openclaw-aws-deploy

# OpenClaw AWS Deploy Skill

## Quick Start (Minimal Deployment ~$30/mo)

### Prerequisites
- **AWS credentials** — any of these methods:
  - `--profile <name>` flag (named AWS CLI profile)
  - `.env.aws` file in workspace root or skill directory (optional):
    ```
    AWS_ACCESS_KEY_ID=...
    AWS_SECRET_ACCESS_KEY=...
    AWS_DEFAULT_REGION=us-east-1
    ```
  - Existing environment variables, AWS SSO session, or IAM role
- `.env.starfish` in workspace root (recommended) or skill directory:
  ```
  TELEGRAM_BOT_TOKEN=...     # from @BotFather (required)
  TELEGRAM_USER_ID=...       # your Telegram user ID (optional, enables auto-approve pairing)
  GEMINI_API_KEY=...         # from aistudio.google.com (optional, for Gemini models)
  ```
- `aws` CLI installed OR Docker for sandboxed access
- `jq`, `openssl` available

### One-Shot Deploy

```bash
# From the skill directory:
./scripts/deploy_minimal.sh --name starfish --region us-east-1 \
  --env-dir /path/to/workspace

# Or with cleanup of previous deployment first:
./scripts/deploy_minimal.sh --name starfish --region us-east-1 \
  --env-dir /path/to/workspace --cleanup-first
```

This single command:
1. Creates VPC + subnet + IGW + route table
2. Creates security group (NO inbound ports — SSM only)
3. Creates IAM role with minimal permissions (SSM + Parameter Store + Bedrock)
4. Stores secrets in SSM Parameter Store (fetched at each service start — rewritten on each start, never stored in repo or static images)
5. Launches **t4g.medium** ARM64 instance with user-data bootstrap
6. User-data installs Node.js 22 + OpenClaw + configures everything
7. Runs smoke test via SSM
8. Saves all resource IDs to `deploy-output.json`

### After Deploy

1. **Message the Telegram bot** — you'll get a pairing code
2. **Approve pairing** via SSM:
   ```bash
   aws ssm start-session --target <INSTANCE_ID> --region us-east-1
   sudo -u openclaw bash
   export HOME=/home/openclaw
   openclaw pairing approve telegram <CODE>
   ```
3. Bo...

# openclaw-aws-deploy

**One-shot OpenClaw deployment to AWS** — VPC, EC2, Telegram, any AI model, all in one command.

[![ClawHub](https://img.shields.io/badge/ClawHub-openclaw--aws--deploy-blue)](https://clawhub.ai/skills/openclaw-aws-deploy)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)

## What It Does

Deploys a fully working OpenClaw agent to AWS with a single command:

```
┌─────────────────────────────────────────────────────┐
│                    VPC (isolated)                    │
│  ┌───────────────────────────────────────────────┐  │
│  │      EC2 t4g.medium (ARM64, 4GB, encrypted)   │  │
│  │  ┌───────────────────────────────────────────┐│  │
│  │  │         OpenClaw Gateway                  ││  │
│  │  │  • Any model (Bedrock/Gemini/OpenRouter)  ││  │
│  │  │  • Telegram channel                       ││  │
│  │  │  • Node.js 22 + systemd                   ││  │
│  │  │  • CloudWatch monitoring                  ││  │
│  │  └───────────────────────────────────────────┘│  │
│  └───────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────┘
         ↑                              ↓
    SSM only (no SSH)         Outbound HTTPS only
```

**Cost:** ~$30/month (t4g.medium + EBS + public IP).

## Quick Start

### Step 1: Set Up AWS Permissions

You need an AWS identity with permissions to create VPC, EC2, IAM, SSM, and CloudWatch resources.

**Option A: Use the setup script (recommended)**

```bash
# Create a dedicated deployer IAM role with minimum permissions
./scripts/setup_deployer_role.sh --type role --name openclaw-deployer

# Or create an IAM user with access keys
./scripts/setup_deployer_role.sh --type user --name openclaw-deployer

# Just print the policy (no changes):
./scripts/setup_deployer_role.sh --dry-run
```

**Option B: Use an existing AWS profile/SSO**

If you already have an AWS profile with sufficient permissions:

```bash
# No .env.aws needed — just pass --profil...