Hire OpenClaw Agent as Co-worker | One click spin up on AWS

OpenClaw is like hiring someone full-time. They sit at a desk (your server), they have their own email, their own tools, and they're always on. You message them on Telegram or WhatsApp, they remember your last conversation, they can browse the web, write code, read your emails, and actually go do stuff without you watching.

Sameer Goel

Published Mar 16, 2026

Last modified May 13, 2026

Folks, it's time to make agents learn your tasks and automate them. If you are learning a new skill, ask your agent to build a personalized and interactive learning platform for that skill. If you are running a business alone, ask it to analyze your funnel, draft your emails, and tell you exactly what to fix. These are not hypotheticals. This is what OpenClaw does today.

This is for anyone spending hours on manual tasks that an AI agent could handle for you. Email follow-ups, customer research, onboarding sequences, code reviews, content drafts, competitor analysis. If you keep doing it by hand, this guide shows you how to stop.

OpenClaw is an open-source AI agent framework that gives you a gateway, a browser-based Control UI, and a multi-agent system you can wire up to messaging channels like WhatsApp, Telegram, Discord, Slack, and Feishu/Lark. Think of it as the infrastructure layer for running persistent AI agents that people can actually talk to.

The gateway runs on port 18789, serves a real-time chat UI over WebSocket, and manages agent sessions, channel routing, skills, cron jobs, and configuration. You install it with npm, point it at a model provider, and you have a working AI agent with a web interface.

This post covers three ways to deploy OpenClaw on AWS, then walks through the CloudFormation + Bedrock path in detail, because that is the approach covered here.

Three Ways to Deploy on AWS

Path	Time	Monthly Cost	Complexity	Best For
Lightsail Blueprint	~5 min	~$29-32	Easiest	First-timers who want it running now
CloudFormation + Bedrock	~8 min	~$23-43	One command	AWS users, no API keys, production-ready
Manual EC2	~30-45 min	~$15-30 + API costs	Full control	Custom setups, existing infrastructure

Lightsail is a pre-baked image. You click a button, wait, and it works. Manual EC2 gives you total control but takes 30+ minutes of SSH and configuration. CloudFormation + Bedrock sits in the middle: one deploy command, full AWS-native integration, and no third-party API keys to manage.

The CloudFormation + Bedrock Path (Step by Step)

This is the path covered in this guide. It creates a complete, self-contained stack with Bedrock as the model provider, SSM for secure access (no open ports), and a Graviton ARM instance for better price-performance.

Prerequisites

Before you start, you need four things on your local machine:

AWS CLI v2 installed and configured with credentials that have CloudFormation, EC2, IAM, and Bedrock permissions.
An EC2 key pair created in your target region. Go to EC2 > Key Pairs > Create, or run:

1
2
3
aws ec2 create-key-pair --key-name OpenClawKP \
  --query 'KeyMaterial' --output text > ~/.ssh/OpenClawKP.pem
chmod 400 ~/.ssh/OpenClawKP.pem

Bedrock model access enabled. Open the Bedrock Console , go to Model access, and enable the models you want. This is easy to forget and the stack will deploy fine but the agent will not be able to respond.
The SSM Session Manager Plugin installed on your local machine. This is what lets you tunnel into the instance without opening SSH ports. Install instructions: AWS docs .

What the CloudFormation Template Creates

The template (openclaw-bedrock-fixed.yaml) provisions:

A VPC with public and private subnets, internet gateway, and route tables
An EC2 instance (Graviton c7g.large by default, or t4g.medium as used in this guide) running Ubuntu 24.04
An IAM role with Bedrock invoke permissions and SSM managed policy
A 30GB encrypted gp3 data volume (optionally retained on stack delete)
Optional VPC endpoints for private Bedrock and SSM access
Docker installed for sandboxed code execution
The gateway token stored as a SecureString in SSM Parameter Store
A security group with no inbound rules (all access goes through SSM)

The instance bootstrap installs Node.js 22 via nvm, installs OpenClaw globally, writes the Bedrock configuration to ~/.openclaw/openclaw.json, starts the gateway as a systemd user service, and signals CloudFormation when it is ready.

Running the Deployment

Here is the deploy command for this guide. Save it and run it, or just grab the aws cloudformation deploy command:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
STACK_NAME="openclaw-bedrock"
REGION="us-east-1"
MODEL_ID="global.anthropic.claude-opus-4-6-v1"
INSTANCE_TYPE="t4g.medium"
KEY_PAIR_NAME="OpenClawKP"

aws cloudformation deploy \
  --stack-name "$STACK_NAME" \
  --template-file openclaw-bedrock-fixed.yaml \
  --region "$REGION" \
  --parameter-overrides \
    "OpenClawModel=$MODEL_ID" \
    "InstanceType=$INSTANCE_TYPE" \
    "KeyPairName=$KEY_PAIR_NAME" \
    "CreateVPCEndpoints=false" \
    "EnableSandbox=true" \
    "EnableDataProtection=true" \
  --tags \
    "Key=Project,Value=OpenClaw" \
    "Key=Environment,Value=production" \
    "Key=ManagedBy,Value=CloudFormation" \
  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM

Note: the deploy command above overrides several template defaults. The template defaults to a c7g.large instance and Nova 2 Lite as the model. The template defaults to Nova 2 Lite ($0.30/$2.50 per million tokens) for cost efficiency. This guide uses Claude Opus 4.6 for maximum capability. Change the MODEL_ID variable to use a different model.

