# Deploy in your AWS account



Install the runtime, qualify a tool, and start an API for your users.

 

## Before you start



Use a checkout of the Security.Run repository with its Python dependencies and native tool packs installed. You need AWS credentials for your account, a supported region, and a subnet for the VPC connector. Run these commands as the deployment operator.

 

## 1. Create the AWS resources



Run the installer with your profile, account and subnet. It writes a private configuration file and creates the artifact bucket, registry, build role and connector. Keep the generated file for later commands.

 

## 2. Build and qualify a tool



Start with YARA. Publish its image, then run qualification once the image build has completed. A successful receipt for the exact image is required before users can run it. To expand the catalog, repeat the process or use `qualify_aws_catalog.py`.

 

## 3. Configure users and storage



Create a private JSON token file mapping owner names to distinct tokens of at least 24 characters. Choose a data directory you control. Set the three environment variables shown in the example, then start the API on loopback.

 

## 4. Verify before sharing access



Call `GET /v1/tools` with a configured token and run the [quickstart](https://www.security.run/docs/quickstart.html). Put your authenticated HTTPS entrypoint in front of the API before exposing it to users. Configure permitted target routes, DNS, backups and retention for your environment.

 

This preview uses owner tokens. Enterprise identity and organization retention policies require additional integration.

## Create the AWS resources

```bash
.venv/bin/python scripts/deploy_microvm_infra.py \
  --profile CUSTOMER_PROFILE --account CUSTOMER_ACCOUNT --region us-east-1 \
  --subnet CUSTOMER_SUBNET --prefix customer-security-tools \
  --output .local/customer-microvms.json
```

## Build and qualify YARA

```bash
.venv/bin/python scripts/build_aws_microvm_pack.py yara \
  --config .local/customer-microvms.json
.venv/bin/python scripts/qualify_aws_microvm.py yara \
  --config .local/customer-microvms.json --output .local/yara-qualification.json
```

## Start the API

```bash
export SECURITY_RUN_AWS_MICROVM_CONFIG=/private/customer-microvms.json
export SECURITY_RUN_DATA=/private/security-run
export SECURITY_RUN_TOKENS_FILE=/private/owner-tokens.json
.venv/bin/uvicorn security_run.atomic_app:create_atomic_app \
  --factory --host 127.0.0.1 --port 8000
```