Lightweight Worker Node Deployment for AI Automations

Overview

As organizations deploy AI across multiple departments and cloud environments, there's limited visibility into which AI systems are operating, what data they use, and how they make decisions. This blind spot increases regulatory risk and undermines ethical governance efforts.

The OneTrust lightweight worker node is a modular version of our worker node that grants a simplified experience and minimizes the need for specialized personnel. It can retrieve all prerequisites and images from a cloud API, ensuring smooth, firewall-independent deployment.

By providing real-time visibility into AI systems—including their data sources, operational footprint, and decision logic—this feature empowers organizations to govern AI responsibly across departments and clouds. It also reduces regulatory risk and strengthens ethical oversight, enabling confident, compliant AI adoption at scale.

Prerequisites

You will need an account with one of the supported cloud service providers with the necessary permissions and security configurations to permit this deployment.

AWS

Below is the policy that needs to be attached to the CloudFormation execution role, the IAM role that CloudFormation assumes to create, update, and delete your VPC, EC2 instances, Key Pairs, and other options. The AWS console user's role (for example, Developer, DevOps, etc.) should have the necessary permissions to execute CloudFormation stacks and inspect the resources provisioned by the stacks, in addition to any broader permissions their role requires.

Download the JSON policy here.

Azure

Required at minimum: Contributor role on the subscription or resource group

Additionally, less broad scope roles are required in the resource group:

  • Microsoft.Resources/deployments/*

  • Microsoft.Network/*

  • Microsoft.Compute/*

Google Cloud

You will need a deployment service account with the following roles:

  • roles/compute.instanceAdmin.v1: to create/update/delete Compute Engine instances

  • roles/iam.serviceAccountUser: to run instance as service account

  • roles/compute.networkAdmin: to read/create VPC networks, subnets, firewall rules

  • roles/compute.securityAdmin: to manage firewall rules

  • roles/config.admin: control of Infrastructure Manager resources

  • roles/config.agent: to provide access to a service account to work with Infra Manager, including deployments, revisions, logging, and Terraform state files

To create the lightweight worker node

  1. On the AI Governance menu, select Setup > AI automations.

    The AI automations screen appears.

  2. Click the Create worker node button.

    The Create lightweight worker node modal appears.


    AI automations screen
  3. Choose your desired cloud service provider.

    Create lightweight worker node modal
  4. Select a vault to securely access credentials required to activate this worker node.
    AWS Selected

    Create lightweight worker node modal - Select vault

    Vault Option

    Required Fields

    HashiCorp Vault - Open Source (Internal)

    Default option, no fields required.

    AWS Secrets Manager

    • AWS region

    • Access key

    • Secret access key
    Azure Selected

    Select vault selection menu

    Vault Option

    Required Fields

    HashiCorp Vault - Open Source (Internal)

    Default option, no fields required.

    Azure Key Vault

    • Azure Key Vault URL

    • Azure Key Vault tenant ID

    • Azure Key Vault client ID

    • Azure Key Vault client secret
    GCP Selected
    Tip:

    You will be asked to enter your Service ID from the GCP account and select your desired vault. The Source URL should be copied so it can be provided in the next steps.


    Select vault - Service ID field

    Vault Option

    Required Fields

    HashiCorp Vault - Open Source (Internal)

    Default option, no fields required.

    Google Secret Manager

    Choose between:

    • Manual input: paste your JSON credentials

    • Upload credentials: select a local file in either TXT or JSON format
  5. Click the Activate worker node button. You will be directed to the selected provider in a new browser tab to activate the worker node. The AWS Deployment,Azure Deployment, andGoogle Cloud Deployment sections below will address the specifics required for each deployment approach.
    Note:

    If you are already logged in to the account in your current browsing session, the page will automatically appear via SSO. If not, you will be asked to log in before you can access the activation page.

  6. Back in OneTrust, the Set up automation button on the Automations screen will be disabled until the worker node is healthy.

    Automations screen - Set up automation
  7. After deployment, you can go to Data Discovery and select Setup > Worker nodes to view the lightweight worker node and monitor its status. For more information, see Managing Worker Node Details.

AWS Deployment

  1. The AWS console will present the Quick create stack screen, which contains essential information about the node's template and optional details you can provide for existing options.

    Tip:

    If you do not have existing details, options, or values to provide, you can use the default selections offered by AWS to create the stack. If so, you must check the acknowledgment box.



  2. To change your region, click the dropdown in the menu and select your preference.



  3. The stack name will default to an auto-generated convention prefixed with "ot". Example: ot-5890a347-3e85-2234



  4. The Parameters section contains additional fields to allow the input of custom values for the networking settings.

    • Existing Instance Profile (optional) - provide the Name or ARN of an existing IAM instance profile. If you leave this field blank, the template creates a new IAM role and instance profile with the following permissions:

      • The AWS managed policies AmazonSageMakerReadOnly, SecretsManagerReadWrite, and AWSCloudTrail_ReadOnlyAccess.

