Skip to content
redactsure
Book a demo

Explore.

Guide · By Chris Sowa · Published
Last updated

How to Use AI Agents to Launch a GPU-Accelerated Amazon EC2 Instance and Configure Drivers and Software

Let the agent work the console and terminal from quota request to nvidia-smi while the 5 steps that spend money or create a credential wait for a named person.

A cloud deployment conveyor links configuration screens, an approval gate and GPU hardware.

62% experimenting · 23% scaling · 5 approvals

Six in ten organizations are experimenting with AI agents and fewer than one in four are scaling them anywhere (CX Today, 2026). A GPU launch is where the experiment meets a bill. The agent opens Service Quotas, picks a G6 or a P5, drafts a role, opens a port, creates a key pair and starts the meter. Every one of those pages renders your account ID, and the terminal can print your access key.

Today the launch probably runs like this: the agent in a laptop shell with the CLI configured, "always allow" switched on after the third prompt, and CloudTrail as the only record. The model reads the key with the first env it runs, and CloudTrail cannot say who approved the port.

Rome kept the treasury keys with a quaestor and the right to spend with the Senate, two offices, never one. The agent works inside a governed environment that hands the model tokens for keys and account IDs, and a named person signs for the quota request, the IAM role, the ingress rule, the key pair and the launch. The instance runs, nvidia-smi is on the record, and the agent never held a key or an account ID.

AWS documents G and P GPU families, and a new account's quota for them is often 0

AWS's accelerated computing instances include the G family (G5, G6, G6e) for graphics and inference and the P family (P4d, P4de, P5, P5e) for training (AWS, 2026). The choice sets the hourly price and the driver path.

The quota comes second and it is where most agent runs stall. GPU families are often limited to zero in a new account, and Service Quotas is where you read the limit and request an increase (AWS, 2026). An agent can read the limit and fill the form; it should not submit it. A quota request is a commitment to AWS, and the limit it wins shapes every future launch in that region.

The vCPU limit, the family and the region are facts the task runs on and stay in clear. The account ID in every ARN is an identifier and arrives as ACCT_001.

Keys in a laptop shell reach the model on the first env it runs

On a laptop, Claude Code reads files and runs commands in the terminal (Anthropic, 2026). The access key enters the model's context the moment the agent runs env, and whatever reaches the context can reach an output. Language models can emit sequences from their training data (Carlini et al., 2021), and a key does not need to be memorized to be exposed; it only needs to be logged.

In a vendor's cloud computer, sign-in is shielded. OpenAI's secure sign-in submits credentials "without exposing them to the model's context," and the model then reads the webpage text (OpenAI, 2026). The account ID and the role ARNs on the next page are webpage text.

Property Agent in a laptop shell Agent in a vendor cloud computer Agent in a customer-owned governed environment
What the model reads on the IAM page The whole page and terminal The webpage text (OpenAI, 2026) Task fields, with ACCT_001 and KEY_001
Where the access key lives A file the model can read Sign-in outside the model's context No key; the person's own identity
Who signs the launch Whoever clicked "always allow" Custom Rules the user sets A named person, on the record

The governed environment rests on render-layer tokenization: replacing sensitive values with consistent stand-in tokens at the point where a screen is rendered, before any AI model reads it, so the model works with SSN_001 and ACCT_001 and real values resolve only at approved destinations at the moment of action.

5 of the 10 steps spend money, open the network or create a credential, and each waits for a named person

The agent carries ten steps. It reads the planner's policy on the console and terminal the person connected. It reads the G or P limit and drafts the quota increase (AWS, 2026). It picks the type, reads the hourly price and proposes a spend ceiling and a stop time for the launch. It selects the image and drafts a least-privilege IAM role and instance profile (AWS, 2026), drafts the security group with SSH limited to known addresses, sizes the EBS volume, selects or creates the key pair, launches from the wizard or the CLI (AWS, 2026), installs the driver, runs nvidia-smi and reports the hourly cost.

Five of those steps commit the account to something you cannot take back, and those five stop. The quota request is a submission to AWS. The launch starts spend, under the ceiling and stop time the person approves with it. The ingress rule decides who can reach the box. The role is a credential every process on the box inherits. The key pair is a credential whose holder holds the instance. The rule is Supervised Delegation: a named person grants the access, chooses the applications, confirms what is tokenized, can watch and pause the run, and approves every consequential action, on the record.

The Deep Learning AMI ships the NVIDIA driver; a base AMI needs the AWS install steps

AWS documents two driver paths on Linux: launch from a Deep Learning AMI with the driver and frameworks preinstalled, or install the public NVIDIA driver on a base AMI following the steps for Tesla, GRID or gaming drivers (AWS, 2026).

