Skip to content

Getting started

This page takes you from subscription to your first tofu plan. It takes about ten minutes, most of it waiting for the instance to boot.

1. Subscribe and launch

  1. Open the listing and subscribe.
  2. Launch the AMI on t3.medium or larger, with a gp3 root volume of at least 16 GiB. Turn on EBS encryption if your policies require it.
  3. Choose how you will connect:
    • Session Manager (recommended): attach an instance profile that allows AWS Systems Manager, such as one with AmazonSSMManagedInstanceCore. No inbound rule is needed.
    • SSH: select your EC2 key pair, and set the TCP 22 rule to your administrator CIDR. The listing's default security group allows 22 only from 127.0.0.1/32, which blocks SSH until you change it.

You do not need any other IAM permissions to get started. The example workspace does not call AWS.

2. Connect as ubuntu

With Session Manager, start a session from the EC2 console or the AWS CLI, then switch to the ubuntu user:

sudo -iu ubuntu

With SSH:

ssh -i <your-key.pem> ubuntu@<public-ip>

3. Wait for first boot

On first boot, the sushi-opentofu-firstboot service creates the workspace. Wait for cloud-init, then check that it finished:

sudo cloud-init status --wait
systemctl is-active sushi-opentofu-firstboot.service

The second command prints active when first boot is complete.

First boot creates:

Path Purpose
/var/lib/opentofu/workspace/ Your workspace, owned by ubuntu
versions.tf, main.tf, .terraform.lock.hcl Local-only example and provider lock, in the workspace
s3-backend.example.hcl, iam-s3-backend.json.example S3 state examples, in the workspace
/etc/opentofu/backend.env Commented credentials template. root:root, mode 0600.

4. Run the walkthrough

Run the bundled demo before you change the example workspace:

bash /opt/sushi/docs/demo.sh

It checks first boot, prints the OpenTofu version, runs init, validate and plan on the example, checks that the plan contains only a synthetic output, applies that plan locally and confirms a second plan has no changes. It then runs the image self-test and finishes with SUSHI_CUSTOMER_DEMO_PASSED. The example declares no AWS resources, so nothing is created in your account.

5. Run your own plan

Use -chdir to point tofu at the workspace:

tofu -chdir=/var/lib/opentofu/workspace init -input=false
tofu -chdir=/var/lib/opentofu/workspace validate
tofu -chdir=/var/lib/opentofu/workspace plan

init installs the AWS provider from the local mirror, not from the internet. The example plan shows a single output, pilot_invoice.

Next steps