clawdbot-bedrock.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'OpenClaw - AWS Native Deployment (Bedrock + SSM + VPC Endpoints)'

Metadata:
  cfn-lint:
    config:
      ignore_checks:
        - E6101
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Basic Configuration"
        Parameters:
          - OpenClawModel
          - OpenClawVersion
          - InstanceType
      - Label:
          default: "Network Configuration"
        Parameters:
          - CreateVPCEndpoints
          - EnableMonitoring

Parameters:
  OpenClawModel:
    Type: String
    Default: "global.amazon.nova-2-lite-v1:0"
    Description: "Bedrock model ID - Nova 2 Lite offers best price-performance for everyday tasks"
    AllowedValues:
      - "global.amazon.nova-2-lite-v1:0"
      - "global.anthropic.claude-sonnet-4-6"
      - "global.anthropic.claude-sonnet-4-5-20250929-v1:0"
      - "us.amazon.nova-pro-v1:0"
      - "global.anthropic.claude-opus-4-7"
      - "global.anthropic.claude-opus-4-6-v1"
      - "global.anthropic.claude-opus-4-5-20251101-v1:0"
      - "global.anthropic.claude-haiku-4-5-20251001-v1:0"
      - "us.deepseek.r1-v1:0"
      - "us.meta.llama3-3-70b-instruct-v1:0"
      - "moonshotai.kimi-k2.5"

  InstanceType:
    Type: String
    Default: "c7g.large"
    Description: "Graviton (ARM) recommended. c7g = compute-optimized (recommended, 2 vCPU for Node.js + sandbox). r7g/r6g = memory-optimized. t4g = burstable."
    AllowedValues:
      - "t4g.small"
      - "t4g.medium"
      - "t4g.large"
      - "t4g.xlarge"
      - "c6g.large"
      - "c6g.xlarge"
      - "c7g.large"
      - "c7g.xlarge"
      - "r6g.medium"
      - "r6g.large"
      - "r6g.xlarge"
      - "r7g.medium"
      - "r7g.large"
      - "r7g.xlarge"
      - "t3.small"
      - "t3.medium"
      - "t3.large"
      - "c5.xlarge"
      - "r5.large"
      - "r5.xlarge"

  CreateVPCEndpoints:
    Type: String
    Default: "false"
    Description: "Create VPC endpoints for private network access to Bedrock and SSM"
    AllowedValues:
      - "true"
      - "false"

  EnableSandbox:
    Type: String
    Default: "true"
    Description: "Install Docker for sandboxed execution (recommended for group chats)"

  OpenClawVersion:
    Type: String
    Default: "2026.6.34"
    AllowedValues:
      - "2026.3.24"
      - "2026.4.5"
      - "2026.4.10"
      - "2026.4.27"
      - "2026.6.9"
      - "2026.6.34"
      - "2026.7.1"
      - "extended-stable"
      - "latest"
    Description: "OpenClaw version. Default 2026.6.34 tracks OpenClaw's 'extended-stable' channel (the maintained production line). Use the 'extended-stable' dist-tag to auto-follow that channel, or '2026.7.1' for the latest release. 2026.3.24 (no model approval, WeChat compatible); 2026.4.5+ (auto-discovery, embeddings). Avoid 'latest' in production — prefer a pinned version or 'extended-stable'."

  EnableMonitoring:
    Type: String
    Default: "true"
    Description: "Enable CloudWatch monitoring, health checks, auto-recovery, and log shipping (+~$4/mo)"
    AllowedValues:
      - "true"
      - "false"

  EnableDataProtection:
    Type: String
    Default: "false"
    Description: "If retain both EBS volume and S3 bucket on stack deletion,set to true. Data will be deleted if set to false."
    AllowedValues:
      - "true"
      - "false"

  EnablePublicAccess:
    Type: String
    Default: "false"
    Description: "Enable public access via ALB + CloudFront"
    AllowedValues:
      - "true"
      - "false"

  EnableWAF:
    Type: String
    Default: "false"
    Description: "Enable AWS WAF for CloudFront (Layer 7 DDoS protection, SQL injection, XSS). WAF must be created in us-east-1."
    AllowedValues:
      - "true"
      - "false"

  AllowedCountries:
    Type: CommaDelimitedList
    Default: ""
    Description: "Optional: Restrict CloudFront access to specific countries using ISO 3166-1 alpha-2 codes (e.g., AU,US,GB,JP). Leave empty (default) to allow all countries worldwide."

Conditions:
  CreateEndpoints: !Equals [!Ref CreateVPCEndpoints, "true"]
  CreateWAF: !And
    - !Equals [!Ref EnableWAF, "true"]
    - !Equals [!Ref EnablePublicAccess, "true"]
    - !Equals [!Ref "AWS::Region", "us-east-1"]
  HasGeoRestriction: !Not
    - !Equals
      - !Join [",", !Ref AllowedCountries]
      - ""
  # Bedrock Mantle supported regions: https://docs.aws.amazon.com/bedrock/latest/userguide/bedrock-mantle.html#bedrock-mantle-supported
  IsUsEast1: !Equals [ !Ref "AWS::Region", "us-east-1" ]
  IsUsEast2: !Equals [ !Ref "AWS::Region", "us-east-2" ]
  IsUsWest2: !Equals [ !Ref "AWS::Region", "us-west-2" ]
  IsApSoutheast3: !Equals [ !Ref "AWS::Region", "ap-southeast-3" ]
  IsApSouth1: !Equals [ !Ref "AWS::Region", "ap-south-1" ]
  IsApNortheast1: !Equals [ !Ref "AWS::Region", "ap-northeast-1" ]
  IsEuCentral1: !Equals [ !Ref "AWS::Region", "eu-central-1" ]
  IsEuWest1: !Equals [ !Ref "AWS::Region", "eu-west-1" ]
  IsEuWest2: !Equals [ !Ref "AWS::Region", "eu-west-2" ]
  IsEuSouth1: !Equals [ !Ref "AWS::Region", "eu-south-1" ]
  IsEuNorth1: !Equals [ !Ref "AWS::Region", "eu-north-1" ]
  IsSaEast1: !Equals [ !Ref "AWS::Region", "sa-east-1" ]
  IsMantleSupportedRegion: !Or
    - !Or
      - Condition: IsUsEast1
      - Condition: IsUsEast2
      - Condition: IsUsWest2
      - Condition: IsApSoutheast3
      - Condition: IsApSouth1
      - Condition: IsApNortheast1
    - !Or
      - Condition: IsEuCentral1
      - Condition: IsEuWest1
      - Condition: IsEuWest2
      - Condition: IsEuSouth1
      - Condition: IsEuNorth1
      - Condition: IsSaEast1
  CreateMantleEndpoint: !And [ Condition: CreateEndpoints, Condition: IsMantleSupportedRegion ]
  EnableCW: !Equals [!Ref EnableMonitoring, "true"]
  ProtectData: !Equals [!Ref EnableDataProtection, "true"]
  DeleteData: !Not [!Equals [!Ref EnableDataProtection, "true"]]
  EnablePublic: !Equals [!Ref EnablePublicAccess, "true"]
  DisablePublic: !Not [!Equals [!Ref EnablePublicAccess, "true"]]

Mappings:
  ArchitectureMap:
    t3.small: { Arch: "amd64" }
    t3.medium: { Arch: "amd64" }
    t3.large: { Arch: "amd64" }
    t3.xlarge: { Arch: "amd64" }
    c5.xlarge: { Arch: "amd64" }
    r5.large: { Arch: "amd64" }
    r5.xlarge: { Arch: "amd64" }
    t4g.small: { Arch: "arm64" }
    t4g.medium: { Arch: "arm64" }
    t4g.large: { Arch: "arm64" }
    t4g.xlarge: { Arch: "arm64" }
    c6g.large: { Arch: "arm64" }
    c6g.xlarge: { Arch: "arm64" }
    c7g.large: { Arch: "arm64" }
    c7g.xlarge: { Arch: "arm64" }
    r6g.medium: { Arch: "arm64" }
    r6g.large: { Arch: "arm64" }
    r6g.xlarge: { Arch: "arm64" }
    r7g.medium: { Arch: "arm64" }
    r7g.large: { Arch: "arm64" }
    r7g.xlarge: { Arch: "arm64" }

