NetBird Private Access Gateway with Command Center by Code Creator

The Command Center combines NetBird with Code Creator software that discovers private AWS resources, visualizes remote user and routing health, previews access changes before they are applied, and creates narrowly scoped NetBird resource and TCP/UDP access policies through a guarded workflow.

Additional charges apply for Code Creator's technical additions and deployment automation, including:

• Secure Access Command Center - a single-pane interface for managing private access to AWS workloads
• AWS resource discovery for EC2, RDS, RDS clusters, and load balancers
• First-boot endpoint and credential generation - no baked administrator password; credentials are generated on first boot and written to ~/FIRST_LOGIN.txt
• Prebuilt NetBird groups, network, and routing topology created automatically during setup
• Live data refresh and connection diagnostics showing whether the AWS target is running, whether the routing peer and remote user are connected, whether a private access policy exists, and whether the selected TCP resource is reachable
• Guided Access Setup with a dry-run plan that requires explicit APPLY confirmation before creating a NetBird resource or policy

The Command Center does not modify AWS security groups, route tables, NACLs, or IAM policies.

Deploy the AMI in the VPC containing the private resources you want to reach, attach the documented read-only IAM discovery role, and provide a public IPv4 address for the NetBird management endpoint. First boot configures HTTPS, creates customer-specific credentials and the Code Creator routing topology, and writes login information to ~/FIRST_LOGIN.txt.

Human users can be enrolled with NetBird's embedded local identity system or an external identity provider. Setup key enrollment is available for quick validation and managed or server devices.

The deployment runs entirely in the buyer's AWS account and uses the buyer's EC2, networking, IAM, and security controls. Key security measures include:

• HTTPS/TLS - certificates issued via Let's Encrypt on first boot so peers can validate the endpoint immediately
• Read-only IAM discovery role - the Command Center uses minimal permissions to discover AWS resources without write access
• Narrowly scoped access policies - the Guided Access Setup creates only the specific NetBird resource and TCP/UDP policies you approve through the dry-run workflow
• WireGuard encrypted tunnels - peers build encrypted point-to-point tunnels for all private network traffic
• UFW firewall - host-level firewall enabled by default
• SSH hardening - PasswordAuthentication disabled, key-only access, PermitRootLogin set to no
• AppArmor - mandatory access control enforced on the instance
• Kernel hardening - SYN cookies, ASLR, rp_filter enabled, kexec disabled
• /tmp mounted as tmpfs with nosuid, nodev, noexec flags
• auditd - system call auditing of critical paths
• Anonymous telemetry disabled by default

The AMI runs the complete NetBird control plane on a single instance: the management service, signal service, relay, STUN server, and an embedded identity provider. All services are multiplexed behind one TLS port with an nginx TLS perimeter. The local datastore uses SQLite on the persistent volume.

NetBird geolocation-based posture functionality is disabled in this build.

The default automated public IP deployment uses sslip.io DNS for its generated hostname and Let's Encrypt for TLS certificate issuance and renewal. Internet connectivity to these services is required. Neither service requires a separate paid subscription.

Launch the AMI from AWS Marketplace, attach the read-only IAM role, and the first-boot process handles HTTPS configuration, credential generation, and routing topology creation automatically. Once logged in, use the Command Center to discover your private AWS resources and set up secure access through the guided workflow.