This takes about 8 minutes. The stack creates the infrastructure, launches the instance, runs the bootstrap script, installs OpenClaw, starts the gateway, and signals back when everything is ready.

You can watch progress in the CloudFormation console or poll from the CLI:

1
2
3
4
aws cloudformation describe-stacks \
  --stack-name openclaw-bedrock \
  --query "Stacks[0].StackStatus" \
  --output text --region us-east-1

Wait for CREATE_COMPLETE.

Connecting via SSM Port Forwarding

Once the stack is up, get the instance ID and start a port forwarding session:

1
2
3
4
5
6
7
8
9
10
11
12
13
# Get the instance ID
INSTANCE_ID=$(aws cloudformation describe-stack-resources \
  --stack-name openclaw-bedrock \
  --region us-east-1 \
  --query "StackResources[?ResourceType=='AWS::EC2::Instance'].PhysicalResourceId | [0]" \
  --output text)

# Start port forwarding (keep this terminal open)
aws ssm start-session \
  --target $INSTANCE_ID \
  --region us-east-1 \
  --document-name AWS-StartPortForwardingSession \
  --parameters '{"portNumber":["18789"],"localPortNumber":["18789"]}'

This tunnels port 18789 on the remote instance to localhost:18789 on your machine. No SSH keys involved, no ports open to the internet.

Getting the Gateway Token

The gateway token was generated during setup and stored encrypted in SSM Parameter Store. Retrieve it in a second terminal:

1
2
3
4
5
6
7
TOKEN=$(aws ssm get-parameter \
  --name /openclaw/openclaw-bedrock/gateway-token \
  --with-decryption \
  --query Parameter.Value \
  --output text --region us-east-1)

echo "http://localhost:18789/?token=$TOKEN"

Opening the Control UI

Open the URL from the previous step in your browser. You should see the OpenClaw Control UI with a chat interface. Type a message and the agent responds using Bedrock.

If you open http://localhost:18789 without the token parameter, you will see an "unauthorized: gateway token missing" error. Either use the full URL with ?token= or paste the token into the Gateway Token field in the UI.

Common Errors and Fixes

These are real issues encountered during deployment, not hypotheticals.

CloudFormation tag validation error. IAM has specific character restrictions on tag values. Tags that propagate to IAM resources will fail if they contain characters IAM does not allow. Keep values to alphanumeric characters, spaces, and basic punctuation. If your tags include something like Value=my-project, production, the stack will fail during IAM resource creation. Fix: keep tag values simple. Value=OpenClaw works.

"unauthorized: gateway token missing." This happens when you open the Control UI URL without the token query parameter. The gateway requires authentication. Fix: use the full URL with ?token=YOUR_TOKEN or paste the token in the Gateway Token field on the login screen.

OOM during onboarding. If you use a t3.micro (1GB RAM), the instance will crash during OpenClaw installation or first agent interaction. Node.js, the gateway, and the model client together need more than 1GB. Fix: use t3.small (2GB) as the minimum, and add a 2GB swap file for safety:

1
2
3
sudo fallocate -l 2G /swapfile && sudo chmod 600 /swapfile
sudo mkswap /swapfile && sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

"command not found" after npm install. When OpenClaw is installed globally via nvm, the binary path is not always in the system PATH. Fix:

1
export PATH=$PATH:$(npm config get prefix)/bin

The CloudFormation template handles this by creating a wrapper script at /usr/local/bin/openclaw that points directly to the nvm-managed node binary.

Gateway won't start. Check if the gateway process is running and if port 18789 is listening:

1
2
openclaw status
ss -tlnp | grep 18789

If the port is not listening, restart the gateway:

1
systemctl --user restart openclaw-gateway.service

Bedrock model errors. The most common cause is that the model has not been enabled in the Bedrock Console. Go to Bedrock > Model access and verify the model you selected is listed as "Access granted." The CloudFormation stack will deploy successfully even if model access is missing, but the agent will fail when it tries to call the model.