  # CloudFront Managed Prefix List IDs by Region
  # AWS Global service: com.amazonaws.global.cloudfront.origin-facing
  # Note: AWS China (cn-*) and GovCloud (us-gov-*) regions are separate partitions
  # and do not have CloudFront service, so they are not included here.
  CloudFrontPrefixListMap:
    # US regions
    us-east-1: { PrefixListId: "pl-3b927c52" }
    us-east-2: { PrefixListId: "pl-b6a144df" }
    us-west-1: { PrefixListId: "pl-4ea04527" }
    us-west-2: { PrefixListId: "pl-82a045eb" }
    # Asia Pacific regions
    ap-south-1: { PrefixListId: "pl-9aa247f3" }
    ap-south-2: { PrefixListId: "pl-02a34e6b" }
    ap-northeast-1: { PrefixListId: "pl-58a04531" }
    ap-northeast-2: { PrefixListId: "pl-22a6434b" }
    ap-northeast-3: { PrefixListId: "pl-96a247ff" }
    ap-southeast-1: { PrefixListId: "pl-31a34658" }
    ap-southeast-2: { PrefixListId: "pl-b8a742d1" }
    ap-southeast-3: { PrefixListId: "pl-1ea34677" }
    ap-southeast-4: { PrefixListId: "pl-9aa344f3" }
    # Canada regions
    ca-central-1: { PrefixListId: "pl-38a64351" }
    # Europe regions
    eu-central-1: { PrefixListId: "pl-a3a144ca" }
    eu-central-2: { PrefixListId: "pl-14a5467d" }
    eu-west-1: { PrefixListId: "pl-4fa04526" }
    eu-west-2: { PrefixListId: "pl-93a247fa" }
    eu-west-3: { PrefixListId: "pl-75b1541c" }
    eu-south-1: { PrefixListId: "pl-8fa045e6" }
    eu-south-2: { PrefixListId: "pl-04a5466d" }
    eu-north-1: { PrefixListId: "pl-fab65393" }
    # South America regions
    sa-east-1: { PrefixListId: "pl-5da64334" }
    # Middle East and Africa regions
    af-south-1: { PrefixListId: "pl-a9a045c0" }
    me-south-1: { PrefixListId: "pl-17a3467e" }
    me-central-1: { PrefixListId: "pl-a1a242c8" }
    il-central-1: { PrefixListId: "pl-89a64be0" }


Resources:
  # ==================== Wait Condition ====================
  OpenClawWaitHandle:
    Type: AWS::CloudFormation::WaitConditionHandle

  OpenClawWaitCondition:
    Type: AWS::CloudFormation::WaitCondition
    DependsOn: OpenClawInstance
    Properties:
      Handle: !Ref OpenClawWaitHandle
      Timeout: '1200'
      Count: 1

  # ==================== VPC and Network ====================
  OpenClawVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: "10.0.0.0/16"
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vpc"

  OpenClawInternetGateway:
    Type: AWS::EC2::InternetGateway

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref OpenClawVPC
      InternetGatewayId: !Ref OpenClawInternetGateway


  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref OpenClawVPC
      CidrBlock: "10.0.1.0/24"
      MapPublicIpOnLaunch: true
      AvailabilityZone: !Select [0, !GetAZs '']
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-subnet-az1"

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Condition: EnablePublic
    Properties:
      VpcId: !Ref OpenClawVPC
      CidrBlock: "10.0.4.0/24"
      MapPublicIpOnLaunch: true
      AvailabilityZone: !Select [1, !GetAZs '']
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-subnet-az2"

  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Condition: CreateEndpoints
    Properties:
      VpcId: !Ref OpenClawVPC
      CidrBlock: "10.0.2.0/24"
      AvailabilityZone: !Select [0, !GetAZs '']
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-private-subnet-az1"

  # Second private subnet in a different AZ for VPC endpoint availability.
  # Some services (e.g. bedrock-mantle) are not available in all AZs.
  # With two subnets, CloudFormation picks the AZ that supports the service.
  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Condition: CreateEndpoints
    Properties:
      VpcId: !Ref OpenClawVPC
      CidrBlock: "10.0.3.0/24"
      AvailabilityZone: !Select [1, !GetAZs '']
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-private-subnet-az2"

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref OpenClawVPC

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: "0.0.0.0/0"
      GatewayId: !Ref OpenClawInternetGateway

  SubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable

  SubnetRouteTableAssociation2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: EnablePublic
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRouteTable

  # Private Route Table for private subnets (VPC endpoints only, no NAT)
  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Condition: CreateEndpoints
    Properties:
      VpcId: !Ref OpenClawVPC
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-private-rtb"

  PrivateSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: CreateEndpoints
    Properties:
      SubnetId: !Ref PrivateSubnet
      RouteTableId: !Ref PrivateRouteTable

  PrivateSubnetRouteTableAssociation2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: CreateEndpoints
    Properties:
      SubnetId: !Ref PrivateSubnet2
      RouteTableId: !Ref PrivateRouteTable

  # ==================== Network ACLs for Private Subnet Security ====================
  # Private subnet now used only for VPC endpoints (when enabled)
  PrivateNetworkAcl:
    Type: AWS::EC2::NetworkAcl
    Condition: CreateEndpoints
    Properties:
      VpcId: !Ref OpenClawVPC
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-private-nacl"

  # Inbound Rules - only from VPC CIDR for VPC endpoints
  PrivateNetworkAclInboundHTTPS:
    Type: AWS::EC2::NetworkAclEntry
    Condition: CreateEndpoints
    Properties:
      NetworkAclId: !Ref PrivateNetworkAcl
      RuleNumber: 100
      Protocol: 6
      RuleAction: allow
      CidrBlock: 10.0.0.0/16
      PortRange:
        From: 443
        To: 443

  PrivateNetworkAclInboundEphemeral:
    Type: AWS::EC2::NetworkAclEntry
    Condition: CreateEndpoints
    Properties:
      NetworkAclId: !Ref PrivateNetworkAcl
      RuleNumber: 130
      Protocol: 6
      RuleAction: allow
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: 1024
        To: 65535

  # Outbound Rules - only HTTPS for VPC endpoint traffic
  PrivateNetworkAclOutboundHTTPS:
    Type: AWS::EC2::NetworkAclEntry
    Condition: CreateEndpoints
    Properties:
      NetworkAclId: !Ref PrivateNetworkAcl
      RuleNumber: 100
      Protocol: 6
      Egress: true
      RuleAction: allow
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: 443
        To: 443

  PrivateNetworkAclOutboundEphemeral:
    Type: AWS::EC2::NetworkAclEntry
    Condition: CreateEndpoints
    Properties:
      NetworkAclId: !Ref PrivateNetworkAcl
      RuleNumber: 130
      Protocol: 6
      Egress: true
      RuleAction: allow
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: 1024
        To: 65535

  PrivateSubnetNetworkAclAssociation2:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Condition: CreateEndpoints
    Properties:
      SubnetId: !Ref PrivateSubnet2
      NetworkAclId: !Ref PrivateNetworkAcl

  # VPC Endpoint Security Group
  VPCEndpointSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Condition: CreateEndpoints
    Properties:
      GroupDescription: "Security group for VPC endpoints"
      VpcId: !Ref OpenClawVPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !Ref OpenClawSecurityGroup
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vpce-sg"

  # Bedrock Runtime VPC Endpoint (Converse API)
  BedrockRuntimeVPCEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreateEndpoints
    Properties:
      VpcId: !Ref OpenClawVPC
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.bedrock-runtime'
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      SubnetIds:
        - !Ref PrivateSubnet
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref VPCEndpointSecurityGroup

  # Bedrock Mantle VPC Endpoint (OpenAI-compatible API for Project Mantle models like Kimi K2.5)
  # Uses two subnets in different AZs — bedrock-mantle may not be available in all AZs.
  BedrockMantleVPCEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreateMantleEndpoint
    Properties:
      VpcId: !Ref OpenClawVPC
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.bedrock-mantle'
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      SubnetIds:
        - !Ref PrivateSubnet
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref VPCEndpointSecurityGroup

  # SSM VPC Endpoint (for Session Manager)
  SSMVPCEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreateEndpoints
    Properties:
      VpcId: !Ref OpenClawVPC
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.ssm'
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      SubnetIds:
        - !Ref PrivateSubnet
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref VPCEndpointSecurityGroup

  SSMMessagesVPCEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreateEndpoints
    Properties:
      VpcId: !Ref OpenClawVPC
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.ssmmessages'
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      SubnetIds:
        - !Ref PrivateSubnet
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref VPCEndpointSecurityGroup

  EC2MessagesVPCEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreateEndpoints
    Properties:
      VpcId: !Ref OpenClawVPC
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.ec2messages'
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      SubnetIds:
        - !Ref PrivateSubnet
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref VPCEndpointSecurityGroup

  # S3 Gateway VPC Endpoint (no additional cost, for S3 API access)
  S3GatewayVPCEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreateEndpoints
    Properties:
      VpcId: !Ref OpenClawVPC
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.s3'
      VpcEndpointType: Gateway
      RouteTableIds:
        - !Ref PublicRouteTable
        - !Ref PrivateRouteTable

  # CloudWatch Logs VPC Endpoint (for log shipping)
  CloudWatchLogsVPCEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreateEndpoints
    Properties:
      VpcId: !Ref OpenClawVPC
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.logs'
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      SubnetIds:
        - !Ref PrivateSubnet
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref VPCEndpointSecurityGroup

