feat(embed): terraform module for aws

GitOrigin-RevId: 67dcaf34ed0c4f487046377f678850aaecb78534

Author: svalleru

embed/.gitignore

@@ -10,7 +10,7 @@ compose/env/*.local.env
 # tracked on purpose.
 !/compose/.env
 
-# `make lint` runs `terraform init` in the module and in the example, through a
+# `make lint` runs `terraform init` in each module and each example, through a
 # shared plugin cache; a module needs no lock file, so none of that is tracked.
 .terraform/
 .terraform-cache/

embed/Makefile

@@ -2,7 +2,7 @@ SHELL := /bin/bash
 .PHONY: lint config test images stores-check vector-validate otel-validate sync-configs kubernetes-render terraform-validate
 
 # Every compose invocation runs against compose/, where compose.yaml and .env
-# live; the other two install shapes have their own directories beside it.
+# live; the other three install shapes have their own directories beside it.
 COMPOSE := docker compose --project-directory compose
 
 SHELL_FILES := $(strip $(wildcard compose/scripts/*.sh))
@@ -21,16 +21,24 @@ lint: config vector-validate otel-validate kubernetes-render terraform-validate
 kubernetes-render:
 	kubectl kustomize kubernetes >/dev/null
 
-# Both roots share one plugin cache, so the providers are downloaded once. The
-# example is validated too: a renamed input or output is exactly how a
-# copy-paste example goes stale.
+# All four roots share one plugin cache, so each provider is downloaded once.
+# Terraform reads that cache only for providers a lock file already lists
+# unless told otherwise, and none of these roots tracks a lock file
+# (.gitignore), so there is none to keep. The examples are validated too: a
+# renamed input or output is exactly how a copy-paste example goes stale.
+TF_CACHE := TF_PLUGIN_CACHE_DIR=$(CURDIR)/.terraform-cache TF_PLUGIN_CACHE_MAY_BREAK_DEPENDENCY_LOCK_FILE=true
 terraform-validate:
 	mkdir -p .terraform-cache
-	TF_PLUGIN_CACHE_DIR=$(CURDIR)/.terraform-cache terraform -chdir=terraform/gcp init -backend=false -input=false >/dev/null
+	$(TF_CACHE) terraform -chdir=terraform/gcp init -backend=false -input=false >/dev/null
 	terraform -chdir=terraform/gcp fmt -check -recursive
 	terraform -chdir=terraform/gcp validate
-	TF_PLUGIN_CACHE_DIR=$(CURDIR)/.terraform-cache terraform -chdir=terraform/gcp/examples/basic init -backend=false -input=false >/dev/null
+	$(TF_CACHE) terraform -chdir=terraform/gcp/examples/basic init -backend=false -input=false >/dev/null
 	terraform -chdir=terraform/gcp/examples/basic validate
+	$(TF_CACHE) terraform -chdir=terraform/aws init -backend=false -input=false >/dev/null
+	terraform -chdir=terraform/aws fmt -check -recursive
+	terraform -chdir=terraform/aws validate
+	$(TF_CACHE) terraform -chdir=terraform/aws/examples/basic init -backend=false -input=false >/dev/null
+	terraform -chdir=terraform/aws/examples/basic validate
 
 # Vector parses the config and compiles its VRL without connecting to sinks.
 # Catches a broken remap or a misspelled sink option before a host does.

embed/README.md

@@ -5,11 +5,12 @@
 
 # E2B Embed
 
-**A complete E2B, sandboxes included, on one machine you own.** Three ways to
+**A complete E2B, sandboxes included, on one machine you own.** Four ways to
 get that machine running, all of them the same stack.
 
 [Docker Compose](compose/README.md)
 | [Terraform on GCP](terraform/gcp/README.md)
+| [Terraform on AWS](terraform/aws/README.md)
 | [Kubernetes](kubernetes/README.md)
 | [Reference](docs/REFERENCE.md)
 | [Releasing](../docs/RELEASING.md)
@@ -22,12 +23,13 @@ get that machine running, all of them the same stack.
 |-------|---------------|-------------|-------|
 | Docker Compose | a Linux host with KVM that you may mutate | `docker compose up -d --wait` | [`compose/README.md`](compose/README.md) |
 | Terraform on GCP | a GCP project and credentials | `terraform apply` | [`terraform/gcp/README.md`](terraform/gcp/README.md) |
+| Terraform on AWS | an AWS account and credentials | `terraform apply` | [`terraform/aws/README.md`](terraform/aws/README.md) |
 | Kubernetes | a cluster with one KVM node | `kubectl apply -k` | [`kubernetes/README.md`](kubernetes/README.md) |
 
 Compose and Terraform run [`compose/compose.yaml`](compose/compose.yaml) and
 [`compose/.env`](compose/.env) as shipped. Kubernetes runs a StatefulSet
 translated from them, with the same pins in
-[`kubernetes/kustomization.yaml`](kubernetes/kustomization.yaml). All 3 are
+[`kubernetes/kustomization.yaml`](kubernetes/kustomization.yaml). All 4 are
 single-machine evaluation packages, not deployment patterns. For a production
 deployment see [e2b.dev/enterprise](https://e2b.dev/enterprise).
 
