> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/expel-assembler/deploy-the-virtual-machine/deploy-the-assembler-in-aws.md).

# Deploy the Assembler in AWS

Each assembler you created must be deployed via a virtual machine, and then you can add your technology as a security device in Workbench to complete the full integration. For more information about the Expel Assembler or how it works, see the [About the Expel Assembler](/connect-your-technology/expel-assembler/about-the-expel-assembler.md) guide.

## Prerequisites

* You must have completed all of the steps in [Add a New Assembler](/connect-your-technology/expel-assembler/add-a-new-assembler.md) for each assembler you wish to deploy.

## Step 1: Download the CoreOS Ignition File from Workbench

The ignition file enables the virtual machine to read a configuration file, and to provision the Fedora CoreOS system based on the contents of that file. You will use this file when you configure the virtual machine in AWS.

1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
2. In the side menu, navigate to **Organization Settings > Assemblers**.
3. Find the assembler you created, leave the file format as **JSON**, and select **Download the CoreOS Ignition File**. This action will download a JSON file that you will need in the next step.

{% hint style="info" %}
You may choose a different file format if you like, but the JSON format is recommended for this type of assembler.
{% endhint %}

<figure><img src="/files/Eafkj0BJOEqa4x4PfyJF" alt="Select the JSON format in the right menu, and then select the download link."><figcaption></figcaption></figure>

4. Repeat this process for any additional assemblers.&#x20;

{% hint style="warning" %}
You must keep track of which files came from which assembler, because each assembler has its own unique ignition file.
{% endhint %}

## Step 2: Import and Configure the CoreOS Ignition File

Assembler ignition files are too large to be used in-line during AWS instance creation. Instead, we recommend placing the ignition file on S3 and [referencing a remote source](https://docs.fedoraproject.org/en-US/fedora-coreos/remote-ign/) for the ignition file, as described in these steps.&#x20;

{% hint style="info" %}
The ignition file and means of sharing it only need to exist upon first boot.
{% endhint %}

1. Create or choose an existing S3 bucket in AWS to host the ignition file. See [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/create-bucket-overview.html) for more information.
2. Click on your S3 bucket in the list, and drop or upload the CoreOS ignition file you got from Workbench into the bucket.
3. Click on the file name and select the **Object actions drop down > Share with a presigned URL**.
4. Generate a short-lived pre-signed URL in AWS and save it, as you will need it in the next step. See [Sharing objects with presigned URLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html) for more information.

{% hint style="warning" %}
**We recommend setting the pre-signed URL to expire after at least 10 minutes** in order to give yourself enough time to get through the AWS instance creation process, and for the instance to retrieve the ignition file from your bucket. Please ensure you have already completed all steps in our Add a New Assembler documentation and have [configured your firewall rules (security group)](/connect-your-technology/expel-assembler/add-a-new-assembler.md#step-2-update-your-firewall-configuration).
{% endhint %}

## Step 3: Configure and Spin Up the Virtual Machine

Now that you have a pre-signed URL, you can create and spin up your virtual machine in EC2.

1. First, you need to get an AMI ID.
   * Go to [Fedora CoreOS](https://fedoraproject.org/coreos/download?stream=stable).
   * Scroll to **Cloud Launchable > AWS**.
   * Select the **list** button.
   * Choose the **AMI ID** that corresponds to your deployment region and copy it to a safe place; you will need the ID later in this section.
2. Navigate to **EC2** in AWS.
3. Select **Launch Instance**.
4. Name your instance.
5. Search the Application and OS Images catalog for the **AMI ID** you chose, and then select the **Community AMIs** tab.
6. Select an instance type.

{% hint style="warning" %}
**Remember that your VM must have, at minimum, 2 virtual CPUs, 8 GB RAM, and 20 GB disk space.** You may choose any machine configuration you wish, as long as it meets these minimum requirements. An example of one you may select would be t2.large.
{% endhint %}

7. Under Key Pair, choose **Proceed without a key pair**. A key pair is not required for this configuration.
8. Under Network Settings, you should have already configured your firewall rules (security group) when you completed the [Add a New Assembler](/connect-your-technology/expel-assembler/add-a-new-assembler.md) documentation. Choose **Select existing security group** and select the group you created.
9. Under Configure Storage, ensure it is **20 GB**. Leave the Root Volume at the default value.
10. Expand the Advanced Details section and scroll down to **User data**. Paste the following JSON object in the field, being sure to include the **pre-signed URL** you generated in Step 2 as the source.

```
{
  "Ignition": {
    "config": {
      "replace": {
        "source": "YOUR_PRE-SIGNED-URL"
      }
    },
    "version": "3.3.0"
  }
}
```

11. Select **Launch Instance**.

## Step 4: Verify a “Connected” Status in Workbench

{% hint style="info" %}
It can take 10 to 15 minutes for the assembler’s status to update in Workbench.
{% endhint %}

1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
2. In the side menu, navigate to **Organization Settings > Assemblers** (or, refresh the page if you never logged out).
3. Find your newly created assembler(s) and verify that the status has changed from “Not Yet Connected” to “Connected.”&#x20;
   * If your assembler(s) still do not show as connected after waiting at least 15 minutes and refreshing the page, see the [Troubleshooting](#troubleshooting) section for help.

## Step 5: Delete Temporary Outbound Connections

In the Add a New Assembler documentation, you added [additional temporary outbound connections](/connect-your-technology/expel-assembler/add-a-new-assembler.md#aws-virtual-machines-only) as part of the firewall configuration. Now that your instance has booted and there is a connection to Workbench, these temporary IP addresses can be removed and all traffic will securely go through the Expel platform.&#x20;

{% hint style="warning" %}
Please ensure the two non-temporary outbound connections remain in place (34.149.216.90 and 34.107.163.233).
{% endhint %}

## Step 6: Connect Your Technology

You can now set up your vendor technology in Workbench.

<button type="button" class="button primary" data-action="search" data-icon="magnifying-glass">Search for your setup guide…</button>

## Troubleshooting

If your assembler is still not showing as “Connected” after 15 minutes:

1. Make sure you have the proper [firewall configurations](/connect-your-technology/expel-assembler/add-a-new-assembler.md#step-2-update-your-firewall-configuration) to allow our outbound ports as specified in [Add a New Assembler](/connect-your-technology/expel-assembler/add-a-new-assembler.md#step-2-update-your-firewall-configuration). If you did not have your security group (firewall) configured correctly when you launched the instance, you will have to restart the virtual machine.
2. Make sure your chosen machine’s size meets the required minimums (2 virtual CPUs, 8 GB RAM, and 20 GB disk space).

If all firewall and machine size settings are correct and you are still unable to connect the assembler, [contact Support](/support/how-to-reach-us.md) for help.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/connect-your-technology/expel-assembler/deploy-the-virtual-machine/deploy-the-assembler-in-aws.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.