Merge pull request #38 from mikelixiang88/main

Remove curl piping patterns and exposed gateway token from disk and cloudformation

Author: JiaDe-Wu

DEPLOYMENT.md

@@ -122,8 +122,8 @@ aws ssm start-session --target $INSTANCE_ID --region us-west-2
 # Switch to ubuntu user
 sudo su - ubuntu
 
-# Get token
-cat ~/.openclaw/gateway_token.txt
+# Get token from SSM Parameter Store
+aws ssm get-parameter --name /openclaw/openclaw-bedrock/gateway-token --with-decryption --query Parameter.Value --output text --region us-west-2
 ```
 
 ### Step 4: Open Web UI

README.md

@@ -109,15 +109,15 @@ Choose this if you need:
 **Just 3 steps**:
 1. ✅ Click "Launch Stack" button below
 2. ✅ Select your EC2 key pair in the form
-3. ✅ Wait ~8 minutes → Check "Outputs" tab → Copy URL → Start using!
+3. ✅ Wait ~8 minutes → Check "Outputs" tab → Retrieve token from SSM → Start using!
 
 **What happens automatically**:
 - Creates VPC, subnets, security groups
 - Launches EC2 instance
 - Installs Node.js, openclaw
 - Configures Bedrock integration
-- Generates secure gateway token
-- Outputs ready-to-use URL with token
+- Generates secure gateway token (stored in SSM Parameter Store)
+- Outputs SSM retrieval command for token
 
 Click to deploy:
 
@@ -161,8 +161,9 @@ For AWS China deployments using SiliconFlow (DeepSeek, Qwen, GLM) instead of Bed
 
 1. **Install SSM Plugin**: Click link in `Step1InstallSSMPlugin` (one-time setup)
 2. **Port Forwarding**: Copy command from `Step2PortForwarding`, run on your computer (keep terminal open)
-3. **Open URL**: Copy URL from `Step3AccessURL`, open in browser (token included!)
-4. **Start Chatting**: Connect WhatsApp/Telegram/Discord in Web UI
+3. **Get Token**: Run the command from `Step3GetToken` to retrieve your token from SSM Parameter Store
+4. **Open URL**: Open `http://localhost:18789/?token=<your-token>` in browser
+5. **Start Chatting**: Connect WhatsApp/Telegram/Discord in Web UI
 
 
 ![CloudFormation Outputs](images/20260128-105244.jpeg)
@@ -204,8 +205,16 @@ aws ssm start-session \
   --document-name AWS-StartPortForwardingSession \
   --parameters '{"portNumber":["18789"],"localPortNumber":["18789"]}'
 
-# Open in browser (token is shown in CloudFormation Outputs > Step3AccessURL)
-http://localhost:18789/?token=<your-token>
+# Retrieve token from SSM Parameter Store
+TOKEN=$(aws ssm get-parameter \
+  --name /openclaw/openclaw-bedrock/gateway-token \
+  --with-decryption \
+  --query Parameter.Value \
+  --output text \
+  --region us-west-2)
+
+# Open in browser
+http://localhost:18789/?token=$TOKEN
 ```
 
 ## How to Use openclaw
@@ -503,7 +512,12 @@ EnableSandbox: false  # Skip Docker installation
 
 ## Security Features
 
-IAM roles eliminate API key risks. CloudTrail logs every API call. VPC Endpoints keep traffic private. Docker sandbox isolates execution.
+- **IAM Roles** — eliminate API key risks
+- **CloudTrail** — logs every Bedrock API call
+- **VPC Endpoints** — keep traffic on private network
+- **SSM Parameter Store** — gateway token stored as SecureString, never written to disk or CloudFormation outputs
+- **Supply-Chain Protection** — Docker and NVM installed via GPG-signed repos / download-then-execute (no `curl | sh`)
+- **Docker Sandbox** — isolates code execution
 
 **Full details**: [SECURITY.md](SECURITY.md)
 

README_CN.md

@@ -117,8 +117,9 @@
 
 1. **安装 SSM 插件**：点击 `Step1InstallSSMPlugin` 链接（一次性）
 2. **端口转发**：复制 `Step2PortForwarding` 命令，在本地运行（保持终端打开）
-3. **打开 URL**：复制 `Step3AccessURL`，在浏览器打开（已含 token）
-4. **开始使用**：在 Web UI 连接 WhatsApp/Telegram/Discord
+3. **获取 Token**：运行 `Step3GetToken` 中的命令，从 SSM Parameter Store 获取 token
+4. **打开 URL**：在浏览器打开 `http://localhost:18789/?token=<你的token>`
+5. **开始使用**：在 Web UI 连接 WhatsApp/Telegram/Discord
 
 ![CloudFormation 输出](images/20260128-105244.jpeg)
 ![openclaw Web UI](images/20260128-105059.jpg)
@@ -156,8 +157,16 @@ aws ssm start-session \
   --document-name AWS-StartPortForwardingSession \
   --parameters '{"portNumber":["18789"],"localPortNumber":["18789"]}'
 