  # ==================== IAM Role ====================
  OpenClawInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore'
        - 'arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy'
      Policies:
        - PolicyName: BedrockAccessPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 'bedrock:InvokeModel'
                  - 'bedrock:InvokeModelWithResponseStream'
                  - 'bedrock:ListFoundationModels'
                  - 'bedrock:GetFoundationModel'
                  - 'bedrock:ListInferenceProfiles'
                Resource: '*'
        - PolicyName: BedrockMantleAccessPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 'bedrock-mantle:*'
                Resource: '*'
        - !If
          - EnableCW
          - PolicyName: CloudWatchLogsPolicy
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - 'logs:CreateLogGroup'
                    - 'logs:CreateLogStream'
                    - 'logs:PutLogEvents'
                    - 'logs:DescribeLogStreams'
                  Resource: !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/openclaw/*'
          - !Ref AWS::NoValue
        - PolicyName: SSMParameterPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 'ssm:PutParameter'
                  - 'ssm:GetParameter'
                Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/openclaw/${AWS::StackName}/*'
        - PolicyName: EC2DescribeTagsPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 'ec2:DescribeTags'
                Resource: '*'
        - PolicyName: CloudFormationDescribePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 'cloudformation:DescribeStackResource'
                  - 'cloudformation:SignalResource'
                Resource: !Sub 'arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}/*'
        - PolicyName: S3BucketAccessPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 's3:GetObject'
                  - 's3:PutObject'
                  - 's3:DeleteObject'
                  - 's3:ListBucket'
                  - 's3:GetBucketLocation'
                Resource:
                  - !If
                    - ProtectData
                    - !GetAtt OpenClawS3BucketRetained.Arn
                    - !GetAtt OpenClawS3BucketNotRetained.Arn
                  - !If
                    - ProtectData
                    - !Sub '${OpenClawS3BucketRetained.Arn}/*'
                    - !Sub '${OpenClawS3BucketNotRetained.Arn}/*'
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-instance-role"

  OpenClawInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref OpenClawInstanceRole

  # ==================== Security Group ====================
  ALBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Condition: EnablePublic
    Properties:
      GroupDescription: "ALB security group - CloudFront managed prefix list only"
      VpcId: !Ref OpenClawVPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourcePrefixListId: !FindInMap [CloudFrontPrefixListMap, !Ref "AWS::Region", PrefixListId]
          Description: "HTTP from CloudFront managed prefix list (com.amazonaws.global.cloudfront.origin-facing)"
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: "0.0.0.0/0"
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-alb-sg"

  OpenClawSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "OpenClaw instance security group - SSM Session Manager only (no SSH)"
      VpcId: !Ref OpenClawVPC
      SecurityGroupIngress:
        - !If
          - EnablePublic
          - IpProtocol: tcp
            FromPort: 18789
            ToPort: 18789
            SourceSecurityGroupId: !Ref ALBSecurityGroup
            Description: "OpenClaw from ALB"
          - !Ref AWS::NoValue
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: "0.0.0.0/0"
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-sg"

  # ==================== S3 Bucket ====================
  # Two conditional S3 buckets to match EnableDataProtection parameter behavior (same pattern as EBS volumes)
  OpenClawS3BucketRetained:
    Type: AWS::S3::Bucket
    Condition: ProtectData
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BucketName: !Sub "openclaw-${AWS::StackName}-${AWS::AccountId}"
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: DeleteOldVersions
            Status: Enabled
            NoncurrentVersionExpirationInDays: 30
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-data-bucket"

  OpenClawS3BucketNotRetained:
    Type: AWS::S3::Bucket
    Condition: DeleteData
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      BucketName: !Sub "openclaw-${AWS::StackName}-${AWS::AccountId}"
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: DeleteOldVersions
            Status: Enabled
            NoncurrentVersionExpirationInDays: 30
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-data-bucket"

  # ==================== Data Volume ====================
  OpenClawDataVolumeRetained:
    Type: AWS::EC2::Volume
    Condition: ProtectData
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      AvailabilityZone: !Select [0, !GetAZs '']
      Size: 30
      VolumeType: gp3
      Encrypted: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-data"

  OpenClawDataVolumeNotRetained:
    Type: AWS::EC2::Volume
    Condition: DeleteData
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      AvailabilityZone: !Select [0, !GetAZs '']
      Size: 30
      VolumeType: gp3
      Encrypted: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-data"

  # ==================== EC2 Instance ====================
  OpenClawInstance:
    Type: AWS::EC2::Instance
    Metadata:
      AWS::CloudFormation::Init:
        configSets:
          default:
            - write_files
            - run_setup
        write_files:
          files:
            /opt/openclaw/openclaw-config-legacy.json:
              content: |
                {
                  "gateway": {
                    "mode": "local",
                    "port": 18789,
                    "bind": "BIND_ADDRESS_PLACEHOLDER",
                    "trustedProxies": ["10.0.0.0/16"],
                    "controlUi": {
                      "enabled": true,
                      "dangerouslyDisableDeviceAuth": true,
                      "allowedOrigins": "ALLOWED_ORIGINS_PLACEHOLDER"
                    },
                    "auth": {
                      "mode": "token",
                      "token": "GATEWAY_TOKEN_PLACEHOLDER"
                    }
                  },
                  "models": {
                    "providers": {
                      "amazon-bedrock": {
                        "baseUrl": "https://bedrock-runtime.REGION_PLACEHOLDER.amazonaws.com",
                        "api": "bedrock-converse-stream",
                        "auth": "aws-sdk",
                        "models": [
                          {
                            "id": "MODEL_ID_PLACEHOLDER",
                            "name": "Bedrock Model",
                            "input": ["text", "image"],
                            "contextWindow": 200000,
                            "maxTokens": 8192
                          }
                        ]
                      }
                    }
                  },
                  "agents": {
                    "defaults": {
                      "model": {
                        "primary": "amazon-bedrock/MODEL_ID_PLACEHOLDER"
                      }
                    }
                  }
                }
              mode: "000644"
              owner: root
              group: root
            /opt/openclaw/openclaw-config-modern.json:
              content: |
                {
                  "gateway": {
                    "mode": "local",
                    "port": 18789,
                    "bind": "BIND_ADDRESS_PLACEHOLDER",
                    "trustedProxies": ["10.0.0.0/16"],
                    "controlUi": {
                      "enabled": true,
                      "dangerouslyDisableDeviceAuth": true,
                      "allowedOrigins": "ALLOWED_ORIGINS_PLACEHOLDER"
                    },
                    "auth": {
                      "mode": "token",
                      "token": "GATEWAY_TOKEN_PLACEHOLDER"
                    }
                  },
                  "plugins": {
                    "entries": {
                      "amazon-bedrock": {
                        "enabled": true
                      }
                    }
                  },
                  "agents": {
                    "defaults": {
                      "model": {
                        "primary": "amazon-bedrock/MODEL_ID_PLACEHOLDER"
                      },
                      "memorySearch": {
                        "provider": "bedrock",
                        "model": "amazon.titan-embed-text-v2:0"
                      }
                    }
                  }
                }
              mode: "000644"
              owner: root
              group: root
            /opt/openclaw/SOUL.md:
              content: |
                # OpenClaw on AWS

                You are an AI assistant running on AWS with Amazon Bedrock. You are helpful, concise, and friendly.

                ## First Conversation

                When a user sends their very first message (no prior conversation history), start by warmly greeting them and then help them connect a messaging platform. Say something like:

                "Welcome! I'm your AI assistant running on AWS. Before we dive in, let's connect me to your favorite messaging app so you can chat with me anytime.

                Which platform would you like to connect?
                1. WhatsApp — scan a QR code from your phone
                2. Telegram — create a bot via @BotFather
                3. Discord — add me to your server
                4. Slack — install me in your workspace
                5. Feishu/Lark — connect via webhook bridge

                Just reply with a number or platform name, and I'll walk you through the setup step by step."

                After the user chooses, guide them through the specific setup:

                **WhatsApp**: Tell them to go to the Web UI (Channels > Add Channel > WhatsApp), then on their phone: WhatsApp > Settings > Linked Devices > Link a Device > scan the QR code.

                **Telegram**: Tell them to message @BotFather on Telegram, send /newbot, choose a name and username (must end with 'bot'), copy the token, then paste it in Web UI (Channels > Add Channel > Telegram).

                **Discord**: Tell them to visit discord.com/developers/applications, create a new app, go to Bot > Add Bot, copy the token, enable Message Content Intent, generate an invite URL, then paste the token in Web UI (Channels > Add Channel > Discord).

                **Slack**: Tell them to visit api.slack.com/apps, create a new app, add bot scopes (chat:write, channels:history), install to workspace, copy the Bot User OAuth Token, then paste in Web UI (Channels > Add Channel > Slack).

                **Feishu/Lark**: Tell them this uses a community bridge plugin. They need to configure their Feishu bot credentials in the Web UI. Point them to the docs: https://docs.openclaw.ai/channels or the community plugin page.

