Deploy openclaw.ai on AWS EC2

Intermediate ⏱ 35 minutes 📅 Updated Aug 2026

Deploy on Amazon EC2 with a private Gateway and SSH-tunneled Control UI.

🆓

Check Current Free-Tier Terms

AWS account credits and free-plan terms depend on when the account was created and the selected services. Confirm current EC2 eligibility in your Billing console.

Special Offer

Check current AWS offers

Review current credits, free-plan limits, and EC2 pricing before launch.

Get Started →

📋 Prerequisites

1

Launch an EC2 Instance

Open the EC2 Console and launch a new instance:

  1. Click Launch Instance
  2. Name your instance (e.g., openclaw-server)
  3. Under Application and OS Images, select Ubuntu Server 24.04 LTS (64-bit x86) or a newer supported LTS release
  4. Under Instance type, choose t3.small (2 GB RAM) or a current equivalent; size up for heavier workloads
  5. Under Key pair, select an existing key or click Create new key pair — download and save the .pem file securely
  6. Under Network settings, allow SSH traffic from My IP
  7. Set Storage to at least 20 GiB gp3
  8. Click Launch Instance
ℹī¸

Key Pair Security

Store your .pem file in a safe location and set its permissions with chmod 400 your-key.pem. You'll need this file every time you SSH into the instance.

2

Connect via SSH

Once the instance state shows Running, connect using your key pair:

bash
# Set key permissions (first time only)
chmod 400 your-key.pem

# Connect to your EC2 instance
# Ubuntu AMIs use 'ubuntu' as the default user
ssh -i your-key.pem ubuntu@your-ec2-public-ip

You can find the public IP in the EC2 Console under Instance Details → Public IPv4 address.

3

System Update & Dependencies

Update the package index and upgrade all installed packages:

bash
sudo apt update && sudo apt upgrade -y
4

Install supported Node.js version

openclaw.ai requires Node.js 22.22.3+, 24.15+, or 25.9+ (installer defaults to Node 26). Install it from the official NodeSource repository:

bash
curl -fsSL https://deb.nodesource.com/setup_26.x | sudo -E bash -
sudo apt-get install -y nodejs
node --version  # Should show v26.x.x
5

Install openclaw.ai

Run the official one-line installer:

bash
curl -fsSL https://openclaw.ai/install.sh | bash
6

Run Onboarding

Launch the interactive onboarding wizard. The --install-daemon flag automatically configures openclaw.ai to run as a background service:

bash
openclaw onboard --install-daemon

The wizard will walk you through:

  • Authentication setup (API keys for your LLM provider)
  • Gateway configuration (port, allowed origins)
  • Optional channel setup (Slack, Discord, etc.)
7

Verify Installation

Confirm everything is running correctly:

bash
# Check system configuration
openclaw doctor

# Verify the gateway is healthy
openclaw health

# Print the authenticated dashboard URL
openclaw dashboard --no-open

# On your local computer, forward the private Gateway port
ssh -N -L 18789:127.0.0.1:18789 ubuntu@your-ec2-public-ip
# Then open http://127.0.0.1:18789
8

Configure Security Group

AWS Security Groups act as virtual firewalls. Keep only SSH reachable from your IP and access OpenClaw through the tunnel from Step 7:

  1. In the EC2 Console, select your instance
  2. Click the Security tab → click the Security Group link
  3. Click Edit inbound rules → Add rule
  4. Configure the new rule:
text
Type             Protocol   Port Range   Source
SSH              TCP        22           My IP
  1. Click Save rules
⚠ī¸

Keep the Gateway Private

Do not open port 18789 in the security group. Keep the default loopback bind and use SSH forwarding or Tailscale for remote access.

9

Keep Running with systemd

The --install-daemon flag from Step 6 already set up a systemd user service. To check its status:

bash
# Check gateway status via openclaw CLI
openclaw gateway status

# Or check directly via systemd
systemctl --user status openclaw-gateway

# View live logs
journalctl --user -u openclaw-gateway -f

The service will automatically restart on failure and start on boot.

💡

Elastic IP

EC2 public IPs change on instance restart. Allocate an Elastic IP in the EC2 Console and associate it with your instance for a permanent address.

🔧 Troubleshooting

Ensure you're using the correct key file and username. Ubuntu AMIs use ubuntu, not root:

bash
# Correct command for Ubuntu AMI
ssh -i your-key.pem ubuntu@your-ec2-ip

# Ensure key permissions are correct
chmod 400 your-key.pem

Check the Gateway on EC2, then restart the tunnel on your local computer:

bash
# On the EC2 instance
openclaw gateway status
ss -tlnp | grep 18789

# On your local computer
ssh -i your-key.pem -N -L 18789:127.0.0.1:18789 ubuntu@your-ec2-ip

EC2 instances lose their public IP when stopped and restarted. To get a static IP:

  1. Go to EC2 Console → Elastic IPs → Allocate Elastic IP address
  2. Select the new IP → Actions → Associate Elastic IP address
  3. Choose your instance and confirm

Elastic IPs are free while associated with a running instance.

Ready to deploy? Get started with AWS →