Connecting Your First SRA Resource

This guide walks you through connecting your first protected resource for SRA.
As a concrete example, it walks through an SSH session to a target host and connecting to it using the Akeyless Connect CLI command. In this example, the target host is an Ubuntu server.
check our Supported Resource Types.

Configuration takes place in the Akeyless Console. Connection is established via CLI using an API Key.

By the end, you'll have a real SSH session open from your terminal, proxied through SRA to your target host.

Prerequisites

• Gateway with SRA.
• An existing SSH Certificates Issuer
• A target host reachable over SSH.
• Console access with permission to edit SSH Certificate Issuers.
• The akeyless CLI installed.

Allow Gateway Access to the Host

1. Allow outbound traffic from the gateway pod to the target host on port 22, In your cluster, this pod is named ssh-gw-akeyless-gateway-....
2. Allow inbound traffic on the target host's firewall or security group from the gateway pod's IP/CIDR or node/subnet range on port 22 .

If this step is skipped, every step that follows will still appear correctly configured, but the connection will fail.

Enable SRA on SSH Certificate Issuer and set the target

Edit the existing SSH Certificate Issuer created during the Gateway deployment directly in the Akeyless Console.

Navigation: Console → Items → locate the existing SSH Certificate Issuer → Secure Remote Access

1. Click Edit pen.
2. Check the Enable Secure Remote Access checkbox.
3. Click Add and enter the target host's IP address.
4. Set Default SSH Username to ubuntu.
5. Click Save.

Create an Authentication Method

This Authentication Method authenticates the user connecting to your resource. For this guide, API key authentication is used for simplicity.

akeyless auth-method create api-key --name MySraAPIKey

Create an Access Role

This Access Role authorizes your SRA user to connect to the resource.

1. Create a new access role:

   Shell

   akeyless create-role --name MySraRole

2. Grant the role list and allow_access permissions on the SSH Certificate Issuer's path:

   Shell

   akeyless set-role-rule --role-name MySraRole --path "/path/to/ssh-certificate-issuer" --capability list --capability allow_access

3. Associate the authentication method with the role:

   Shell

   akeyless assoc-role-am --role-name MySraRole --am-name MySraAPIKey

Connect to Resource via CLI

Authenticate the CLI with your API key (Access ID and Access Key):

akeyless auth --access-id <your-access-id> --access-key <your-access-key>

Copy the user t-token and connect:

akeyless connect \
  -t "ubuntu@<host-ip-address>:22" \
  -c <cert-issuer-name> \
  -v <Gateway-SSH-EXTERNAL-IP>:22 \
  -g https://<Gateway-EXTERNAL-IP> \
	--token <t-token>

where:

• -t The OS user and target host/port to connect to. Must match the SSH username and host configured on the certificate issuer.
• -c The existing SSH Certificate Issuer with Secure Remote Access enabled.
• -v The external endpoint of your Gateway's SSH Access service, the EXTERNAL-IP (or DNS name) retrieved via kubectl get services of the service starting with ssh-quick-start-gw, and port 22 exposed by the SRA SSH service.
• -g The base URL of your Akeyless Gateway, the endpoint the CLI uses to authenticate the session and issue the SSH certificate, e.g. http://<Gateway-EXTERNAL-IP>:8000 retrieved via kubectl get services of the service starting with quick-start-gw.
• --token The user token to Akeyless.

Landing in a real shell on your target host with the banner "You are connecting to your remote server via Akeyless Bastion", confirms that SRA is working end-to-end.

Troubleshooting