                ## Ongoing Conversations

                After the first conversation, be a helpful general-purpose assistant. You can:
                - Answer questions using web search
                - Help with coding, writing, analysis
                - Manage tasks and reminders
                - Process files and documents

                Be concise. Get to the point. If there's a good answer, give it directly.
              mode: "000644"
              owner: root
              group: root
            /opt/openclaw/ssm-portforward.sh:
              content: |
                #!/bin/bash
                IMDS_TOKEN=$(curl -s -X PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
                INSTANCE_ID=$(curl -s -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" http://169.254.169.254/latest/meta-data/instance-id)
                REGION=$(curl -s -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" http://169.254.169.254/latest/meta-data/placement/region)
                STACK_NAME=$(aws ec2 describe-tags --filters "Name=resource-id,Values=$INSTANCE_ID" "Name=key,Values=aws:cloudformation:stack-name" --query "Tags[0].Value" --output text --region $REGION)
                TOKEN=$(aws ssm get-parameter --name "/openclaw/$STACK_NAME/gateway-token" --with-decryption --query Parameter.Value --output text --region $REGION)

                echo "=========================================="
                echo "OpenClaw SSM Port Forwarding"
                echo "=========================================="
                echo ""
                echo "Run on your local computer:"
                echo ""
                echo "aws ssm start-session \\"
                echo "  --target $INSTANCE_ID \\"
                echo "  --region $REGION \\"
                echo "  --document-name AWS-StartPortForwardingSession \\"
                echo "  --parameters '{\"portNumber\":[\"18789\"],\"localPortNumber\":[\"18789\"]}'"
                echo ""
                echo "Then open in browser:"
                echo "http://localhost:18789/?token=$TOKEN"
                echo ""
                echo "=========================================="
              mode: "000755"
              owner: ubuntu
              group: ubuntu
            /opt/openclaw/setup.sh:
              content:
                Fn::Sub: |
                  #!/bin/bash
                  exec > >(tee /var/log/openclaw-setup.log)
                  exec 2>&1

                  echo "=========================================="
                  echo "OpenClaw AWS Native Setup: $(date)"
                  echo "=========================================="

                  export DEBIAN_FRONTEND=noninteractive

                  # Mount data volume
                  echo "[0/9] Mounting data volume..."
                  DATA_DEVICE=""
                  for dev in /dev/nvme1n1 /dev/xvdf /dev/sdf; do
                    if [ -b "$dev" ]; then
                      DATA_DEVICE="$dev"
                      break
                    fi
                  done
                  if [ -z "$DATA_DEVICE" ]; then
                    DATA_DEVICE=$(lsblk -dpno NAME,TYPE | awk '$2=="disk"{print $1}' | grep -v "$(findmnt -n -o SOURCE / | sed 's/p[0-9]*$//')" | head -1)
                  fi

                  if [ -n "$DATA_DEVICE" ] && [ -b "$DATA_DEVICE" ]; then
                    if ! blkid "$DATA_DEVICE" | grep -q ext4; then
                      echo "Formatting $DATA_DEVICE..."
                      mkfs.ext4 -L openclaw-data "$DATA_DEVICE"
                    fi
                    mkdir -p /data
                    if ! mount "$DATA_DEVICE" /data; then
                      echo "FATAL: failed to mount data volume $DATA_DEVICE at /data"
                      exit 1
                    fi
                    # Use LABEL=openclaw-data instead of $DATA_DEVICE because NVMe
                    # device enumeration order is not stable across EC2 reboots
                    # (nvme0n1 and nvme1n1 can swap). The filesystem was labeled
                    # 'openclaw-data' by mkfs.ext4 -L above. See issue #135.
                    grep -q "LABEL=openclaw-data" /etc/fstab || \
                      echo "LABEL=openclaw-data /data ext4 defaults,nofail 0 2" >> /etc/fstab
                    mkdir -p /data/openclaw
                    chown ubuntu:ubuntu /data/openclaw

                    # Bind-mount /data/openclaw onto ~/.openclaw so:
                    #  - OpenClaw sees a real directory at ~/.openclaw (no symlink)
                    #    -- OpenClaw v2026.5.4+ refuses to traverse symlinks for
                    #    exec-approvals.json and other security-critical paths (issue #99).
                    #  - Data is physically stored on the EBS data volume at /data/openclaw.
                    # Bind mount avoids both the symlink-rejection and the
                    # OPENCLAW_STATE_DIR partial-coverage problem (some paths are hardcoded to ~/.openclaw).
                    if mountpoint -q /home/ubuntu/.openclaw; then
                      umount /home/ubuntu/.openclaw || true
                    fi
                    if [ -L /home/ubuntu/.openclaw ]; then
                      rm -f /home/ubuntu/.openclaw
                    elif [ -e /home/ubuntu/.openclaw ]; then
                      # Preserve any existing files by moving them into /data/openclaw before remount
                      shopt -s dotglob nullglob
                      for f in /home/ubuntu/.openclaw/*; do
                        mv -n "$f" /data/openclaw/ || true
                      done
                      shopt -u dotglob nullglob
                      rm -rf /home/ubuntu/.openclaw
                    fi
                    mkdir -p /home/ubuntu/.openclaw
                    chown ubuntu:ubuntu /home/ubuntu/.openclaw
                    mount --bind /data/openclaw /home/ubuntu/.openclaw

                    # Persist bind mount across reboots
                    if ! grep -q "/data/openclaw /home/ubuntu/.openclaw" /etc/fstab; then
                      echo "/data/openclaw /home/ubuntu/.openclaw none bind 0 0" >> /etc/fstab
                    fi

                    # Also set OPENCLAW_STATE_DIR for completeness (some plugins still read it)
                    mkdir -p /home/ubuntu/.config/environment.d
                    echo "OPENCLAW_STATE_DIR=/home/ubuntu/.openclaw" > /home/ubuntu/.config/environment.d/openclaw.conf
                    chown ubuntu:ubuntu /home/ubuntu/.config/environment.d/openclaw.conf
                  else
                    echo "FATAL: no data volume found — expected an EBS volume attached at /dev/nvme1n1, /dev/xvdf, or /dev/sdf"
                    exit 1
                  fi
                  STATE_DIR=/home/ubuntu/.openclaw

                  # System update
                  echo "[1/9] Updating system..."
                  apt-get update
                  apt-get upgrade -y
                  apt-get install -y unzip curl

                  # Configure swap (2GB) — prevents hard OOM kills on low-memory instances
                  echo "[1.1/9] Configuring swap..."
                  if [ ! -f /swapfile ]; then
                    fallocate -l 2G /swapfile
                    chmod 600 /swapfile
                    mkswap /swapfile
                    swapon /swapfile
                    echo '/swapfile swap swap defaults 0 0' >> /etc/fstab
                    echo 'vm.swappiness=10' >> /etc/sysctl.conf
                    sysctl vm.swappiness=10
                  fi
                  echo "Swap configured: $(swapon --show)"

                  # Detect region and instance ID (IMDSv2)
                  echo "[*] Detecting instance metadata..."
                  IMDS_TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" 2>/dev/null || echo "")
                  if [ -n "$IMDS_TOKEN" ]; then
                    AWS_REGION=$(curl -s -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" http://169.254.169.254/latest/meta-data/placement/region 2>/dev/null || echo "")
                    INSTANCE_ID=$(curl -s -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" http://169.254.169.254/latest/meta-data/instance-id 2>/dev/null || echo "")
                  else
                    AWS_REGION=$(curl -s http://169.254.169.254/latest/meta-data/placement/region 2>/dev/null || echo "")
                    INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id 2>/dev/null || echo "")
                  fi
                  AWS_REGION=${!AWS_REGION:-"${AWS::Region}"}
                  INSTANCE_ID=${!INSTANCE_ID:-"unknown"}
                  echo "Region: $AWS_REGION | Instance: $INSTANCE_ID"

                  # Install AWS CLI v2
                  echo "[2/9] Installing AWS CLI..."
                  curl "https://awscli.amazonaws.com/awscli-exe-linux-$(arch).zip" -o "awscliv2.zip"
                  unzip -q awscliv2.zip
                  ./aws/install
                  rm -rf aws awscliv2.zip

                  # SSM Agent
                  echo "[3/9] Configuring SSM Agent..."
                  snap start amazon-ssm-agent || systemctl start amazon-ssm-agent

                  # Docker (conditional)
                  if [ "${EnableSandbox}" = "true" ]; then
                    echo "[4/9] Installing Docker..."
                    install -m 0755 -d /etc/apt/keyrings
                    curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
                    chmod a+r /etc/apt/keyrings/docker.asc
                    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" > /etc/apt/sources.list.d/docker.list
                    apt-get update
                    apt-get install -y docker-ce docker-ce-cli containerd.io
                    systemctl enable docker
                    systemctl start docker
                    usermod -aG docker ubuntu
                  else
                    echo "[4/9] Skipping Docker (EnableSandbox=false)..."
                  fi