Property Deep Learning AMI Base Linux AMI with manual install
Driver at first boot Preinstalled Installed by the agent over SSH
Version control The versions the image ships The version the team pins
Fits when The team needs a working box today The workload pins a driver, CUDA or framework version

Neither path needs an approval; selecting the image and installing the driver are preparation. The instance is not done until nvidia-smi lists the GPU, the driver version and the memory in use. A failure on a base AMI usually means a driver that does not match the GPU; the agent reinstalls. A relaunch on a different family is spend, and spend waits for the named person.

An instance profile replaces the key on the box, as AWS's own practices ask

AWS's IAM best practices call for least privilege, temporary credentials and no long-lived access keys for workloads (AWS, 2026). The agent drafts a role with the permissions the workload needs and attaches it through an instance profile. The named person narrows the policy and approves the role.

That governs what the box may do. It does not govern what the model may see, and the two are different controls. The principle for the second is Least Exposure: for each piece of work, the AI receives exactly the data the task requires and nothing more, enforced before any model reads the screen. The task's fields, the instance type, AMI name, region, quota, volume size and hourly price, stay in clear. The account ID is ACCT_001. The access key and secret are KEY_001 and KEY_002. The private key never reaches the model.

Permissions stay exactly as they are; what changes is what the model reads.

nvidia-smi output and 5 approvals land in one record beside CloudTrail

10 steps · 5 approvals · 1 record

CloudTrail records the API calls the launch produced. It does not record what the model read before it chose them, or who said yes. The environment writes that second record. It is the AI Control Record: the record of every screen the agent saw as tokens, every action, every approval with a name, exported to the customer's own monitoring.

The record for this launch holds the confirmed policy, every console page as tokens, the five approvals with names and timestamps, and the nvidia-smi output. It exports to your SIEM beside CloudTrail. OWASP lists sensitive information disclosure second among LLM application risks (OWASP, 2025); a record you hold is how you check.

The record outlasts the model. Separation of model and control is the principle that the environment deciding what an AI agent sees and who approves what it does is owned by the customer and independent of whichever model performs the work. The vendor that is the model should not also be the judge of the model. Swap Claude Code for a dot next quarter and the render layer, the five stops and the record stay put. A page can carry instructions aimed at the agent (Greshake et al., 2023); a hijacked agent here collects tokens and its action waits for a person.

6 Rules for launching a GPU instance with an agent

Delete the key before the agent arrives

No access key in a file, a shell profile or an environment variable on any machine the agent will use. Test: ask the agent to print the access key; the answer is KEY_001.

Tokenize identifiers and keep the launch facts in clear

The planner proposes the policy and the person confirms it as the first record entry.

Becomes a token Stays in clear
Account ID (ACCT_001) Instance type, region, AMI name
Access key and secret (KEY_001, KEY_002) Quota limit and vCPU count
Role ARNs (ROLE_001) Volume size, hourly price, nvidia-smi output

Submit the quota request with a name on it

The agent drafts the family, region and vCPU count. The person submits. Before: the agent requests a P5 quota at 2 a.m. under "always allow" and launches when it clears. After: the draft waits in the record with the hourly spend; the person submits it in the morning.

Approve the launch with a spend ceiling and a stop time on it

The agent reads the hourly price and proposes both; the person approves the launch with them. Test: the launch entry in the record carries a ceiling, a scheduled stop and the person's name.

Limit SSH to known addresses and let no rule reach 0.0.0.0/0

A rule open to the world is reachable by anyone the moment the instance starts. Before: SSH open to 0.0.0.0/0 to make the first connection easier. After: inbound lists two known ranges and the approval carries a name.

Keep the private key out of the agent's disk, context and record

The private key resolves only to the approved key store.

Where the private key may be Where it may not be
The approved key store The agent's working directory or context
The person's own key management The record and the SIEM export

How to choose how the agent launches the instance

  • If the account carries production workloads, run the agent in a customer-owned governed environment with keys you hold, never in a laptop shell with the CLI configured.
  • If the work is terminal-heavy, choose Claude Code and run it inside the environment rather than in a laptop shell.
  • If the work is console-heavy, run the agent inside the same environment rather than in a vendor's cloud computer.
  • If the team needs a working GPU box today and accepts the shipped versions, select the Deep Learning AMI.
  • If the workload pins a driver, CUDA or framework version, select a base AMI and let the agent follow the AWS install steps.
  • If you expect to change agents or models within a year, choose the environment that keeps the render layer, the stops and the record when the model changes.