      • An inline policy named AgentCorePermissions that grants read-only access to Amazon Bedrock, Amazon Bedrock AgentCore, Amazon CloudWatch and Logs, and Amazon S3. All actions in this policy are scoped to Resource: "*" because they are list/get operations.

      • The instance profile must trust ec2.amazonaws.com with sts:AssumeRole. If your organization uses SCPs or permission boundaries, ensure the provided role can also attach these managed policies and inline statements.



  5. The Advanced Settings section allows you to manage the HTTP/HTTPS Proxy URL and ECS Instance Type. OneTrust currently supports UBUNTU2204 as the Operating System Version. Support for additional operating system versions is coming soon in future releases.



  6. The Tags section permits the optional creation and inclusion of tags (i.e. key-value pairs) to help apply metadata to your AWS resources.



  7. The Permissions section permits the optional specification of existing AWS Identity and IAM service role(s) that CloudFormation can assume.

    Note:

    If you are using the JSON policy for the IAM role, you must select that role here.



  8. The Stack failure options section lets you choose the behavior of provisioning failures and rollback options.



  9. Lastly, the Additional settings section contains subsections for managing additional options for your stack.



  10. When ready, click the Create stack button.

  11. The Stacks screen appears to track the creation progress of the new stack. The process may take up to 15-25 minutes to complete.

    Refresh the Events tab to track the progress and status of new events. The Resources tab will catalog the list of created resources needed for the node.



  12. The screen will update with a confirmation that the deployment is complete.



    You can now navigate back to OneTrust and begin setting up automations.



Azure Deployment

  1. The Azure console will present the Custom deployment screen, which contains essential information about the node's template and optional details you can provide for existing options.



  2. In the Project details section, you will need to provide your Azure subscription and desired resource group.



  3. In the Instance details section, you will need to identify your region and provide your admin username.

    Note:

    The resource group you chose will auto-populate the region.



  4. Next, you will need to select an authentication type and confirm those corresponding details.

    SSH Public Key Source (Default)

    Source Option

    Description

    Generate a new key pair

    Use existing key stored in Azure (supports Ed25519 and RSA SSH formats)

    Use existing public key (supports Ed25519 and RSA SSH formats)

    Important:

    Provide an RSA or Ed25519 public key in the OpenSSH format (starting with "ssh-rsa" or "ssh-ed25519" depending on the SSH key format used) or an RSA key in the multi-line PEM format. You can generate SSH keys using ssh-keygen on Linux and OS X, or PuTTYGen on Windows. Please note that multi-line PEM format is not supported for Ed25519 SSH keys.

    Password



    Field
    Description
    Password

    Provide your password.

    Confirm password

    Confirm your password.

  5. For Advanced Options, this defaults to No. Choose Yes to provide your desired advanced settings:



    Field
    Description
    VM Operating System

    Choose either:

    • Ubuntu-2204

    • Ubuntu-2404 (Default)

    • RHEL 8

    • RHEL 9

    VM Size

    Choose either:

    • Standard_D8ads_v5

    • Standard_D16ads_v5

    Use existing Virtual Network?

    If Yes, provide your Virtual Network and Subnet.

    Enter Proxy Details

    If Yes, provide your Proxy IP and Proxy Port.

    • Proxy IP Example: 49.85.184.22

    • Proxy Port Example: 3218

  6. When ready, click the Review + create button. The screen will begin validating the details from the Basics section.

  7. If there are any issues with your Basics, the screen will display a validation error.



  8. Review your template details, navigating backwards as necessary to update. When ready, click the Create button.



  9. If you selected the Generate new key pair option, a modal will appear to allow you to download these keys. This is your only chance to download them.



  10. The screen will refresh and the deployment will begin. Resources will be populated as they are created.



  11. The screen will update with a confirmation that the deployment is complete.



    You can now navigate back to OneTrust and begin setting up automations.



Google Cloud Deployment

  1. When you choose GCP as the desired service provider, you will be asked to enter your Service ID from the GCP account and select your desired vault. The Source URL should be copied so it can be supplied in the next steps.



  2. Click the Activate worker node button to navigate to the Google Cloud console, which will present the Create an infrastructure Manager deployment screen.

  3. You will need to provide and/or confirm the basic details:



    Field
    Description
    Deployment ID

    Provide a unique ID for this new deployment.

    Region

    Confirm your deployment region.

    Terraform version

    Confirm the Terraform version.

    Service Account

    Select the service account that is authorized with the necessary roles.

  4. Select GCS for the Source of Terraform configuration setting, then paste the source path you copied in OneTrust.



  5. Click the Create deployment button. The console will begin the deployment and provide updates as resources are created or issues are encountered.



  6. The screen will update with a confirmation that the deployment is complete.

    You can now navigate back to OneTrust and begin setting up automations.