Sold by: Lynxroute
Deployed on AWS
Free Trial
This product has charges associated with it for hardening, security configuration, and support.
Apache Druid is a real-time OLAP database for sub-second analytics on streaming and historical data, shipped here as a self-contained single-server cluster: six Java services, an embedded metadata store, bundled coordination and local deep storage, with no external dependencies to provision. This Lynxroute build is hardened and ready out of the box: a unique console password generated at first boot, every Druid service and the coordination and metadata ports bound to localhost only, a TLS reverse proxy as the single entry point, UFW firewall pre-configured, and a CIS Level 1 hardened Ubuntu 24.04 LTS base.
Apache-2.0 license - fully auditable, no vendor lock-in.
Overview
This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.
WHAT IS APACHE DRUID
Apache Druid is a high-performance real-time OLAP database built for sub-second analytical queries over both streaming and historical data. It stores data in a columnar format with time-based partitioning, bitmap indexes and automatic rollup, which lets it answer aggregations, group-bys, top-Ns and time-series queries over billions of rows interactively. Druid is written in Java and runs as a set of cooperating services - broker, coordinator, overlord, historical and middle manager - coordinated through Apache ZooKeeper. It exposes both a native JSON query API and full ANSI-style SQL, and ships a browser-based console for data loading, query authoring, segment management and cluster monitoring. Typical workloads are clickstream and product analytics, application and network telemetry, operational dashboards, digital marketing analytics and real-time fraud detection. Data can be ingested in batch from files or object storage, or continuously from Apache Kafka. Apache-2.0 license, no vendor lock-in.
WHAT THIS AMI ADDS
This image runs Druid as a complete single-server cluster. The metadata store (embedded Apache Derby), deep storage (local disk) and coordination (bundled Apache ZooKeeper) all run on the instance, so the product is usable the moment it boots with nothing external to provision. Buyers who outgrow it can point deep storage at Amazon S3 and the metadata store at PostgreSQL or MySQL - all three extensions ship in the image.
Security hardening:
- Unique console password generated at first boot and written to a root-only credentials file - nothing is baked into the image
- All six Druid services bound to 127.0.0.1 only - the query broker, coordinator, overlord, historical, middle manager and the ingestion task workers are unreachable from the network
- Apache ZooKeeper client port and the embedded metadata store bound to 127.0.0.1 only - neither is exposed externally
- nginx terminates TLS on port 443 as the single entry point and gates the console, the REST API and the SQL endpoint behind authentication - Druid has no built-in authentication of its own
- JavaScript query extension points disabled, so untrusted query input cannot execute code inside the service JVMs
- Automatic memory sizing for all six JVMs derived from instance RAM, with headroom reserved for the OS
- UFW firewall pre-configured - only 22, 80 and 443 open; all Druid, coordination and metadata ports blocked externally
- fail2ban SSH brute-force protection and AppArmor mandatory access control
- CVE scan - every image is scanned for vulnerabilities before release
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, SSH hardening, Kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Highlights
- Apache Druid security baked in: unique console password generated at first boot, all six Druid services plus the coordination and metadata ports bound to localhost only, TLS reverse proxy as the single authenticated entry point, JavaScript query execution disabled, UFW firewall pre-configured.
- CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
- Sub-second analytics on streaming and historical data: columnar storage, time partitioning, automatic rollup, native JSON and SQL query APIs, and a browser console for data loading and cluster monitoring. Self-contained single-server cluster with no external services to provision. Apache-2.0 license - fully auditable, no vendor lock-in.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
m6i.xlarge Recommended | $0.05 |
m6i.2xlarge | $0.05 |
m6i.large | $0.03 |
Dimensions summary
You pay by the hour based on the EC2 instance size you run this hardened Apache Druid image on. The three options are all m6i instance types that differ by compute and memory capacity: m6i.large, m6i.xlarge, and m6i.2xlarge. Pricing scales with instance size, so a larger instance costs more per hour. You pick the size that fits your workload and run it as long as needed. This software fee is separate from the AWS infrastructure charges for the underlying EC2 instance.
Top-of-mind questions for buyers
Each option maps to an AWS EC2 m6i instance size. The m6i.large is the smallest, followed by m6i.xlarge, then m6i.2xlarge with the most vCPUs and memory. You pick the size to match your Apache Druid workload. AWS publishes the exact vCPU and memory specs for each instance type.
The hourly software fee meters running time. A fully stopped instance does not accrue the software charge. You may still pay AWS for attached storage while the instance is stopped. Charges resume when you restart the instance.
