Building Secure AI Agents with OpenClaw on AWS

O’Reilly Live Course | Kesha Williams

Starter configurations, custom skill templates, IAM policy templates, and security checklists for the O’Reilly Live Course: Building Secure AI Agents with OpenClaw on AWS.

Quick Start

git clone https://github.com/keshawillz/oreilly-openclaw-on-aws.git
cd oreilly-openclaw-on-aws

Clone this repo before the session so you have the files ready. You don’t need to install or configure anything else in advance. The Lightsail instance handles everything.

Prerequisites

AWS Account Setup (Required)

• An AWS account. If you don’t have one, create a free tier account at https://aws.amazon.com/free/webapps. Note: this course cannot use the O’Reilly Sandbox environment.
• Amazon Bedrock model access enabled for Anthropic models. Anthropic models require a one-time use case submission per AWS account before they can be enabled. Submit the form via the Amazon Bedrock Console under Model Catalog. Details: https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html
• A Telegram account (recommended for the messaging integration exercises)

Technical Background

• Comfort working in a terminal (bash, SSH, basic filesystem navigation)
• Basic familiarity with AWS (console navigation, IAM concepts, launching instances)
• An understanding of LLM concepts (prompts, completions, tokens)
• No prior OpenClaw experience required

Course Structure

What’s in This Repo

presentations/
  module1-slides.pdf       # Slide decks for each module (PDF)
  module2-slides.pdf
  module3-slides.pdf
  module4-slides.pdf
  module5-slides.pdf
  wrapup-slides.pdf

handouts/
  module1-handout.pdf      # Step-by-step exercise instructions for each module
  module2-handout.pdf
  module3-handout.pdf
  module4-handout.pdf
  module5-handout.pdf

starter-configs/
  SOUL.md                  # Agent identity and behavioral boundaries
  openclaw.json            # Agent runtime configuration (tools, skills, model)
  HEARTBEAT.md             # Scheduled task configuration

skill-templates/
  project-scaffolder/
    SKILL.md               # Creates project directory structures
  file-organizer/
    SKILL.md               # Sorts files by type and date
  code-review/
    SKILL.md               # Analyzes code and provides structured feedback

iam-policies/
  bedrock-after-hardening.json   # Marketplace removed, ApplyGuardrail added
  bedrock-default.json           # Original CloudShell policy (for reference)
  README.md                      # Policy documentation

security/
  production-checklist.md        # 15-item security checklist
  skill-audit-checklist.md       # Third-party skill review guide
  bedrock-guardrail-guide.md     # Bedrock Guardrails setup for OpenClaw
  exec-hardening-guide.md        # Exec sandbox and approval settings

How Files Map to Modules

After the Session

These files are yours to keep and customize. Use them as starting points for your own OpenClaw deployments. The security/production-checklist.md is the most important takeaway. Run through it before pointing any production workload at your agent.

Resources

• OpenClaw Documentation
• OpenClaw Security Docs
• OpenClaw Bedrock Provider Docs
• AWS Lightsail OpenClaw Quick Start
• OWASP Top 10 for Agentic Applications 2026
• MITRE ATLAS Threat Model
• AWS Agentic AI Security Scoping Matrix

About the Instructor

Kesha Williams is an enterprise architect and AI consultant with over three decades of experience designing, building, and operating production software systems. She’s the founder and managing partner of Keysoft, an AWS AI Hero, creator of the RAISE Framework for agentic AI governance, and a global keynote and TED speaker.

License

MIT