Setup

pier setup

The wizard handles the account groundwork once:

1. Asks which cloud and authenticates against your AWS profile or GCP project.
2. Creates the groundwork. On AWS: an IAM role and instance profile carrying only AmazonSSMManagedInstanceCore, plus one egress-only security group. On GCP: the compute and IAP API enables, plus two firewall rules that admit only Google’s IAP range to pier VMs and shut everything else out.
3. Writes ~/.config/pier/config.toml.
4. Detects the agent config and credentials it will copy into sessions.
5. Offers to bake an image for the current repo.
6. Runs the pier doctor checks.

Everything it creates is tagged and removable with pier teardown. Change any setting later from inside the TUI. Run pier and press s.

Without admin rights

No admin rights? Print the handful of commands for an admin to run once:

pier setup --print-admin

The wizard then works with what exists. The full permission lists live in AWS permissions and GCP permissions.

Removing everything

pier teardown

Removes all pier groundwork from the account. Everything pier creates is tagged, so the sweep is complete. On AWS that is the role, the instance profile, the security group, and any baked images. On GCP it is the two firewall rules and any baked images.