresh. If refresh also fails, ask Pragma for a new credentials link in your Slack channel.