> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/expel-assembler/deploy-the-virtual-machine/deploy-the-assembler-in-aws-terraform.md).
# Deploy the Assembler in AWS (Terraform)
Each assembler you created must be deployed via a virtual machine, and then you can add your technology as a security device in Workbench to complete the full integration. For more information about the Expel Assembler or how it works, see the [About the Expel Assembler](/connect-your-technology/expel-assembler/about-the-expel-assembler.md) guide.
{% hint style="info" %}
Terraform lets you define both cloud and on-prem resources in human-readable configuration files that you can version, reuse, and share. These instructions assume you have working knowledge of Terraform; if you need additional help or context, refer to the [Terraform Documentation](https://developer.hashicorp.com/terraform).
{% endhint %}
## Prerequisites
* You must have completed all of the steps in [Add a New Assembler](/connect-your-technology/expel-assembler/add-a-new-assembler.md) for each assembler you wish to deploy.
* You must have [Terraform installed](https://developer.hashicorp.com/terraform/tutorials/gcp-get-started/install-cli?in=terraform%2Fgcp-get-started).
## Step 1: Download the Ignition File
The ignition file enables the virtual machine to read a configuration file, and to provision the Fedora CoreOS system based on the contents of that file. You will use this file when you configure the virtual machine in GCP.
1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
2. In the side menu, navigate to **Organization Settings > Assemblers**.
3. Find the assembler you created, leave the file format as JSON, and select **Download the CoreOS Ignition File**. This action will download a JSON file that you will need in the next section.
{% hint style="info" %}
You may choose a different file format if you like, but the JSON format is recommended for this type of assembler.
{% endhint %}
4. Move your ignition file to a remote, secure location such as [Google's Cloud Storage](https://cloud.google.com/storage?hl=en). The contents of the ignition file will be stored in plaintext (unencrypted) wherever your Terraform state files are located.
{% hint style="danger" %}
1. **Do not store your ignition file in a git repository.** The file contains sensitive information and git is not a suitable place for this type of data.
2. **Be sure to lock down access to the storage location.** Only people who need access to the ignition file (and to the Terraform state files if using [Terraform Remote State](https://developer.hashicorp.com/terraform/language/state/remote)) should have access to the storage location.
{% endhint %}
5) Repeat this process for any additional assemblers.
{% hint style="warning" %}
You must keep track of which files came from which assembler, because each assembler has its own unique ignition file.
{% endhint %}
## Step 2: Set Up the Terraform Config File for AWS
Terraform will use the [AWS provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs) (use this link if you need help with authentication) to configure your infrastructure. You will need to create a [Terraform config file](#user-content-fn-1)[^1] if you do not have one, and make sure the file has the following configuration.
* The `aws` provider block is used to configure your AWS authentication credentials.
* The `region` is your AWS region.
* Optional: You may add an `access_key` and `secret_key` if needed for authentication
```
provider "aws" {
region = "us-east-1"
}
```
## Step 3: Set the User Data for the VM
Use the [template\_file](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) data source and set the source attribute to the URL where you stored your ignition file. For example, this could be a [pre-signed S3 object link](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html) if the ignition file is stored in S3.
{% hint style="info" %}
If you are deploying more than one assembler, this step will need to be repeated for each assembler.
{% endhint %}
```
data "template_file" "user_data" {
template = jsonencode({
ignition = {
config = {
replace = {
source = ""
}
},
version = "3.4.0"
}
})
}
```
## Step 4: Configure and Spin Up the Virtual Machine
Use the [aws\_instance](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance) resource to configure your virtual machine with the minimum requirements.
{% hint style="info" %}
If you are deploying more than one assembler, this step will need to be repeated for each assembler.
{% endhint %}
1. Go to the [Fedora CoreOS downloads page](https://fedoraproject.org/coreos/download?stream=stable) and scroll to the **Cloud Launchable** section, and click the button for AWS.
2. On the screen that displays, copy the **Amazon Machine Image (AMI) ID** for the region you would like to deploy to, and use it in the code below.
* `ami` is the AMI ID you just copied.
* `machine_type` is “t2.medium”, which has the minimum CPU and RAM requirements for an assembler.
* `volume_size` is "20", which indicates the 20GB minimum disk size required for an assembler.
```
resource "aws_instance" "assembler" {
instance_type = "t2.medium"
ami = "ami-12345" #Get this from Fedora CoreOS Downloads page
user_data = data.template_file.user_data.rendered
root_block_device {
volume_size = 20
}
}
```
## Step 5: Verify a “Connected” Status in Workbench
{% hint style="info" %}
It can take 10 to 15 minutes for the assembler’s status to update in Workbench.
{% endhint %}
1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
2. In the side menu, navigate to **Organization Settings > Assemblers** (or, refresh the page if you never logged out).
3. Find your newly created assembler(s) and verify that the status has changed from “Not Yet Connected” to “Connected.”
* If your assembler(s) still do not show as connected after waiting at least 15 minutes and refreshing the page, see the [Troubleshooting](#troubleshooting) section for help.
## Step 6: Connect Your Technology
You can now set up your vendor technology in Workbench.
## Troubleshooting
If your assembler is still not showing as “Connected” after 15 minutes:
* Make sure your chosen connection has the proper [firewall configurations](/connect-your-technology/expel-assembler/add-a-new-assembler.md#step-2-update-your-firewall-configuration) to allow our outbound ports.
* Make sure your config file includes the correct region ([Step 2](#step-2-set-up-the-terraform-config-file-for-aws)).
* Make sure your ignition file is at the path specified, and that you are referencing the correct ignition file for your assembler ([Step 3](#step-3-set-the-user-data-for-the-vm)).
* Make sure your chosen machine’s size meets the required minimums (2 virtual CPUs, 8 GB RAM, and 20 GB disk space).
If all firewall, config file, and resource definitions settings are correct and you are still unable to connect the assembler, [contact Support](/support/how-to-reach-us.md) for help.
## Reference
### Full Code Examples
terraform.tf (config file)
```
provider "aws" {
region = "us-east-1"
}
```
assembler.tf (resource definitions)
```
data "template_file" "user_data" {
template = jsonencode({
ignition = {
config = {
replace = {
source = ""
}
},
version = "3.4.0"
}
})
}
resource "aws_instance" "assembler" {
instance_type = "t2.medium"
ami = "ami-12345" #Get this from Fedora CoreOS Downloads page
user_data = data.template_file.user_data.rendered
root_block_device {
volume_size = 20
}
}
```
[^1]: A file name might be terraform.tf.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.expel.io/connect-your-technology/expel-assembler/deploy-the-virtual-machine/deploy-the-assembler-in-aws-terraform.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.