AgentAura on AWS: Set Up an EC2 Server ☁️

By the end of this guide you will have an Ubuntu 24.04 EC2 instance in your own AWS account, a private key that logs in to it, and the four values that AgentAura's My Server option asks for. On AWS, My Server is the only path: you launch the instance in the AWS console, and AgentAura logs in to it over SSH.

The server requirements and the key rules that apply to every provider are in our overview, Getting a Server for AgentAura. The AWS console changes from time to time, so a label may look slightly different from ours.

1. Create an AWS Account

Sign up from aws.amazon.com. AWS asks for an email address and account name, a root user password, contact details and a valid payment method; you cannot finish sign-up without one. You may also be asked to confirm a phone number by SMS. Activation usually takes a few minutes, occasionally up to 24 hours. AWS is rolling out a newer sign-up flow to some customers, so your screens may differ.

During sign-up you choose a plan. At the time of writing (September 2026), new accounts get USD $100 in credits, and can earn up to $100 more, on either plan:

• Free plan: no charges, but the account closes automatically after six months or when the credits run out, whichever comes first. AWS keeps your data for 90 days, during which you can upgrade to keep it. Some services are not available on this plan.
• Paid plan: the same credits, then normal pay-as-you-go pricing. The account does not close.

The Free plan is fine for trying AgentAura. If you want your agent to keep running, upgrade before the six months are up.

2. Decide Where the SSH Key Comes From

• Let AWS create the key pair while you launch the instance (step 3). You download the private key once as a .pem file, and AgentAura accepts that file as it is. This is the simplest option.
• Or use your own key, made just for this server and without a passphrase, and import its public half under Key Pairs, Import key pair:

# macOS or Linux
mkdir -p ~/.ssh
ssh-keygen -t ed25519 -f ~/.ssh/agentaura -N "" -C "agentaura"

# Windows 10 or 11, in PowerShell. When asked for a passphrase, press Enter twice.
New-Item -ItemType Directory -Force "$HOME\.ssh" | Out-Null
ssh-keygen -t ed25519 -f "$HOME\.ssh\agentaura" -C "agentaura"

EC2 accepts RSA and ED25519 keys for Linux. Key pairs belong to one AWS Region, so create or import the key in the Region where you launch the instance. The steps below assume AWS creates it.

3. Launch the Instance

1. Open the EC2 console. In the navigation bar, pick a Region near you, then choose Launch instance.

2. Under Name and tags, enter a name such as agentaura.

3. Under Application and OS Images (Amazon Machine Image), choose Quick Start, then Ubuntu, and select Ubuntu Server 24.04 LTS. Make sure the architecture is 64-bit x86, not Arm.

4. Under Instance type, pick one with 2 vCPUs and 4 GiB on an x86 processor:

   • c7i-flex.large (Intel). On accounts created on or after 15 July 2025 it is marked Free tier eligible, so your credits cover it.
   • t3.medium (Intel) or t3a.medium (AMD) are the same size.

   Avoid t4g and other Graviton types: they are Arm and AgentAura will not install on them. The other free-tier types, t3.micro and t3.small, have 1 GiB and 2 GiB of memory, which is less than we recommend.

5. Under Key pair (login), choose Create new key pair. Name it agentaura, pick ED25519 or RSA, keep the .pem format, and create it. Your browser downloads agentaura.pem. This is the only chance to save it, so keep it safe. Never choose to proceed without a key pair.

6. Under Network settings, keep the default VPC and make sure Auto-assign public IP is Enable. Keep Create security group. AWS then adds an inbound SSH rule open to all IP addresses. Leave any options that open web ports (HTTP, HTTPS) unticked.

7. Under Configure storage the default works; raise the size if you expect the agent to handle large projects.

8. Choose Launch instance. Open Instances, wait until the state is Running and the status checks have passed, then copy the Public IPv4 address.

4. Keep SSH Open, and Only SSH

The security group needs exactly one inbound rule: SSH, port 22, source 0.0.0.0/0. AWS's documentation calls SSH open to all addresses unsafe for production, and the console may offer to limit it to your own IP. For AgentAura, do not. AgentAura connects from its own cloud, not from your computer, both for the install and later for logs, restarts, reconnecting a credential, adding agents and updates. A rule narrowed to your IP breaks all of those.

What makes an open port safe is key-only login. On EC2, password login and root login are disabled by default, so only someone holding your private key gets in. Do not open other ports: the installer sets up an outbound Cloudflare Tunnel, which needs no inbound rule.

Two things to know about the address:

• The auto-assigned public IPv4 is released when the instance stops, and a new one is assigned when it starts. If you need a fixed address, associate an Elastic IP.
• AWS charges by the hour for every public IPv4 address, including the one on a running instance and any Elastic IP.

5. Log In Once Yourself

On macOS or Linux, move the key somewhere safe, lock its permissions, and log in:

mkdir -p ~/.ssh
mv ~/Downloads/agentaura.pem ~/.ssh/
chmod 400 ~/.ssh/agentaura.pem
ssh -i ~/.ssh/agentaura.pem ubuntu@203.0.113.10

On Windows, in PowerShell:

ssh -i "$HOME\Downloads\agentaura.pem" ubuntu@203.0.113.10

Use your instance's address instead of 203.0.113.10. The login user on AWS's Ubuntu image is ubuntu. Check that sudo works without a password, which the installer needs:

sudo -n true && echo "passwordless sudo OK"

If the login is refused at first or apt reports a lock, the instance is still finishing first-boot work. Give it a few minutes before deploying.

6. Fill In AgentAura

In AgentAura, add a server with My Server and enter:

To print the key for copying, run cat ~/.ssh/agentaura.pem on macOS or Linux, or Get-Content "$HOME\Downloads\agentaura.pem" in PowerShell. If you imported your own key, paste the private key agentaura instead, never agentaura.pub. Start the deployment and watch the output; the quick start covers what comes next.

7. Costs and Cleanup

• Running: the instance is billed, idle or not, unless your Free Tier credits cover it.
• Stopped: no instance charges, but the EBS volume is still billed, and so is an Elastic IP associated with it. The agent is offline while the instance is stopped.
• Terminated: charges for the instance end. In EC2, terminate means delete, and it cannot be undone.

When you are finished, open Instances, select yours, and choose Instance state, Terminate (delete) instance. Then check Volumes and Elastic IPs for anything left behind, and release an Elastic IP you no longer use. Removing the agent in AgentAura does not delete anything in AWS.

Common Problems

• "Permission denied (publickey)". The login user is root instead of ubuntu, the key does not match the instance, or a .pub file was pasted instead of the private key.
• Connection timed out. The SSH rule was narrowed to your IP, the instance has no public IPv4, or it is stopped.
• Windows says the key file is unprotected. In File Explorer, open the file's Properties, Security, Advanced, choose Disable inheritance, and remove every user except yourself.
• The install fails early. Check for an Arm (Graviton) instance type or an Arm image and launch again on x86.
• AgentAura cannot reach the server after a stop and start. The public IPv4 changed. Use an Elastic IP if you plan to stop the instance.
• Everything is gone after six months. The account was on the Free plan and was not upgraded.

AWS's references: Free Tier plans · Launch an instance · Default users on EC2 Linux · Stop and start costs