Agents in Action

AWS Account

You need an AWS account with permissions to create Lightsail instances. Free tier is fine for testing.

Enable Bedrock Model Access (Required)

The Lightsail blueprint uses AWS Bedrock as the model provider — no separate Anthropic account needed. But you must request access to Claude models first.

• Go to AWS Console → Amazon Bedrock → Model access
• Find Anthropic — Claude and click Request access
• Accept the EULA. Access is usually granted instantly.
• Confirm "Access granted" appears next to Claude Sonnet 4.6

Telegram

Install on your phone and desktop before the lab.

• Phone: App Store / Play Store → "Telegram" → sign up with your phone number
• Desktop: web.telegram.org — no install needed, same account
• Create your bot now: Open Telegram → search @BotFather → send /newbot → follow prompts → copy the token

Set an AWS Budget Alert (Required)

Bedrock charges per token on your AWS bill. Without a budget alert, a debugging loop or runaway cron job can cost you $40+ in a single day. Set this up now.

• Go to AWS Console → Billing → Budgets → Create budget
• Budget type: Cost budget
• Amount: $25/month (covers Lightsail + moderate Bedrock use)
• Alert threshold: 80% → your email
• Add a second alert at 100%

Brave Search API Key (Optional — for web search)

Gives your agent the ability to search the web. Not required for the core lab, but makes the agent significantly more useful.

• Sign up at api.search.brave.com
• Create an API key (free tier: 2,000 queries/month)
• Requires a credit card to sign up

Launch Lightsail Instance

AWS Console → Lightsail → Create instance

Platform:   Linux/Unix
Blueprint:  Apps + OS → search "OpenClaw" → select it  (shows as OpenClaw 2026.2.17)
Plan:       $24/month (4 GB RAM) — AWS recommended for optimal performance
Name it:    OpenClaw-Lab
Click:      Create instance  (takes ~2 minutes)

Connect via Browser SSH

Lightsail Console → your instance → Getting started tab → Connect using SSH (orange button).

A browser terminal opens with the Lightsail OpenClaw MOTD displaying three things you need:

Lightsail OpenClaw MOTD v1.0.0
+----------------------------------------------+
|          OpenClaw Dashboard Access            |
+----------------------------------------------+

Dashboard URL:
    https://<your-ip>/overview

Access Token:
    <your-token>

Current Model:
    bedrock/global.anthropic.claude-sonnet-4-6

Continue with device pairing? (y = pair now, n = skip):

Pair Your Browser with the Dashboard

• Open the Dashboard URL in a new browser tab
• Paste the Access Token into the Gateway Token field
• Click Connect
• The dashboard will show a "device pairing required" message — that's expected

Now go back to the SSH terminal:

Continue with device pairing? (y = pair now, n = skip): y
...approve prompt appears...
a   ← approve the device pairing

The dashboard should now show Health: OK with a green indicator. Your browser is paired.

Enable Bedrock API Access (CloudShell Script)

Your instance needs IAM permissions to call Bedrock. The Getting started tab in the Lightsail console shows a script — copy it and run it in AWS CloudShell.

• Go back to the Lightsail console → your instance → Getting started tab
• Find the "Enable Amazon Bedrock as your model provider" section
• Click Copy the script
• Click Launch CloudShell (or open it from the AWS Console top bar)
• Paste and run the script — it creates an IAM role granting Bedrock access

Test: Chat via Dashboard

Go to Chat in the OpenClaw dashboard and send a message. If you get a response, Bedrock is working and your agent is live.

Set Tools Profile (REQUIRED)

Back in the SSH terminal:

openclaw config set tools.profile full

Connect Telegram

openclaw channels add telegram
# Enter your bot token from BotFather when prompted

Send a message to your bot on Telegram. It will reply with a pairing code and instructions:

openclaw pairing approve telegram <CODE>

Enable Web Search — Brave (Optional)

echo "BRAVE_SEARCH_API_KEY=your_key_here" >> ~/.openclaw/.env
sudo systemctl restart openclaw-gateway

Test it: send your bot "Search the web for the latest AWS news"

Run the Security Audit

openclaw security audit
openclaw security audit --fix    # apply safe auto-remediations

Verify Key Settings

openclaw config get gateway.bind         # should be: loopback ✅
openclaw config get tools.profile        # should be: full

Lock Down File Permissions

chmod 600 ~/.openclaw/.env
chmod 700 ~/.openclaw

Install Go 1.24+ (the apt version is too old)

# Download official Go binary
wget https://go.dev/dl/go1.24.1.linux-amd64.tar.gz

# Remove any old Go and install
sudo rm -rf /usr/local/go
sudo tar -C /usr/local -xzf go1.24.1.linux-amd64.tar.gz

# Add to PATH (and make it persist)
echo 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin' >> ~/.bashrc
source ~/.bashrc

# Verify
go version
# → go version go1.24.1 linux/amd64

Install ALSA dev libraries (required for Go audio build)

sudo apt install -y libasound2-dev

Build sag from source

go install github.com/steipete/sag/cmd/sag@latest

Symlink so the gateway service can find it

sudo ln -sf ~/go/bin/sag /usr/local/bin/sag

Set API key and voice ID

cat >> ~/.openclaw/.env << 'EOF'
ELEVENLABS_API_KEY=your_elevenlabs_api_key_here
ELEVENLABS_VOICE_ID=hpp4J3VqNfWAUOO0d1Us
EOF

# Lock down permissions (secrets file)
chmod 600 ~/.openclaw/.env

# Restart for changes to take effect
sudo systemctl restart openclaw-gateway

Test it

Send a voice note to your bot on Telegram. It should reply with a voice note back in Bella's voice.