WebSocket disconnects with Nginx. If you put Nginx in front of the gateway, WebSocket connections will drop after 60 seconds by default. Add these directives to your Nginx config:

1
2
3
4
proxy_read_timeout 300s;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

What You Get

Here is the architecture after deployment:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
┌──────────────┐     SSM Tunnel      ┌─────────────────────────────┐
│  Your       │ ──────────────────── │  EC2 (Graviton t4g.medium) │
│  Browser     │     port 18789      │                             │
│              │                     │  ┌───────────────────────┐  │
│  Control UI  │ ◄──── WebSocket ──► │  │  OpenClaw Gateway     │  │
│  (chat,      │                     │  │  :18789               │  │
│   config,    │                     │  │  + Control UI (Vite)  │  │
│   channels)  │                     │  └───────────┬───────────┘  │
└──────────────┘                     │              │              │
                                     │  ┌───────────▼───────────┐  │
                                     │  │  Agent Runtime        │  │
                                     │  │  (multi-agent system) │  │
                                     │  └───────────┬───────────┘  │
                                     │              │              │
                                     └──────────────┼──────────────┘
                                                    │
                                          ┌─────────▼─────────┐
                                          │  Amazon Bedrock   │
                                          │  (Claude, Nova,   │
                                          │   DeepSeek, etc.) │
                                          └───────────────────┘

No third-party API keys are stored on the instance. The IAM role handles Bedrock authentication. The gateway token is written to the local config file during setup but is also stored encrypted in SSM Parameter Store.

Cost Breakdown

Real numbers based on us-east-1 pricing:

Component	Lightsail	CloudFormation + Bedrock	Manual EC2
Compute	$24/mo (4GB plan)	~$24/mo (t4g.medium)	~$15/mo (t3.small)
Storage	Included	~$2.40/mo (30GB gp3)	~$2.40/mo (30GB gp3)
VPC Endpoints	N/A	$0 (disabled) or ~$29/mo	N/A
Model costs	Bedrock pay-per-use	Bedrock pay-per-use	Third-party API keys
Estimated total	~$29-32/mo	~$26-56/mo	~$17-30/mo + API

Bedrock usage depends on how much you chat. Nova 2 Lite is the cheapest at $0.30/$2.50 per million input/output tokens. Claude Opus is the most capable but costs $6.00/$30.00 per million tokens. For light personal use, expect $5-10/month in Bedrock charges.

VPC endpoints add roughly $29-37/month (four or five endpoints depending on region, at $0.01/hour each). They keep Bedrock and SSM traffic on the private AWS network. For a personal deployment, you can skip them and save the money. Set CreateVPCEndpoints=false in the deploy command.

Cleanup

When you are done experimenting, delete the stack:

1
aws cloudformation delete-stack --stack-name openclaw-bedrock --region us-east-1

If you deployed with EnableDataProtection=true (as this guide does), the data volume is retained after the stack is deleted. You will need to manually delete it from the EC2 > Volumes console or via the CLI to avoid ongoing storage charges.

Next Steps

Once the gateway is running and you can chat in the Control UI, there are a few things worth setting up.

Agent personality files. Create these in ~/.openclaw/workspace/ or through the Control UI config editor:

SOUL.md defines how the agent behaves, its tone, boundaries, and default responses.
IDENTITY.md gives the agent a name and role. It reads this at the start of every conversation.
USER.md tells the agent about you, your preferences, your projects, and your schedule.

These files become part of the system prompt. They are the simplest way to make the agent useful for your specific workflow.

Messaging channels. The CloudFormation template pre-enables WhatsApp, Telegram, Discord, Slack, and Feishu/Lark plugins. To connect one, go to Channels in the Control UI, add a channel, and follow the setup flow. Telegram is the easiest to start with: message @BotFather, create a bot, paste the token.

Model switching. You can change models without redeploying. Update the OpenClawModel parameter in CloudFormation, or edit ~/.openclaw/openclaw.json on the instance and restart the gateway. The template supports Nova 2 Lite, Nova Pro, Claude Sonnet 4, Claude Sonnet 4.5, Claude Haiku 4.5, Claude Opus 4.5, Claude Opus 4.6, DeepSeek R1, Llama 3.3 70B, and Kimi K2.5.

Monitoring. The instance has CloudWatch Agent policy attached. You can set up log groups for /var/log/openclaw-setup.log and gateway logs to catch issues early.

That is the whole deployment. One CloudFormation command, one SSM tunnel, one browser tab. From zero to a working AI agent with a chat UI in about 10 minutes.

Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.

Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article

Builder Center

Hire OpenClaw Agent as Co-worker | One click spin up on AWS

Sameer Goel

Three Ways to Deploy on AWS

The CloudFormation + Bedrock Path (Step by Step)

Prerequisites

What the CloudFormation Template Creates

Running the Deployment

Connecting via SSM Port Forwarding

Getting the Gateway Token

Opening the Control UI

Common Errors and Fixes

What You Get

Cost Breakdown

Cleanup

Next Steps