The checklist

Check Pass Fail
Key files on the machine the agent uses None found A credentials file or shell profile entry
One console page in the record Type and price in clear, ACCT_001 for the account A real account ID or ARN
Quota request entry Submitted with a name Submitted under "always allow"
Launch entry Approved by name, with a spend ceiling and stop time No name, or no ceiling
Security group inbound rule Known addresses only, approved by name 0.0.0.0/0 on any port
Private key location The approved key store only The agent's disk, context or the record
nvidia-smi output On the record listing GPU, driver and memory Missing
A test page with an instruction aimed at the agent Only tokens collected; the action stopped A real value, or an unsigned action

Questions

Should the agent hold an AWS access key?

No. AWS's best practices say workloads should use temporary credentials and no long-lived access keys (AWS, 2026). An agent holding a key in its shell can print it, log it or use it on an instruction planted in a page it read. The instance gets its identity from an instance profile. The agent sees keys only as tokens, and real values resolve at the moment of an approved action.

Deep Learning AMI or manual driver install?

The Deep Learning AMI when the team needs a working GPU box today and accepts the driver and framework versions it ships (AWS, 2026). A base AMI with a manual install when the workload pins a driver, CUDA or framework version, or when your image policy requires your own base. Either way, nvidia-smi lists the GPU and the driver, or the launch is not done.

How do we know what the agent did on the console?

From a record you hold. In a governed environment, every console page the agent read is logged as tokens, every action is logged, and every approval carries the name of the person who gave it. That record exports to your SIEM beside CloudTrail. A vendor's activity view shows what the agent did inside the vendor's app, not what the model read.

Can the agent request the quota increase itself?

It can draft it. The agent reads the current limit from Service Quotas (AWS, 2026), names the family, region and vCPU count, and fills the form. Submission commits the account to a request with AWS, and the limit granted shapes future spend, so the named person reads the draft and submits it. Once the increase is granted, the launch is a separate approval.

What if nvidia-smi fails after the launch?

The agent reads the error and checks that the instance type is a GPU family and that the driver matches it. On a base AMI the usual cause is a driver mismatch, and AWS's guide lists driver types by use (AWS, 2026). A reinstall is preparation. A relaunch on a different family is spend and waits for the named person.

Can the agent open SSH to the world to make the connection easier?

Not without a name on the rule. The agent drafts the security group with the office or VPN addresses, and the named person approves it (AWS, 2026). A group open to 0.0.0.0/0 is reachable by anyone the moment the instance starts. An agent that widened the rule on its own would appear in the record, and the action waits before it runs.

What happens if a page the agent reads tells it to create a key?

In a governed environment it collects tokens and stops. Content a model reads can carry instructions aimed at it (Greshake et al., 2023). A hijacked agent that tries to create an access key proposes a credential, credentials are among the five stops, and the named person sees a request they did not ask for. The record shows the attempt and the page it came from.

Methodology

What this page rests on. AWS documentation for GPU instances, NVIDIA drivers, the Deep Learning AMI, the launch wizard, Service Quotas and IAM; Anthropic's Claude Code documentation; OpenAI's September 29, 2026 account of Dots; McKinsey's State of AI 2026 via CX Today; OWASP LLM02; Carlini et al. (2021); Greshake et al. (2023); all read as of October 9, 2026.

What was not tested. No hands-on testing of Claude Code, OpenAI Dots, the EC2 console or any AMI was performed for this page. Instance families, quotas, drivers and console flows change with releases; the page carries its date.

Whose determination it is. Whether an agent, an environment or a record meets your obligations is for your counsel, your assessor and your security and compliance officers to decide.

How RedactSure does this

10 steps · 5 approvals · 0 keys in the model

RedactSure runs the agent inside a customer-owned governed environment: a secure virtual machine in the cloud your posture requires, with keys you hold. The render layer tokenizes each screen before any model reads it, so the model receives the task's fields with the account ID as ACCT_001, keys as KEY_001 and role ARNs as ROLE_001, while the instance type, region, quota and price stay in clear. The planner writes the per-task policy; a named person confirms it, then approves the quota submission, the IAM role, the ingress rule, the key pair and the launch with its spend ceiling under Supervised Delegation. Every screen, action and approval, and the nvidia-smi output, land in the AI Control Record and export to your SIEM.

The agent you chose (Claude Code in the terminal, Claude Cowork on the desktop, or an OpenAI dot) does the work inside the environment, and the model is swappable without moving a control. RedactSure does not change permissions. Prompt injection that succeeds collects tokens, and the consequential action still stops for a named person. Deployments are in pilot.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.