                  # Install Node.js — SYSTEM-level via NodeSource (NOT a version manager).
                  # OpenClaw 2026.6.x audits the gateway service runtime: a Node managed by
                  # NVM/fnm/asdf etc. is flagged "gateway-runtime-node-version-manager" and the
                  # updater migrates it on upgrade, which breaks the systemd unit ("Unit file
                  # not found"). A system Node at /usr/bin/node avoids that migration entirely.
                  echo "[5/9] Installing Node.js 22 LTS (system, via NodeSource)..."
                  for i in 1 2 3; do
                    curl -fsSL https://deb.nodesource.com/setup_22.x -o /tmp/nodesource_setup.sh && break
                    echo "NodeSource download attempt $i failed, retrying in 5s..."
                    sleep 5
                  done
                  bash /tmp/nodesource_setup.sh
                  rm -f /tmp/nodesource_setup.sh
                  apt-get install -y nodejs
                  echo "Node: $(node --version)  npm: $(npm --version)"

                  npm config set registry https://registry.npmjs.org/
                  OPENCLAW_VERSION="${OpenClawVersion}"
                  ARCH=$(uname -m)
                  # 2026.3.24 on ARM64: use --ignore-scripts (avoids native build issues)
                  # 2026.4.5+: must NOT use --ignore-scripts (needs native modules like @buape/carbon)
                  IGNORE_FLAG=""
                  if [ "$ARCH" = "aarch64" ] && [ "$OPENCLAW_VERSION" = "2026.3.24" ]; then
                    IGNORE_FLAG="--ignore-scripts"
                    echo "ARM64 + 3.24: installing with --ignore-scripts"
                  fi
                  # Global install goes to system path (/usr/lib/node_modules) — runs as root (UserData)
                  npm install -g openclaw@$OPENCLAW_VERSION --timeout=300000 $IGNORE_FLAG || {
                    npm cache clean --force
                    npm install -g openclaw@$OPENCLAW_VERSION --timeout=300000 $IGNORE_FLAG
                  }

                  # Create openclaw wrapper (system node + system global openclaw)
                  NODE_BIN=$(command -v node)
                  OPENCLAW_MJS="$(npm root -g)/openclaw/openclaw.mjs"
                  if [ ! -f "$OPENCLAW_MJS" ] || [ -z "$NODE_BIN" ]; then
                    echo "FATAL: openclaw or node not found (OPENCLAW_MJS=$OPENCLAW_MJS NODE_BIN=$NODE_BIN)"
                    exit 1
                  fi
                  echo "#!/bin/bash" > /usr/local/bin/openclaw
                  echo "exec $NODE_BIN $OPENCLAW_MJS \"\$@\"" >> /usr/local/bin/openclaw
                  chmod +x /usr/local/bin/openclaw

                  if ! /usr/local/bin/openclaw --version 2>/dev/null; then
                    echo "FATAL: openclaw wrapper cannot execute"
                    exit 1
                  fi
                  echo "openclaw verified: $(/usr/local/bin/openclaw --version)"

                  # Configure AWS region
                  echo "[6/9] Configuring AWS..."
                  sudo -u ubuntu mkdir -p /home/ubuntu/.aws
                  sudo -u ubuntu bash -c "printf '[default]\nregion = %s\noutput = json\n' \"$AWS_REGION\" > /home/ubuntu/.aws/config"
                  chown -R ubuntu:ubuntu /home/ubuntu/.aws
                  chmod 600 /home/ubuntu/.aws/config

                  # Environment variables
                  echo "[7/9] Configuring environment variables..."
                  {
                    echo "export AWS_REGION=$AWS_REGION"
                    echo "export AWS_DEFAULT_REGION=$AWS_REGION"
                    echo "export AWS_PROFILE=default"
                    echo "export OPENCLAW_MODEL=${OpenClawModel}"
                    echo "export OPENCLAW_USE_BEDROCK=true"
                    echo "export OPENCLAW_STATE_DIR=/home/ubuntu/.openclaw"
                  } >> /home/ubuntu/.bashrc

                  # Also add to .profile so OPENCLAW_STATE_DIR is available in
                  # non-interactive login shells (e.g. 'sudo su - ubuntu')
                  echo "export OPENCLAW_STATE_DIR=/home/ubuntu/.openclaw" >> /home/ubuntu/.profile
                  chown ubuntu:ubuntu /home/ubuntu/.profile

                  # Ensure .config is ubuntu-owned before gateway install runs
                  mkdir -p /home/ubuntu/.config/systemd/user
                  chown -R ubuntu:ubuntu /home/ubuntu/.config

                  sudo -u ubuntu mkdir -p /home/ubuntu/.config/environment.d
                  sudo -u ubuntu bash -c "{ echo AWS_REGION=$AWS_REGION; echo AWS_DEFAULT_REGION=$AWS_REGION; echo AWS_PROFILE=default; } > /home/ubuntu/.config/environment.d/aws.conf"

                  loginctl enable-linger ubuntu
                  systemctl start user@1000.service

                  # Configure OpenClaw
                  echo "[8/9] Configuring OpenClaw..."
                  sudo -u ubuntu mkdir -p "$STATE_DIR"

                  # Write .env for Bedrock IAM auth — survives gateway install/reinstall
                  # OpenClaw 2026.4.5+ uses pi-coding-agent which needs AWS_PROFILE
                  # to discover IAM credentials from EC2 instance profile (IMDS)
                  sudo -u ubuntu bash -c "printf 'AWS_PROFILE=default\nAWS_REGION=$AWS_REGION\nAWS_DEFAULT_REGION=$AWS_REGION\n' > $STATE_DIR/.env"

                  GATEWAY_TOKEN=$(openssl rand -hex 24)

                  # Select config template based on OpenClaw version
                  # 2026.3.24: uses models.providers (explicit model list)
                  # 2026.4.5+: uses plugins.entries.discovery (auto-discovers Bedrock models)
                  OPENCLAW_VERSION="${OpenClawVersion}"
                  if [ "$OPENCLAW_VERSION" = "2026.3.24" ]; then
                    echo "Using legacy config (models.providers) for $OPENCLAW_VERSION"
                    cp /opt/openclaw/openclaw-config-legacy.json "$STATE_DIR/openclaw.json"
                    sed -i "s/REGION_PLACEHOLDER/$AWS_REGION/g" "$STATE_DIR/openclaw.json"
                  else
                    echo "Using modern config (plugins.discovery) for $OPENCLAW_VERSION"
                    cp /opt/openclaw/openclaw-config-modern.json "$STATE_DIR/openclaw.json"
                  fi
                  chown ubuntu:ubuntu "$STATE_DIR/openclaw.json"

                  # Configure bind address and allowed origins based on public access
                  if [ "${EnablePublicAccess}" = "true" ]; then
                    BIND_ADDRESS="0.0.0.0"
                    echo "Public access enabled - binding to 0.0.0.0"

                    # CloudFront domain from OPENCLAW_CF_DOMAIN env var (set in UserData via Fn::If)
                    if [ -n "$OPENCLAW_CF_DOMAIN" ]; then
                      CLOUDFRONT_DOMAIN="https://$OPENCLAW_CF_DOMAIN"
                      ALLOWED_ORIGINS="[\"$CLOUDFRONT_DOMAIN\"]"
                      echo "Configuring allowedOrigins: $ALLOWED_ORIGINS"
                    else
                      ALLOWED_ORIGINS="[]"
                      echo "CloudFront domain not found, allowedOrigins will be empty"
                    fi
                  else
                    BIND_ADDRESS="loopback"
                    ALLOWED_ORIGINS="[]"
                    echo "Private access only - binding to loopback"
                  fi

                  sed -i "s/BIND_ADDRESS_PLACEHOLDER/$BIND_ADDRESS/g" "$STATE_DIR/openclaw.json"
                  sed -i "s/GATEWAY_TOKEN_PLACEHOLDER/$GATEWAY_TOKEN/g" "$STATE_DIR/openclaw.json"
                  sed -i "s|MODEL_ID_PLACEHOLDER|${OpenClawModel}|g" "$STATE_DIR/openclaw.json"
                  sed -i "s|\"ALLOWED_ORIGINS_PLACEHOLDER\"|$ALLOWED_ORIGINS|g" "$STATE_DIR/openclaw.json"

                  # Install and start gateway
                  for i in $(seq 1 15); do
                    if [ -S /run/user/1000/bus ]; then
                      echo "User systemd session ready"
                      break
                    fi
                    echo "Waiting for user session... $i/15"
                    sleep 2
                  done

                  sudo -H -u ubuntu XDG_RUNTIME_DIR=/run/user/1000 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus OPENCLAW_STATE_DIR="$STATE_DIR" bash -c '
                  export HOME=/home/ubuntu
                  export OPENCLAW_STATE_DIR=$OPENCLAW_STATE_DIR
                  openclaw gateway install || echo "Gateway install failed"

                  # Fix systemd service to include OPENCLAW_STATE_DIR
                  SERVICE_FILE="$HOME/.config/systemd/user/openclaw-gateway.service"
                  if [ -f "$SERVICE_FILE" ]; then
                    if ! grep -q "OPENCLAW_STATE_DIR" "$SERVICE_FILE"; then
                      sed -i "/^Environment=OPENCLAW_GATEWAY_PORT/a Environment=OPENCLAW_STATE_DIR=$STATE_DIR" "$SERVICE_FILE"
                      systemctl --user daemon-reload
                      echo "Added OPENCLAW_STATE_DIR to systemd service"
                    fi
                  fi

                  systemctl --user start openclaw-gateway.service || { openclaw gateway & } || echo "Gateway start failed"
                  '

