Skip to main content
Every Lowkey deployment is defined by four choices: which agent runtime to run (pack), how much AWS access it gets (profile), how much you want to configure manually (install mode), and which infrastructure tool creates the resources (deploy method). Understanding how these fit together makes it easy to pick the right options and predict what the installer will do.

​
Pack

A pack is a self-contained agent runtime. When you deploy Lowkey, you deploy exactly one pack onto an EC2 instance. Every pack installs a specific AI coding agent, wires it to a model provider, and configures the right system settings. All packs implement the same installer contract, so the top-level installer treats them uniformly — it presents your options and handles the full deploy regardless of which agent you pick.

​
Available packs

The installer also installs bedrockify as a dependency for most packs. Bedrockify is an OpenAI-compatible proxy for Amazon Bedrock that runs as a systemd daemon on port 8090. Packs that connect directly to their provider’s API (Codex CLI, Kiro CLI) skip it.

​
Profile

A profile controls the IAM permissions attached to the agent’s EC2 instance profile. Choosing the right profile is the most important security decision you make during setup. All profiles also get AmazonSSMManagedInstanceCore so you can connect via SSM Session Manager.
The builder profile grants AdministratorAccess to your entire AWS account. Use a dedicated sandbox account. See Risks before deploying.
Profiles also drive which security services turn on in simple mode:

​
Install mode

Install mode controls how much the installer asks you to configure.

Simple (recommended)

You pick pack and profile. The installer auto-configures everything else: instance size, region, VPC, security services, environment name, and model defaults. One screen of prompts and you’re deploying.

Advanced

The installer prompts for every parameter: region, instance type, VPC reuse, individual security services, environment naming, and more. Use this when you need tight control or want to deploy into an existing VPC.
When you pass -y on the command line, the installer defaults to simple mode. You can override with --simple or --advanced. See Simple-mode defaults for the full table of what gets auto-configured.

​
Deploy method

Lowkey ships two IaC flavors and keeps them in sync. Both call the same bootstrap.sh from UserData, so the agent you get is identical either way. Pick based on what the rest of your stack uses.
The installer runs aws cloudformation create-stack with the template from the repo. It waits for CREATE_COMPLETE and streams stack events as they arrive. No extra tooling needed — just the AWS CLI.To select it explicitly:
The installer uses the Terraform module under deploy/terraform/. If Terraform 1.10+ isn’t installed, the installer offers to download it to /tmp (no root required) and offers to configure an S3 backend with a DynamoDB lock table for remote state.To select it explicitly:
Terraform is a good choice if you already use it to manage your AWS account and want Lowkey’s resources to live in the same state.

​
How they combine

These four choices compose in a predictable chain:
In simple mode, fixing pack and profile determines everything below. In advanced mode, you override the defaults at each step. When you run a non-interactive command like:
You’re fixing the top two layers. The installer computes the rest from simple-mode defaults.

​
State and where things live

Once deployed, here’s where everything lives: Every resource Lowkey creates is tagged loki:managed=true and loki:watermark=<env-name>. This makes it easy to find and clean up everything:
Tearing down the CloudFormation stack (or running terraform destroy) removes everything the installer created. Your agent’s memory and any resources it built inside your account are separate — the uninstaller at curl -sfL uninstall.lowkey.run | bash handles those.