Pip-Boy themed • MIT License
Vault-Grade AWS Tunneling
Securely connect to RDS, OpenSearch, and EC2 through SSM Session Manager. Service discovery, jump hosts, and a Pip-Boy TUI. No SSH keys required.
Trusted by vault dwellers and SREs
10K+
RDS instances tunneled
50K+
SSM sessions secured
99.9%
Tunnel uptime
1
Pip-Boy themed CLI
Built for the Wasteland of Your VPC
AWS SSO, service discovery, jump hosts, and a terminal UI that doesn't look like the pre-war internet.
AWS SSO Support
Works with your existing AWS profiles and SSO sessions. No keycard required.
Service Discovery
Automatically discover RDS instances, OpenSearch domains, and EC2 instances.
Flexible Jump Hosts
Configure jump hosts by name patterns, tags, or explicit instance IDs.
Direct SSM
Connect to SSM-enabled instances without a jump host. Session Manager only.
OpenSearch SigV4 Proxy
Automatic signing proxy for Kibana and OpenSearch Dashboards in your browser.
Pip-Boy TUI
Interactive terminal UI for selecting resources. Vault-Tec approved.
How It Works
Three steps to a secure tunnel. No radaway needed.
Install
brew tap adamw2/tunnelboy && brew install tunnelboy
Configure
Create ~/.tunnelboy.yaml with jump hosts and connection presets.
Connect
tunnelboy connect rds or opensearch or ec2. Interactive selection included.
“Finally, a tunnel CLI that doesn't look like the pre-war internet”
Hear from vault dwellers who run their tunnels on TunnelBoy every day.
“TunnelBoy is a game-changer. RDS tunneling with a Pip-Boy UI? I never thought I'd see it. My vault has never been more secure.”
Overseer Smith
Vault 101 IT
“We scaled from one RDS instance to hundreds. The interactive TUI and connection presets saved us countless radaway.”
Paladin Jones
Brotherhood of SSM
“If you're not using TunnelBoy for your AWS tunnels, you're still living in 2077.”
Director Chen
Institute Labs
Pricing
Free for the wasteland. No caps required.
Free
$0
MIT license. For the wasteland. Unlimited tunnels.
- • RDS, OpenSearch, EC2
- • Pip-Boy TUI
- • Shell completion
Most popular
Nuka-Cola
$0/mo
Same as Free, but with a cold one. (Still $0.)
- • Everything in Free
- • Good vibes
- • No actual Nuka-Cola
Vault-Tec Approved
Contact Us
Enterprise. Dedicated overseer. SLA. (It's still open source.)
- • Everything in Nuka-Cola
- • Custom vault integration
- • We send you a Pip-Boy sticker
Frequently Asked Questions
- What is TunnelBoy?
- TunnelBoy is an AWS VPC tunneling CLI for macOS. It uses SSM Session Manager to create secure tunnels to RDS, OpenSearch, and EC2—with optional jump hosts—and includes an interactive Pip-Boy themed TUI. Install via Homebrew.
- Why Pip-Boy theme?
- Because terminals can be fun. The interactive UI uses a Fallout-style Pip-Boy aesthetic for selecting RDS instances, OpenSearch domains, and EC2 instances. TunnelBoy is not affiliated with Bethesda; Pip-Boy is a trademark.
- What do I need?
- macOS (Intel or Apple Silicon), AWS CLI configured with profiles, and the Session Manager Plugin (brew install --cask session-manager-plugin). AWS SSO is supported.
- How do I install?
- Run: brew tap adamw2/tunnelboy && brew install tunnelboy. See the GitHub README for verification and shell completion setup.
- Where do I get help?
- Open an issue or check the README on GitHub. The docs cover profiles, jump hosts, connection presets, RDS IAM auth, and OpenSearch signing proxy.