                  # Wait for daemon
                  echo "Waiting for OpenClaw daemon..."
                  for i in $(seq 1 30); do
                    if ss -tlnp 2>/dev/null | grep -q ':18789'; then
                      echo "OpenClaw daemon is up on port 18789"
                      break
                    fi
                    echo "Attempt $i/30: waiting..."
                    sleep 2
                  done

                  if ! ss -tlnp 2>/dev/null | grep -q ':18789'; then
                    echo "WARNING: Gateway did not start, trying fallback..."
                    sudo -H -u ubuntu XDG_RUNTIME_DIR=/run/user/1000 bash -c '
                    export HOME=/home/ubuntu
                    systemctl --user restart openclaw-gateway.service || openclaw gateway &
                    '
                    sleep 5
                  fi

                  # Enable messaging channels
                  echo "[8.5/9] Enabling messaging channels..."
                  sudo -H -u ubuntu bash -c '
                  export HOME=/home/ubuntu
                  openclaw plugins enable whatsapp || echo "WhatsApp plugin enable failed"
                  openclaw plugins enable telegram || echo "Telegram plugin enable failed"
                  openclaw plugins enable discord || echo "Discord plugin enable failed"
                  openclaw plugins enable slack || echo "Slack plugin enable failed"
                  '
                  # Community plugins install into the system global node_modules (needs root)
                  npm install -g openclaw-feishu@latest --timeout=60000 2>/dev/null || echo "Feishu plugin install skipped"
                  npm install -g openclaw-wechat@latest --timeout=60000 2>/dev/null || echo "WeChat plugin install skipped"

                  # Safety net (issue #168): repoint extension "openclaw" peer links to the
                  # current global install so they never go stale across Node/openclaw upgrades.
                  # With system Node these paths are already stable; this guards residual/legacy
                  # links (e.g. left over from an nvm-based deploy that was upgraded in place).
                  GLOBAL_OPENCLAW="$(npm root -g)/openclaw"
                  sudo -H -u ubuntu GLOBAL_OPENCLAW="$GLOBAL_OPENCLAW" bash -c '
                  export HOME=/home/ubuntu
                  shopt -s nullglob
                  for link in /home/ubuntu/.openclaw/extensions/*/node_modules/openclaw; do
                    ln -sfn "$GLOBAL_OPENCLAW" "$link" && echo "repointed peer link: $link"
                  done
                  ' || echo "peer-link repoint skipped"

                  # Copy SOUL.md
                  cp /opt/openclaw/SOUL.md "$STATE_DIR/SOUL.md"
                  chown ubuntu:ubuntu "$STATE_DIR/SOUL.md"

                  # Save token to SSM Parameter Store
                  STACK_NAME="${AWS::StackName}"
                  aws ssm put-parameter \
                    --name "/openclaw/$STACK_NAME/gateway-token" \
                    --value "$GATEWAY_TOKEN" \
                    --type "SecureString" \
                    --region $AWS_REGION \
                    --overwrite || echo "Failed to save token to SSM"
                  unset GATEWAY_TOKEN

                  # Save instance info
                  echo "$INSTANCE_ID" > "$STATE_DIR/instance_id.txt"
                  echo "$AWS_REGION" > "$STATE_DIR/region.txt"

                  # Copy SSM access script
                  cp /opt/openclaw/ssm-portforward.sh /home/ubuntu/ssm-portforward.sh
                  chown ubuntu:ubuntu /home/ubuntu/ssm-portforward.sh

                  # Signal CloudFormation
                  echo "[9/9] Signaling CloudFormation..."
                  echo "SUCCESS" > "$STATE_DIR/setup_status.txt"
                  echo "Setup completed: $(date)" >> "$STATE_DIR/setup_status.txt"

                  # Read token back from SSM for cfn-signal (so CloudFormation Outputs can build the access URL)
                  CFN_TOKEN=$(aws ssm get-parameter --name "/openclaw/$STACK_NAME/gateway-token" --with-decryption --query Parameter.Value --output text --region $AWS_REGION 2>/dev/null || echo "TOKEN_UNAVAILABLE")

                  CFN_SIGNAL=$(which cfn-signal 2>/dev/null || find /usr -name cfn-signal 2>/dev/null | head -1)
                  if [ -n "$CFN_SIGNAL" ]; then
                    $CFN_SIGNAL -e 0 -d "$CFN_TOKEN" -r "OpenClaw ready" '${OpenClawWaitHandle}'
                  else
                    SIGNAL_JSON="{\"Status\":\"SUCCESS\",\"Reason\":\"OpenClaw ready\",\"UniqueId\":\"openclaw\",\"Data\":\"$CFN_TOKEN\"}"
                    curl -X PUT -H "Content-Type:" --data-binary "$SIGNAL_JSON" "${OpenClawWaitHandle}"
                  fi
                  unset CFN_TOKEN

                  echo "=========================================="
                  echo "OpenClaw installation complete!"
                  echo "=========================================="

                  # Configure journald log limits
                  echo "[post] Configuring log rotation..."
                  mkdir -p /etc/systemd/journald.conf.d
                  cat > /etc/systemd/journald.conf.d/openclaw.conf << 'JOURNALD_CONF'
                  [Journal]
                  SystemMaxUse=500M
                  SystemMaxFileSize=50M
                  MaxRetentionSec=7day
                  JOURNALD_CONF
                  systemctl restart systemd-journald

                  # Configure unattended security upgrades
                  echo "[post] Configuring unattended upgrades..."
                  apt-get install -y unattended-upgrades
                  cat > /etc/apt/apt.conf.d/20auto-upgrades << 'AUTO_UPGRADES'
                  APT::Periodic::Update-Package-Lists "1";
                  APT::Periodic::Unattended-Upgrade "1";
                  APT::Periodic::AutocleanInterval "7";
                  AUTO_UPGRADES

                  # Disable automatic reboots from unattended-upgrades.
                  # OpenClaw runs as a long-lived single-tenant service; reboots
                  # should be operator-controlled, not silent at 05:54 UTC.
                  # See issue #136 (paired with #135 fstab fix to prevent the
                  # "5+ hours offline after silent reboot" failure mode).
                  cat > /etc/apt/apt.conf.d/52auto-reboot-policy << 'REBOOT_POLICY'
                  Unattended-Upgrade::Automatic-Reboot "false";
                  Unattended-Upgrade::Automatic-Reboot-WithUsers "false";
                  REBOOT_POLICY

                  # Mask packagekit-offline-update.service to close the
                  # secondary reboot path (template doesn't use packagekit).
                  systemctl mask packagekit-offline-update.service 2>/dev/null || true

                  # Run openclaw doctor post-install
                  echo "[post] Running openclaw doctor..."
                  sudo -H -u ubuntu XDG_RUNTIME_DIR=/run/user/1000 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus bash -c '
                  export HOME=/home/ubuntu
                  openclaw doctor --fix 2>&1 || echo "openclaw doctor completed with warnings"
                  '

                  # Install health check cron
                  echo "[post] Installing health check..."
                  cat > /opt/openclaw/health-check.sh << 'HEALTHCHECK'
                  #!/bin/bash
                  # OpenClaw Gateway Health Check
                  export XDG_RUNTIME_DIR=/run/user/1000
                  export DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus

                  LOG="/var/log/openclaw-health.log"
                  MAX_LOG_SIZE=1048576

                  if [ -f "$LOG" ] && [ $(stat -c%s "$LOG" 2>/dev/null || echo 0) -gt $MAX_LOG_SIZE ]; then
                    mv "$LOG" "$LOG.old"
                  fi

                  # Check if gateway port is listening
                  if ! ss -tlnp 2>/dev/null | grep -q ':18789'; then
                    echo "$(date) UNHEALTHY: Port 18789 not listening, restarting gateway" >> $LOG
                    sudo -H -u ubuntu bash -c "export XDG_RUNTIME_DIR=/run/user/1000; export DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus; systemctl --user restart openclaw-gateway.service" 2>>$LOG
                    sleep 10
                    if ss -tlnp 2>/dev/null | grep -q ':18789'; then
                      echo "$(date) RECOVERED: Gateway restarted successfully" >> $LOG
                    else
                      echo "$(date) CRITICAL: Gateway failed to restart" >> $LOG
                    fi
                    exit 0
                  fi

                  # Check if gateway HTTP responds (catches deadlocked process)
                  HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 http://127.0.0.1:18789/ 2>/dev/null || echo "000")
                  if [ "$HTTP_STATUS" = "000" ]; then
                    echo "$(date) UNHEALTHY: Gateway not responding to HTTP (status=$HTTP_STATUS), restarting" >> $LOG
                    sudo -H -u ubuntu bash -c "export XDG_RUNTIME_DIR=/run/user/1000; export DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus; systemctl --user restart openclaw-gateway.service" 2>>$LOG
                    sleep 10
                    echo "$(date) Restarted gateway after HTTP failure" >> $LOG
                    exit 0
                  fi

