Skip to content
Goose CLI Agent AI Agents · Goose v1.54.0 Launch on AWS

Getting started

This page takes you from the AWS Marketplace listing to your first Goose task: subscribe, launch, connect, check the installation and run Goose with your own model provider. It takes about ten minutes.

You need: an AWS account with permission to subscribe to AWS Marketplace products and launch EC2 instances, and an API key for a model provider that Goose supports.

1. Subscribe

Open the Goose CLI Agent listing, review the pricing and terms, and subscribe.

2. Launch the instance

Launch from the listing with these settings:

  • Instance type: t3.medium.
  • Storage: at least 16 GiB, encrypted gp3.
  • Metadata: IMDSv2.
  • Security group: no inbound rules are needed. Allow outbound HTTPS.
  • IAM instance profile: attach a role with the AWS managed policy AmazonSSMManagedInstanceCore so you can connect with Session Manager. Goose itself needs no AWS permissions.

3. Connect

Connect with Session Manager, from the EC2 console (Connect > Session Manager) or with the AWS CLI:

aws ssm start-session --target <instance-id>

Wait for first boot to finish:

cloud-init status --wait

4. Run the walkthrough

sudo -iu ubuntu bash /opt/sushi/docs/demo.sh

The walkthrough checks that first boot completed, prints the Goose version, confirms the ubuntu user cannot read /etc/goose/secrets, and then has Goose finish a real task: it starts a test model on 127.0.0.1, and Goose uses its write tool to create a file. Then it runs the self-test. No paid model is called, and your own Goose configuration is not used or changed.

Each step prints STEP, COMMAND and RESULT lines, and the script ends with SUSHI_CUSTOMER_DEMO_PASSED.

5. Configure your provider

Switch to the ubuntu user:

sudo -iu ubuntu

On this server image, tell Goose to keep keys in its own secrets file instead of a desktop keyring, then run the interactive setup:

export GOOSE_DISABLE_KEYRING=1
goose configure

Choose your provider, paste your key when asked and pick a model. With GOOSE_DISABLE_KEYRING=1, Goose stores the key in ~/.config/goose/secrets.yaml. Add the export line to ~/.bashrc so later sessions find it.

Keep your key out of logs

Do not put provider keys in EC2 user data, config.yaml, shared shell history, tickets or screen recordings.

6. Run your first task

Go to the sample workspace and give Goose a task:

cd /var/lib/goose/workspace
goose run --text "<your task>" --with-builtin developer

For example, ask it to add a docstring to hello.py and run the file. Goose prints each step and tool call as it works.

For an interactive conversation instead of a single task:

goose session --with-builtin developer

Next steps

Set defaults, use your own repositories and choose how much Goose may do on its own in Configuration.

Last updated October 13, 2026 · Suggest an improvement