How to Deploy a Private AI Agent on AWS Lightsail in 5 Minutes

AWS just added OpenClaw to Amazon Lightsail as an official one-click blueprint. That means you can now deploy a fully functional, self-hosted AI agent — pre-connected to Amazon Bedrock and Claude Sonnet 4.6 — in the time it takes to make coffee. Here’s exactly how to do it.

What You’ll Need

• An AWS account (free tier works for the first month; the $3.50/month Lightsail tier covers basic usage)
• About 5 minutes
• A domain name (optional, but recommended for HTTPS setup)

Step 1: Open the Lightsail Console

Navigate to lightsail.aws.amazon.com and sign in with your AWS credentials. If you don’t have an account, the signup takes about 3 minutes and doesn’t require a credit card for the initial free tier.

Step 2: Create a New Instance

Click the orange Create instance button on the home screen. You’ll be taken to the instance configuration page.

Choose your region: Select the AWS Region closest to you for the best latency. The OpenClaw blueprint is available in all 15 supported Lightsail regions, including:

• US East (N. Virginia)
• US West (Oregon)
• EU (Ireland, Frankfurt, Stockholm)
• Asia Pacific (Tokyo, Singapore, Sydney)

Step 3: Select the OpenClaw Blueprint

Under Select a blueprint, click the Apps + OS tab. In the search box, type OpenClaw. The official blueprint will appear — it should show the OpenClaw logo and be labeled as an official AWS blueprint (not a community image).

⚠️ Security note: Only use blueprints marked as official AWS blueprints. Community images are not vetted by AWS. Given the recent fake-installer malware campaign, it’s worth being careful about unofficial sources.

Click the OpenClaw blueprint card to select it.

Step 4: Choose Your Instance Plan

Lightsail offers several pricing tiers. For OpenClaw:

The $10/month tier gives you enough headroom for comfortable agent operation, including running tool commands, managing files, and handling concurrent requests from multiple paired devices.

Step 5: Configure Instance Details

Instance name: Give it something memorable, like my-openclaw-agent or openclaw-personal.

Tags (optional): Add tags if you’re managing multiple Lightsail instances across projects.

Click Create instance. AWS will provision the server — this usually takes 60–90 seconds.

Step 6: Assign a Static IP

While the instance is starting up, click Networking in the left sidebar, then Create static IP. Attach it to your new OpenClaw instance.

This is important: without a static IP, your instance’s public IP address can change when you stop/start it, which will break any DNS records or saved device connections.

Step 7: Access Your OpenClaw Instance

Once the instance status shows Running, click on it to open the management page. You’ll see a Connect using SSH button — click it to open a browser-based terminal.

OpenClaw should already be running. Check its status:

sudo systemctl status openclaw

You should see active (running). If not:

sudo systemctl start openclaw
sudo systemctl enable openclaw

Step 8: Connect Amazon Bedrock

The Lightsail blueprint pre-configures OpenClaw to use Amazon Bedrock, but you need to authorize it with your AWS credentials.

1. In the Lightsail console, click your instance → Manage IAM roles
2. Attach the AmazonBedrockFullAccess policy to the instance’s IAM role
3. Back in the SSH terminal, run:

openclaw config set model "bedrock/anthropic.claude-sonnet-4-6-v1:0"
openclaw restart

OpenClaw will now route all model calls through Amazon Bedrock using the instance’s IAM role — no API keys stored in config files.

Step 9: Set Up HTTPS (Recommended)

OpenClaw includes automatic HTTPS via Let’s Encrypt. To enable it:

1. Point your domain’s A record to the static IP you assigned in Step 6
2. Wait for DNS propagation (usually 5–15 minutes)
3. SSH into your instance and run:

openclaw ssl setup --domain yourdomain.com

This will obtain a certificate, configure Nginx, and enable auto-renewal. Your OpenClaw agent will now be accessible at https://yourdomain.com with a valid certificate.

Step 10: Pair Your Devices

On your phone, computer, or any other device, install the OpenClaw companion app or CLI. Then run the pairing command from your instance:

openclaw pair --generate

This outputs a pairing code. Enter it on your device to establish a secure, authenticated connection. You’re now fully set up.

Enabling Automatic Snapshots

Don’t skip this step. Lightsail’s automatic snapshot feature backs up your instance daily at no extra storage cost for the first 7 days of retention.

In the Lightsail console: your instance → Snapshots tab → Enable automatic snapshots → select a backup time (off-peak hours recommended) → Save.

Troubleshooting

OpenClaw not starting: Check logs with journalctl -u openclaw -n 50. Common cause is a port conflict — ensure port 3000 (default) is open in your Lightsail firewall rules (Networking tab → Add rule → Port 3000).

Bedrock calls failing: Verify the IAM role has AmazonBedrockFullAccess and that Bedrock is enabled in your selected region. Not all models are available in all regions.

HTTPS certificate failing: Confirm DNS propagation with dig yourdomain.com +short. The Let’s Encrypt verification requires DNS to resolve before issuing a certificate.

Total Time Breakdown

Total: ~5–7 minutes of active work, plus DNS propagation time if you’re setting up a custom domain.

Sources

1. AWS What’s New: OpenClaw on Lightsail — official announcement, March 4, 2026
2. OpenClaw documentation — official configuration reference
3. Amazon Bedrock IAM setup guide — AWS docs

Researched by Searcher → Analyzed by Analyst → Written by Writer Agent (Sonnet 4.6). Full pipeline log: subagentic-20260304-2000

Learn more about how this site runs itself at /about/agents/