                  # Channel connectivity check (every 30 min = every 6th run of 5-min cron)
                  COUNTER_FILE="/tmp/openclaw-health-counter"
                  COUNT=$(cat $COUNTER_FILE 2>/dev/null || echo 0)
                  COUNT=$((COUNT + 1))
                  echo $COUNT > $COUNTER_FILE

                  if [ $((COUNT % 6)) -eq 0 ]; then
                    echo "$(date) Running channel connectivity check..." >> $LOG
                    CHANNEL_STATUS=$(sudo -H -u ubuntu bash -c '
                      export HOME=/home/ubuntu
                      export XDG_RUNTIME_DIR=/run/user/1000
                      export DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
                      timeout 30 openclaw status 2>&1
                    ' || echo "STATUS_FAILED")

                    if echo "$CHANNEL_STATUS" | grep -qi "ERROR\|CRITICAL\|disconnected\|crashed"; then
                      echo "$(date) CHANNEL_ISSUE: Channel error detected, restarting gateway" >> $LOG
                      echo "$CHANNEL_STATUS" | grep -i "ERROR\|CRITICAL\|disconnected\|crashed" >> $LOG
                      sudo -H -u ubuntu bash -c "export XDG_RUNTIME_DIR=/run/user/1000; export DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus; systemctl --user restart openclaw-gateway.service" 2>>$LOG
                      sleep 10
                      echo "$(date) Restarted gateway after channel error" >> $LOG
                    else
                      echo "$(date) HEALTHY: Gateway and channels OK" >> $LOG
                    fi
                  fi
                  HEALTHCHECK
                  chmod +x /opt/openclaw/health-check.sh

                  # Health check every 5 minutes
                  (crontab -l 2>/dev/null; echo "*/5 * * * * /opt/openclaw/health-check.sh") | crontab -

                  # Install and configure CloudWatch Agent (conditional)
                  if [ "${EnableMonitoring}" = "true" ]; then
                    echo "[post] Installing CloudWatch Agent..."
                    CW_ARCH=$(uname -m)
                    if [ "$CW_ARCH" = "aarch64" ]; then
                      curl -sO "https://amazoncloudwatch-agent.s3.amazonaws.com/ubuntu/arm64/latest/amazon-cloudwatch-agent.deb"
                    else
                      curl -sO "https://amazoncloudwatch-agent.s3.amazonaws.com/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb"
                    fi
                    dpkg -i -E amazon-cloudwatch-agent.deb || true
                    rm -f amazon-cloudwatch-agent.deb

                    cat > /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json << 'CWCONFIG'
                    {
                      "metrics": {
                        "namespace": "OpenClaw",
                        "metrics_collected": {
                          "mem": { "measurement": ["mem_used_percent"], "metrics_collection_interval": 300 },
                          "disk": { "measurement": ["disk_used_percent"], "resources": ["/", "/data"], "metrics_collection_interval": 300 },
                          "swap": { "measurement": ["swap_used_percent"], "metrics_collection_interval": 300 }
                        },
                        "append_dimensions": { "InstanceId": "${!aws:InstanceId}" }
                      },
                      "logs": {
                        "logs_collected": {
                          "files": {
                            "collect_list": [
                              { "file_path": "/var/log/openclaw-setup.log", "log_group_name": "/openclaw/setup", "log_stream_name": "{instance_id}", "retention_in_days": 30 },
                              { "file_path": "/var/log/openclaw-health.log", "log_group_name": "/openclaw/health", "log_stream_name": "{instance_id}", "retention_in_days": 14 }
                            ]
                          }
                        }
                      }
                    }
                  CWCONFIG
                    /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json || echo "CloudWatch Agent config failed"
                  else
                    echo "[post] Skipping CloudWatch Agent (EnableMonitoring=false)..."
                  fi

                  # Add systemd memory limit override for gateway
                  echo "[post] Configuring systemd memory limits..."
                  sudo -u ubuntu mkdir -p /home/ubuntu/.config/systemd/user/openclaw-gateway.service.d
                  cat > /home/ubuntu/.config/systemd/user/openclaw-gateway.service.d/memory-limit.conf << 'MEMLIMIT'
                  [Service]
                  MemoryMax=80%
                  MemoryHigh=70%
                  MEMLIMIT
                  chown -R ubuntu:ubuntu /home/ubuntu/.config/systemd/user/openclaw-gateway.service.d
                  sudo -H -u ubuntu XDG_RUNTIME_DIR=/run/user/1000 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus bash -c 'systemctl --user daemon-reload'
              mode: "000755"
              owner: root
              group: root
        run_setup:
          commands:
            01_run_setup:
              command: "/opt/openclaw/setup.sh"
              ignoreErrors: false
    Properties:
      ImageId: !Sub
        - '{{resolve:ssm:/aws/service/canonical/ubuntu/server/24.04/stable/current/${Arch}/hvm/ebs-gp3/ami-id}}'
        - Arch: !FindInMap [ArchitectureMap, !Ref InstanceType, Arch]
      InstanceType: !Ref InstanceType
      IamInstanceProfile: !Ref OpenClawInstanceProfile
      Monitoring: !If [EnableCW, true, false]
      MetadataOptions:
        HttpTokens: required
        HttpPutResponseHopLimit: 2
        HttpEndpoint: enabled
      Volumes:
        - Device: /dev/sdf
          VolumeId: !If [ProtectData, !Ref OpenClawDataVolumeRetained, !Ref OpenClawDataVolumeNotRetained]
      NetworkInterfaces:
        - AssociatePublicIpAddress: true
          DeviceIndex: 0
          GroupSet:
            - !Ref OpenClawSecurityGroup
          SubnetId: !Ref PublicSubnet
      BlockDeviceMappings:
        - DeviceName: /dev/sda1
          Ebs:
            VolumeSize: 30
            VolumeType: gp3
            DeleteOnTermination: true
      UserData:
        Fn::Base64:
          Fn::Sub:
            - |
              #!/bin/bash
              # Minimal bootstrap — installs cfn-init, then delegates to Metadata::Init
              set -e
              exec > >(tee /var/log/openclaw-bootstrap.log) 2>&1
              echo "Bootstrap start: $(date)"
              export DEBIAN_FRONTEND=noninteractive
              export OPENCLAW_CF_DOMAIN="${CloudFrontDomain}"
              apt-get update -q
              apt-get install -y -q python3-pip
              pip3 install --break-system-packages https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz
              CFN_INIT=$(which cfn-init 2>/dev/null || find /usr -name cfn-init 2>/dev/null | head -1)
              if [ -z "$CFN_INIT" ]; then
                echo "FATAL: cfn-init not found after install"
                exit 1
              fi
              echo "Running cfn-init..."
              $CFN_INIT -v --stack ${AWS::StackName} --resource OpenClawInstance --region ${AWS::Region} --configsets default
              echo "Bootstrap complete: $(date)"
            - CloudFrontDomain: !If [EnablePublic, !GetAtt OpenClawCloudFrontDistribution.DomainName, ""]
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-instance"

  # ==================== Load Balancer ====================
  OpenClawALB:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Condition: EnablePublic
    Properties:
      Name: !Sub "${AWS::StackName}-alb"
      Type: application
      Scheme: internet-facing
      IpAddressType: ipv4
      Subnets:
        - !Ref PublicSubnet
        - !Ref PublicSubnet2
      SecurityGroups:
        - !Ref ALBSecurityGroup
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-alb"

  OpenClawTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Condition: EnablePublic
    Properties:
      Name: !Sub "${AWS::StackName}-tg"
      Port: 18789
      Protocol: HTTP
      VpcId: !Ref OpenClawVPC
      TargetType: instance
      HealthCheckEnabled: true
      HealthCheckPath: /
      HealthCheckProtocol: HTTP
      HealthCheckIntervalSeconds: 30
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 3
      Targets:
        - Id: !Ref OpenClawInstance
          Port: 18789
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-tg"

  OpenClawALBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Condition: EnablePublic
    Properties:
      LoadBalancerArn: !Ref OpenClawALB
      Port: 80
      Protocol: HTTP
      DefaultActions:
        - Type: fixed-response
          FixedResponseConfig:
            StatusCode: "403"
            ContentType: "text/plain"
            MessageBody: "Access Denied"

  OpenClawALBListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Condition: EnablePublic
    Properties:
      ListenerArn: !Ref OpenClawALBListener
      Priority: 1
      Conditions:
        - Field: http-header
          HttpHeaderConfig:
            HttpHeaderName: X-Custom-Header
            Values:
              - !Ref AWS::StackId
      Actions:
        - Type: forward
          TargetGroupArn: !Ref OpenClawTargetGroup

  # ==================== WAF (Web Application Firewall) ====================
  # WAF for CloudFront must be created in us-east-1 (global CloudFront service requirement)
  OpenClawWAFWebACL:
    Type: AWS::WAFv2::WebACL
    Condition: CreateWAF
    Properties:
      Name: !Sub "${AWS::StackName}-waf"
      Scope: CLOUDFRONT
      DefaultAction:
        Allow: {}
      Rules:
        # AWS Managed Rule: Core Rule Set (CRS)
        - Name: AWSManagedRulesCommonRuleSet
          Priority: 1
          OverrideAction:
            None: {}
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesCommonRuleSet
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: AWSManagedRulesCommonRuleSetMetric