-# 在浏览器打开（token 在 CloudFormation 输出 Step3AccessURL 中）
-http://localhost:18789/?token=<你的token>
+# 从 SSM Parameter Store 获取 token
+TOKEN=$(aws ssm get-parameter \
+  --name /openclaw/openclaw-bedrock/gateway-token \
+  --with-decryption \
+  --query Parameter.Value \
+  --output text \
+  --region us-west-2)
+
+# 在浏览器打开
+http://localhost:18789/?token=$TOKEN
 ```
 
 ## 如何使用 openclaw

TROUBLESHOOTING.md

@@ -37,8 +37,8 @@ XDG_RUNTIME_DIR=/run/user/1000 journalctl --user -u openclaw-gateway.service -n
 # Check configuration
 cat ~/.openclaw/openclaw.json | python3 -m json.tool
 
-# Get gateway token
-cat ~/.openclaw/gateway_token.txt
+# Get gateway token from SSM Parameter Store
+bash ~/ssm-portforward.sh
 
 # Test Bedrock connection
 REGION=$(curl -s http://169.254.169.254/latest/meta-data/placement/region)
@@ -119,8 +119,8 @@ aws ssm start-session \
   --document-name AWS-StartPortForwardingSession \
   --parameters '{"portNumber":["18789"],"localPortNumber":["18789"]}'
 
-# 3. Get correct token (on EC2)
-cat ~/.clawdbot/gateway_token.txt
+# 3. Get correct token (on EC2, via SSM Parameter Store)
+bash ~/ssm-portforward.sh
 
 # 4. Clear browser cache
 # Chrome: Cmd+Shift+Delete (Mac) or Ctrl+Shift+Delete (Windows)
@@ -482,8 +482,11 @@ XDG_RUNTIME_DIR=/run/user/1000 systemctl --user stop clawdbot-gateway
 # Backup old config
 cp ~/.clawdbot/clawdbot.json ~/.clawdbot/clawdbot.json.backup.$(date +%s)
 
-# Get current values
-TOKEN=$(cat ~/.clawdbot/gateway_token.txt)
+# Get current values (token from SSM Parameter Store)
+IMDS_TOKEN=$(curl -s -X PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+INSTANCE_ID=$(curl -s -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" http://169.254.169.254/latest/meta-data/instance-id)
+STACK_NAME=$(aws ec2 describe-tags --filters "Name=resource-id,Values=$INSTANCE_ID" "Name=key,Values=aws:cloudformation:stack-name" --query "Tags[0].Value" --output text --region $REGION)
+TOKEN=$(aws ssm get-parameter --name "/openclaw/$STACK_NAME/gateway-token" --with-decryption --query Parameter.Value --output text --region $REGION)
 REGION=$(curl -s http://169.254.169.254/latest/meta-data/placement/region)
 
 # Recreate config
@@ -643,7 +646,7 @@ cat /tmp/diagnostic-info.txt
 
 ```
 /home/ubuntu/.clawdbot/clawdbot.json          # Main configuration
-/home/ubuntu/.clawdbot/gateway_token.txt      # Gateway token
+# Gateway token: stored in SSM Parameter Store (not on disk)
 /home/ubuntu/.clawdbot/setup_status.txt       # Setup completion status
 /var/log/clawdbot-setup.log                   # Installation log
 /tmp/clawdbot/clawdbot-YYYY-MM-DD.log        # Daily logs
@@ -671,8 +674,8 @@ XDG_RUNTIME_DIR=/run/user/1000 systemctl --user restart clawdbot-gateway
 # Config
 cat ~/.clawdbot/clawdbot.json
 
-# Token
-cat ~/.clawdbot/gateway_token.txt
+# Token (from SSM Parameter Store)
+bash ~/ssm-portforward.sh
 
 # Test Bedrock
 aws bedrock-runtime invoke-model \

clawdbot-bedrock-agentcore-multitenancy.yaml

@@ -565,20 +565,29 @@ Resources:
 
           snap start amazon-ssm-agent || systemctl start amazon-ssm-agent
 
-          curl -fsSL https://get.docker.com | sh
+          # Install Docker via GPG-signed apt repo
+          install -m 0755 -d /etc/apt/keyrings
+          curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+          chmod a+r /etc/apt/keyrings/docker.asc
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" > /etc/apt/sources.list.d/docker.list
+          apt-get update
+          apt-get install -y docker-ce docker-ce-cli containerd.io
           systemctl enable docker
           systemctl start docker
           usermod -aG docker ubuntu
 
           sudo -u ubuntu bash << 'UBUNTU_SCRIPT'
           set -e
           cd ~
-          for i in {1..3}; do
-            if curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash; then
-              break
-            fi
+          # Install NVM (download first, then execute)
+          NVM_VERSION="v0.40.1"
+          for i in 1 2 3; do
+            curl -fsSL "https://raw.githubusercontent.com/nvm-sh/nvm/${!NVM_VERSION}/install.sh" -o /tmp/nvm-install.sh && break
+            echo "NVM download attempt $i failed, retrying in 5s..."
             sleep 5
           done
+          bash /tmp/nvm-install.sh
+          rm -f /tmp/nvm-install.sh
           export NVM_DIR="$HOME/.nvm"
           [ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
           nvm install 22
@@ -720,25 +729,58 @@ Resources:
             --region $REGION \
             --overwrite || echo "Failed to save token to SSM"
 
