AWS Lambda MicroVMs Provider

The provider launches MicroVMs with aws lambda-microvms run-microvm. That command expects an AWS Lambda MicroVM Image ARN, for example:

arn:aws:lambda:us-east-1:123456789012:microvm-image:elasticclaw-base

A public Docker Hub, GHCR, or ECR image cannot be used directly as the image_identifier. AWS first builds a Lambda MicroVM Image from a Dockerfile and code artifact, initializes it, and snapshots the running disk and memory. ElasticClaw then launches agents from that AWS image ARN.

The easiest operator experience is for ElasticClaw to publish a base MicroVM source package that users can import into their AWS account. That package should include:

• A Dockerfile based on public.ecr.aws/lambda/microvms:al2023-minimal.
• The ElasticClaw bridge entrypoint listening on the configured bridge port.
• Required runtime tools such as Git, Node.js/npm, shell utilities, and OpenClaw.
• A run hook handler that reads the ElasticClaw payload and starts the bridge with the supplied environment.

Advanced users can still build their own image and set image_identifier to their custom MicroVM Image ARN.

Until ElasticClaw ships a setup command, treat this as the manual account bootstrap flow:

1. Create an S3 bucket for Lambda MicroVM build artifacts.
2. Package the ElasticClaw MicroVM source bundle as a zip and upload it to S3.
3. Create an IAM build role that Lambda MicroVMs can use while building the image.
4. Create an IAM execution role for launched MicroVMs.
5. Run create-microvm-image with the S3 artifact and AWS base image ARN.
6. Wait for the image to become ready, then copy its MicroVM Image ARN.
7. Configure ElasticClaw with that ARN as image_identifier.

aws lambda-microvms create-microvm-image \
  --code-artifact uri=s3://my-elasticclaw-microvms/elasticclaw-microvm-base.zip \
  --name elasticclaw-base \
  --base-image-arn arn:aws:lambda:us-east-1:aws:microvm-image:al2023-1 \
  --build-role-arn arn:aws:iam::123456789012:role/ElasticClawMicroVMBuildRole

aws lambda-microvms run-microvm \
  --image-identifier arn:aws:lambda:us-east-1:123456789012:microvm-image:elasticclaw-base \
  --execution-role-arn arn:aws:iam::123456789012:role/ElasticClawMicroVMExecutionRole

providers:
  lambda-microvms:
    aws_region: us-east-1
    image_identifier: arn:aws:lambda:us-east-1:123456789012:microvm-image:elasticclaw-base
    execution_role_arn: arn:aws:iam::123456789012:role/ElasticClawMicroVMExecutionRole
    bridge_port: 8080
    maximum_duration_seconds: 28800
    idle_max_duration_seconds: 900
    suspended_duration_seconds: 300
    auto_resume: true

The hub process must have AWS credentials that can run, inspect, suspend, resume, terminate, and mint proxy auth tokens for Lambda MicroVMs.

# elasticclaw-config.yaml
provider: lambda-microvms

The workspace still controls repositories, secrets, model selection, and workflow behavior. The provider controls where the agent runs.

A productized setup command should make the default path one command instead of a manual AWS build sequence:

elasticclaw provider aws-lambda-microvms bootstrap \
  --region us-east-1 \
  --artifact-bucket my-elasticclaw-microvms \
  --image-name elasticclaw-base

That command can upload the ElasticClaw base bundle, create or validate IAM roles, call create-microvm-image, wait for readiness, and write the resulting image_identifier into hub config.

• AWS launch post for Lambda MicroVMs
• Provider overview