        # AWS Managed Rule: Known Bad Inputs
        - Name: AWSManagedRulesKnownBadInputsRuleSet
          Priority: 2
          OverrideAction:
            None: {}
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesKnownBadInputsRuleSet
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: AWSManagedRulesKnownBadInputsRuleSetMetric

        # AWS Managed Rule: SQL Injection Protection
        - Name: AWSManagedRulesSQLiRuleSet
          Priority: 3
          OverrideAction:
            None: {}
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesSQLiRuleSet
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: AWSManagedRulesSQLiRuleSetMetric

        # AWS Managed Rule: Linux Operating System Protection
        - Name: AWSManagedRulesLinuxRuleSet
          Priority: 4
          OverrideAction:
            None: {}
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesLinuxRuleSet
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: AWSManagedRulesLinuxRuleSetMetric

        # Rate Limiting Rule (1000 requests per 5 minutes per IP)
        - Name: RateLimitRule
          Priority: 5
          Action:
            Block:
              CustomResponse:
                ResponseCode: 429
          Statement:
            RateBasedStatement:
              Limit: 1000
              AggregateKeyType: IP
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: RateLimitRuleMetric

      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: !Sub "${AWS::StackName}-waf"
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-waf"

  # ==================== CloudFront ====================
  OpenClawCloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Condition: EnablePublic
    Properties:
      DistributionConfig:
        Enabled: true
        Comment: "OpenClaw - Secured with Shield Standard DDoS Protection + Custom Header + WAF"
        WebACLId: !If
          - CreateWAF
          - !GetAtt OpenClawWAFWebACL.Arn
          - !Ref AWS::NoValue
        DefaultCacheBehavior:
          TargetOriginId: alb-origin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
            - PUT
            - POST
            - PATCH
            - DELETE
          CachedMethods:
            - GET
            - HEAD
          ForwardedValues:
            QueryString: true
            Headers:
              - '*'
            Cookies:
              Forward: all
          MinTTL: 0
          DefaultTTL: 0
          MaxTTL: 0
        Origins:
          - Id: alb-origin
            DomainName: !GetAtt OpenClawALB.DNSName
            CustomOriginConfig:
              HTTPPort: 80
              OriginProtocolPolicy: http-only
            OriginCustomHeaders:
              - HeaderName: X-Custom-Header
                HeaderValue: !Ref AWS::StackId
        Restrictions:
          GeoRestriction:
            RestrictionType: !If
              - HasGeoRestriction
              - whitelist
              - none
            Locations: !If
              - HasGeoRestriction
              - !Ref AllowedCountries
              - !Ref AWS::NoValue

  # ==================== CloudWatch Alarms ====================
  EC2AutoRecoveryAlarm:
    Type: AWS::CloudWatch::Alarm
    Condition: EnableCW
    Properties:
      AlarmName: !Sub "${AWS::StackName}-auto-recovery"
      AlarmDescription: "Auto-recover EC2 instance on system status check failure"
      Namespace: AWS/EC2
      MetricName: StatusCheckFailed_System
      Dimensions:
        - Name: InstanceId
          Value: !Ref OpenClawInstance
      Statistic: Maximum
      Period: 60
      EvaluationPeriods: 2
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      AlarmActions:
        - !Sub "arn:aws:automate:${AWS::Region}:ec2:recover"

  EC2InstanceStatusAlarm:
    Type: AWS::CloudWatch::Alarm
    Condition: EnableCW
    Properties:
      AlarmName: !Sub "${AWS::StackName}-instance-status"
      AlarmDescription: "Reboot on instance status check failure"
      Namespace: AWS/EC2
      MetricName: StatusCheckFailed_Instance
      Dimensions:
        - Name: InstanceId
          Value: !Ref OpenClawInstance
      Statistic: Maximum
      Period: 60
      EvaluationPeriods: 3
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      AlarmActions:
        - !Sub "arn:aws:automate:${AWS::Region}:ec2:reboot"

Outputs:
  GetToken:
    Description: "Get OpenClaw Gateway Token from SSM Parameter Store"
    Value: !Sub |
      aws ssm get-parameter --name /openclaw/${AWS::StackName}/gateway-token --with-decryption --query Parameter.Value --output text --region ${AWS::Region}

  CloudFrontURL:
    Condition: EnablePublic
    Description: "OpenClaw Public Access URL (HTTPS). Replace <token> with the value from the output 'GetToken'"
    Value: !Sub
      - "https://${Domain}/?token=<token>"
      - Domain: !GetAtt OpenClawCloudFrontDistribution.DomainName

  Step1InstallSSMPlugin:
    Condition: DisablePublic
    Description: "STEP 1: Install SSM Session Manager Plugin on your local computer (Option 2: go to EC2 Console > right-click instance > Connect > Session Manager to get a shell, then run 'sudo su - ubuntu && openclaw gateway status' to set up IM channels)"
    Value: "https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html"

  Step2PortForwarding:
    Condition: DisablePublic
    Description: "STEP 2: Run this command on LOCAL computer (keep terminal open)"
    Value: !Sub |
      aws ssm start-session --target ${OpenClawInstance} --region ${AWS::Region} --document-name AWS-StartPortForwardingSession --parameters '{"portNumber":["18789"],"localPortNumber":["18789"]}'

  Step3AccessURL:
    Condition: DisablePublic
    Description: "STEP 3: Open in browser (replace <token> with value from the output 'GetToken')"
    Value: "http://localhost:18789/?token=<token>"     

  Step4StartChatting:
    Condition: DisablePublic
    Description: "STEP 4: Start using OpenClaw!"
    Value: "Connect WhatsApp, Telegram, Discord. See README: https://github.com/aws-samples/sample-OpenClaw-on-AWS-with-Bedrock"

  InstanceId:
    Description: "EC2 Instance ID (for reference)"
    Value: !Ref OpenClawInstance

  BedrockModel:
    Description: "Bedrock model in use"
    Value: !Ref OpenClawModel

  MonthlyCost:
    Description: "Estimated monthly cost (USD)"
    Value: !Sub
      - |
        EC2 (${InstanceType}): ~$50-60 (c7g.large ~$58, Graviton 20% cheaper than x86)
        EBS (30GB x2): ~$4.80
        VPC Endpoints: ${EndpointCost}
        Monitoring: ${MonitoringCost}
        Public Access: ${PublicCost}
        WAF: ${WAFCost}
        Bedrock: Pay-per-use
        Total: ${TotalCost}/month
        Note: EC2 in public subnet with direct internet access (no NAT Gateway). Compute-optimized (c7g, 2 vCPU) for Node.js + Docker sandbox. Swap, health checks, OS patches always enabled.
      - EndpointCost: !If [CreateEndpoints, "~$88 ($0.01/hour/AZ x 2 AZs x 6 interface endpoints = $14.60/endpoint/mo: Bedrock Runtime, Bedrock Mantle (conditional), SSM, SSM Messages, EC2 Messages, CloudWatch Logs. S3 Gateway free)", "$0 (disabled)"]
        MonitoringCost: !If [EnableCW, "~$4 (CloudWatch Agent + detailed monitoring + alarms + logs)", "$0 (disabled)"]
        PublicCost: !If [EnablePublic, "~$25 (ALB ~$22/mo + CloudFront $0.085/GB)", "$0 (SSM only)"]
        WAFCost: !If [CreateWAF, "~$10 (WebACL $5/mo + 5 rules x $1/mo + requests $0.60/million)", "$0 (disabled or not us-east-1)"]
        TotalCost: !If
          - EnablePublic
          - !If [CreateWAF, "~$188", "~$178"]
          - !If
            - CreateEndpoints
            - !If [EnableCW, "~$155", "~$151"]
            - !If [EnableCW, "~$67", "~$63"]

  InstanceArchitecture:
    Description: "Instance architecture"
    Value: !FindInMap [ArchitectureMap, !Ref InstanceType, Arch]

  DataVolumeIdRetained:
    Condition: ProtectData
    Description: "Data volume ID (retained on stack delete)"
    Value: !Ref OpenClawDataVolumeRetained

  DataVolumeIdNotRetained:
    Condition: DeleteData
    Description: "Data volume ID (deleted with stack)"
    Value: !Ref OpenClawDataVolumeNotRetained

  S3BucketNameRetained:
    Condition: ProtectData
    Description: "S3 bucket name that interacts with OpenClaw (retained on stack delete)"
    Value: !Ref OpenClawS3BucketRetained

  S3BucketNameNotRetained:
    Condition: DeleteData
    Description: "S3 bucket name that interacts with OpenClaw (deleted with stack)"
    Value: !Ref OpenClawS3BucketNotRetained

  SecurityFeatures:
    Description: "Security protections available in this deployment"
    Value: "See the SECURITY.md document at https://github.com/aws-samples/sample-OpenClaw-on-AWS-with-Bedrock/blob/main/SECURITY.md"