+          # Save instance info (non-secret metadata only)
           echo "$INSTANCE_ID" > /home/ubuntu/.openclaw/instance_id.txt
           echo "$REGION" > /home/ubuntu/.openclaw/region.txt
-          echo "$GATEWAY_TOKEN" > /home/ubuntu/.openclaw/gateway_token.txt
           chown ubuntu:ubuntu /home/ubuntu/.openclaw/*.txt
 
+          # Clear token from environment
+          unset GATEWAY_TOKEN
+
+          # Create SSM access script (retrieves token from SSM at runtime — never stored on disk)
+          cat > /home/ubuntu/ssm-portforward.sh << 'SSMEOF'
+          #!/bin/bash
+          IMDS_TOKEN=$(curl -s -X PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+          INSTANCE_ID=$(curl -s -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" http://169.254.169.254/latest/meta-data/instance-id)
+          REGION=$(curl -s -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" http://169.254.169.254/latest/meta-data/placement/region)
+          STACK_NAME=$(aws ec2 describe-tags --filters "Name=resource-id,Values=$INSTANCE_ID" "Name=key,Values=aws:cloudformation:stack-name" --query "Tags[0].Value" --output text --region $REGION)
+          TOKEN=$(aws ssm get-parameter --name "/openclaw/$STACK_NAME/gateway-token" --with-decryption --query Parameter.Value --output text --region $REGION)
+
+          echo "=========================================="
+          echo "OpenClaw SSM Port Forwarding"
+          echo "=========================================="
+          echo ""
+          echo "Run on your local computer:"
+          echo ""
+          echo "aws ssm start-session \\"
+          echo "  --target $INSTANCE_ID \\"
+          echo "  --region $REGION \\"
+          echo "  --document-name AWS-StartPortForwardingSession \\"
+          echo "  --parameters '{\"portNumber\":[\"18789\"],\"localPortNumber\":[\"18789\"]}'"
+          echo ""
+          echo "Then open in browser:"
+          echo "http://localhost:18789/?token=$TOKEN"
+          echo ""
+          echo "=========================================="
+          SSMEOF
+          chmod +x /home/ubuntu/ssm-portforward.sh
+          chown ubuntu:ubuntu /home/ubuntu/ssm-portforward.sh
+
           apt-get install -y python3-pip 2>&1 | tee -a /var/log/openclaw-setup.log
           pip3 install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz 2>&1 | tee -a /var/log/openclaw-setup.log
 
           CFN_SIGNAL=$(which cfn-signal 2>/dev/null || find /usr -name cfn-signal 2>/dev/null | head -1)
-          COMPLETE_URL="http://localhost:18789/?token=$GATEWAY_TOKEN"
+          COMPLETE_MSG="OpenClaw ready. Retrieve token from SSM: aws ssm get-parameter --name /openclaw/$STACK_NAME/gateway-token --with-decryption --query Parameter.Value --output text --region $REGION"
 
           if [ -n "$CFN_SIGNAL" ]; then
-            $CFN_SIGNAL -e 0 -d "$COMPLETE_URL" -r "OpenClaw ready" '${OpenClawWaitHandle}'
+            $CFN_SIGNAL -e 0 -d "$COMPLETE_MSG" -r "OpenClaw ready" '${OpenClawWaitHandle}'
           else
-            SIGNAL_JSON="{\"Status\":\"SUCCESS\",\"Reason\":\"OpenClaw ready\",\"UniqueId\":\"openclaw\",\"Data\":\"$COMPLETE_URL\"}"
+            SIGNAL_JSON="{\"Status\":\"SUCCESS\",\"Reason\":\"OpenClaw ready\",\"UniqueId\":\"openclaw\",\"Data\":\"$COMPLETE_MSG\"}"
             curl -X PUT -H 'Content-Type:' --data-binary "$SIGNAL_JSON" '${OpenClawWaitHandle}'
           fi
 
           echo "OpenClaw multi-tenant installation complete!"
+          echo "Token stored in SSM Parameter Store"
       Tags:
         - Key: Name
           Value: !Sub "${AWS::StackName}-gateway"
@@ -763,16 +805,8 @@ Outputs:
       aws ssm get-parameter --name "/openclaw/${AWS::StackName}/gateway-token" --region ${AWS::Region} --with-decryption --query 'Parameter.Value' --output text
 
   Step4AccessURL:
-    Description: "STEP 4: Open this URL in browser"
-    Value: !Select
-      - 1
-      - !Split
-        - '":"'
-        - !Select
-          - 0
-          - !Split
-            - '"}'
-            - !GetAtt OpenClawWaitCondition.Data
+    Description: "STEP 4: Open in browser (replace <token> with value from Step 3)"
+    Value: "http://localhost:18789/?token=<token>"
 
   Step5StartChatting:
     Description: "STEP 5: Start using OpenClaw!"