@@ -117,8 +119,8 @@ collector and the pprof endpoints stay on loopback;
 
 - `make images` builds the 3 stack images locally under their pinned tags.
 - `make lint` renders the compose file and the kustomization, validates the
-  Vector config and the Terraform module, and shellchecks the scripts and the
-  tests.
+  Vector config and the 2 Terraform modules, and shellchecks the scripts and
+  the tests.
 - `make test` runs the bats suite in `tests/`.
 - `make stores-check` runs the store-level integration check.
 - `make sync-configs` re-inlines the 3 configs into the compose file.

embed/compose/README.md

@@ -11,8 +11,10 @@ the hub is [`../README.md`](../README.md).
 - Linux x86-64 or arm64 with KVM and a 4 KiB-page kernel (Ubuntu's default
   on both), on a host you own and may mutate: bare metal, or a VM created with
   nested virtualization enabled (on GCE, `--enable-nested-virtualization`; on
-  Apple silicon, a Lima or other Virtualization.framework VM with nested
-  virtualization on, which needs an M3 or newer and macOS 15 or newer). x86-64
+  EC2, `--cpu-options NestedVirtualization=enabled` on an Intel type that
+  offers it, such as `m8i`; on Apple silicon, a Lima or other
+  Virtualization.framework VM with nested virtualization on, which needs an
+  M3 or newer and macOS 15 or newer). x86-64
   is what the guides were written and tested on. arm64 is verified end to
   end on bare metal: on 2026-09-14 a bare-metal arm64 host (a GCE `c4a` metal
   instance, Ubuntu 26.04, kernel 7.0) reached `ready` in under two minutes
@@ -37,7 +39,9 @@ the hub is [`../README.md`](../README.md).
 - `/dev/kvm` and `/dev/net/tun` present. On a VM, `/dev/kvm` means nested
   virtualization is enabled for it; on GCE, stop the VM, run
   `gcloud compute instances update <vm> --enable-nested-virtualization`, and
-  start it again. Without either device, `up` stops at `preflight` with a
+  start it again; on EC2, stop the instance, run
+  `aws ec2 modify-instance-cpu-options --instance-id <id> --nested-virtualization enabled`,
+  and start it again. Without either device, `up` stops at `preflight` with a
   `FIX:` line and nothing that needs KVM is started.
 - Docker Engine 27 or newer with Compose 2.24 or newer, and your user in the
   `docker` group. Docker's own apt repository is the simplest way to get

embed/docs/REFERENCE.md

@@ -3,7 +3,7 @@
 The [hub README](../README.md) says what E2B Embed is and how to pick a
 shape. This page holds the rest: what runs where, logs and telemetry, the
 secrets, how images and pins are released, building templates, and the
-developer tooling. The 3 guides cover what differs per shape.
+developer tooling. The 4 guides cover what differs per shape.
 
 ## What runs where
 
@@ -149,8 +149,8 @@ commented patch line in the kustomization; the
 [Kubernetes guide](../kubernetes/README.md#telemetry) has both, and where the
 collector sits in the pod. Terraform has the `otel_collector_grpc_endpoint` and
 `otel_collector` variables, which the startup script writes into the
-instance's `.env`; the [Terraform guide](../terraform/gcp/README.md#variables)
-lists them.
+instance's `.env`; the [GCP](../terraform/gcp/README.md#variables) and
+[AWS](../terraform/aws/README.md#variables) guides list them.
 
 ## Secrets
 
@@ -281,18 +281,20 @@ without a tunnel.
 | Target | What it does |
 |--------|--------------|
 | `make images` | build the 3 stack images locally under their pinned tags |
-| `make lint` | render the compose file and the kustomization, validate the Vector config and the Terraform module, shellcheck the scripts and the tests |
+| `make lint` | render the compose file and the kustomization, validate the Vector config and the 2 Terraform modules, shellcheck the scripts and the tests |
 | `make test` | run the bats suite in `tests/` |
 | `make stores-check` | the store-level integration check |
 | `make sync-configs` | re-inline the 3 configs into the compose file |
 
 ### What the targets need
 
 `make lint` wants `shellcheck`, `terraform` (1.7.5 or newer) and `kubectl`,
-for `kubectl kustomize`. `terraform init` downloads the google and random
-providers, so it needs network. `make test` wants `bats` plus `kubectl`,
-which `tests/kubernetes.bats` renders the manifest with.
-`tests/terraform.bats` reads the module's files as text and needs no
+for `kubectl kustomize`. `terraform init` downloads the google, aws, random
+and time providers, once each into a shared cache, so it needs network; the
+aws provider alone is about 180 MB to download and about 800 MB unpacked in
+the cache. `make test` wants `bats` plus `kubectl`, which
+`tests/kubernetes.bats` renders the manifest with.
+`tests/terraform.bats` reads both modules' files as text and needs no
 terraform.
 
 Both also need a working Docker daemon with the compose plugin, and `jq` on