OpenClaw on EC2 With No SSH and No Open Ports

I made a video walking through the most secure way to run OpenClaw on AWS, and here are the exact steps written out so you can follow along without pausing. The goal: OpenClaw on Amazon EC2 with no open port and no SSH key, in six CLI commands, nothing exposed to the internet, for about $15 a month.

OpenClaw is an open-source autonomous AI agent that browses the web, works with files, and connects to messaging channels. Once it lives on a server it keeps running without your laptop.

Six commands, no console

The secure deploy uses an AWS Samples CloudFormation template and SSM Session Manager. Normally you SSH in over port 22 with a key file you have to guard. SSM works the other way: the instance has an SSM agent that talks out to AWS over HTTPS only, no inbound port, and your IAM credentials are the login.

You install the AWS CLI and the Session Manager plugin, clone the template repo, and deploy the stack. The template stands up a VPC, the EC2 instance, IAM roles, and security groups, and installs OpenClaw for you. Then you grab the instance ID from the stack outputs, start an SSM tunnel, and pull the OpenClaw URL and token. Open it in the browser and the agent is ready to chat. No AWS Console. No SSH keys. No open ports. The port forward exposes OpenClaw only on localhost.

The instance is a T4g.small, the smallest Graviton box, 2GB of RAM, about $12 a month. It runs Claude Haiku through Amazon Bedrock, so the IAM role handles auth and you never manage a separate API key. Setting create VPC endpoints to false saves about $20 a month, fine for personal use.

Cost and cleanup

EC2 is roughly $12 a month, storage about $2.40, and Haiku is pay per use at around a dollar per million input tokens. Light use is a couple of dollars, heavy use can pass $100, so watch it. Switch to Nova 2 Lite at 30 cents per million if you want it cheaper, which is one stack update. When you are done, one delete-stack command tears down every resource at once. A running instance bills whether you use it or not.

The beginner alternative

If six commands sound like a lot, AWS now ships an OpenClaw blueprint on Lightsail.

You launch it from the Lightsail console, pick the 4GB plan (recommended, and it comes with a free trial window), name the instance, and pair your browser. The instance is pre-configured with Bedrock as the default provider, but you still run one script in CloudShell to grant Bedrock access. The default model is Claude Sonnet, so switch it to Haiku to keep costs down. One thing worth knowing: the Lightsail build sandboxes OpenClaw to its own folder and blocks browser access by default, so it is more locked down than a from-scratch install.

Where to start

Comfortable in a terminal, take the EC2 path for the tightest setup. Newer to AWS, watch the Lightsail walkthrough first to see what each piece does, then come back to secure it. Both videos run through every command.

If you want to size the running cost before you deploy, openclawdc.com has a calculator. I specialize in secure, low-cost AWS deploys like this. Book a call at cloudyeti.io/meet.