Every image ships with CIS Level 1 hardening on Ubuntu 24.04 LTS, a CVE scan before release, a CycloneDX SBOM, and a CIS Conformance Report. Unique credentials are generated at first boot, with firewall, fail2ban, AppArmor, and auditd pre-configured. These are included in the hourly fee.
lynxroute.com
Helpful?
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Apache Druid 37.0.0 - Initial release (August 2026)
- Apache Druid 37.0.0 on Ubuntu 24.04 LTS
- Self-contained single-server cluster - embedded metadata store, local deep storage and bundled Apache ZooKeeper, no external services to provision
- CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
- CVE-scanned before every release
- Unique console password generated at first boot, written to a root-only credentials file
- All six Druid services plus the coordination and metadata ports bound to 127.0.0.1 only
- nginx TLS reverse proxy on 443 as the single authenticated entry point
- JavaScript query extension points disabled
- Automatic JVM memory sizing derived from instance RAM
- UFW firewall pre-configured (ports 22, 80, 443 only)
- fail2ban, auditd, AppArmor pre-configured
- SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
- CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
- IMDSv2 enforced
Additional details
Usage instructions
- Launch instance (m6i.xlarge recommended, m6i.large minimum - Druid runs six Java services plus coordination and sizes its memory from instance RAM)
- Open Security Group - allow TCP 443 from your IP/CIDR
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- Read credentials: sudo cat /root/druid-credentials.txt
- Open https://<PUBLIC_IP>/ - accept the self-signed certificate warning, then sign in with username 'admin' and the password from step 4. The Apache Druid console loads.
- On first launch the cluster takes 2-4 minutes to start. Until it is ready to serve queries the URL shows a loading page that refreshes itself - this is expected, no action needed.
- Load the bundled sample dataset:
curl -s -X POST -H 'Content-Type: application/json'
-d @/opt/druid/quickstart/lynxroute-wikipedia-index.json
http://127.0.0.1:8888/druid/indexer/v1/task Watch it under "Ingestion" in the console. When it succeeds the "wikipedia" datasource appears under "Datasources". - Query it, from the console "Query" tab or from the shell:
curl -s -X POST -H 'Content-Type: application/json'
-d '{"query":"SELECT COUNT(*) FROM wikipedia"}'
http://127.0.0.1:8888/druid/v2/sql - Replace the self-signed TLS certificate with a CA-signed one before production: sudo certbot --nginx -d yourdomain.com
The Druid console and its REST and SQL APIs have no authentication of their own. The nginx reverse proxy on 443 is the only access control, so keep port 443 restricted to your own IP range until you have replaced the certificate and decided on your access model.
All Druid ports bind to 127.0.0.1 only: console and router 8888, coordinator and overlord 8081, query broker 8082, historical 8083, middle manager 8091, ingestion tasks 8100-8199, Apache ZooKeeper 2181, metadata store 1527.
Credentials are written to /root/druid-credentials.txt at first boot.
Data persists under /var/lib/druid - segments, the metadata database, ingestion task state and the coordination store. It survives reboots and instance stop/start.
For durable or shared deep storage, set druid.storage.type to s3 in /opt/druid/conf/druid/auto/_common/common.runtime.properties; the Amazon S3, PostgreSQL and MySQL extensions all ship in this image.
Resources
Vendor resources
Support
Vendor support
Visit us online: https://lynxroute.com
For Apache Druid documentation:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
FerroDruid is a Rust-native, Apache-Druid-compatible real-time OLAP database that runs as a single JVM-free, ZooKeeper-free binary and boots in under a second on under 200 MB of RAM. This listing delivers a hardened, AWS-security-scanned AMI of FerroDruid v1.2.0. Now source-available under BUSL-1.1.
FerroDruid is a Rust-native, Apache-Druid-compatible real-time OLAP database that runs as a single JVM-free, ZooKeeper-free container and boots in under a second on under 200 MB of RAM. This listing delivers a hardened, AWS-security-scanned FerroDruid v1.2.0 container for Kubernetes (EKS) and serverless container compute (ECS/Fargate). Now source-available under BUSL-1.1.
Apache Hudi connector with shaded dependencies to work with AWS Glue.
Easily access Iceberg tables and operate DDLs, reads/writes, time-travels, streaming writes on the Iceberg tables.
This is a repackaged open source software product wherein additional charges apply for technical support. Softwares included: Ubuntu and Apache Web Server
Bansir offers this software product repackaged where additional charges apply for technical support provided by Bansir Cloud email support@bansircloud.com.
Enterprise-grade Kafka UI and API for deep visibility, precise control, and instant action across your ecosystem. Kpow is secure, vendor-agnostic, and trusted by Fortune 500s for managing Apache Kafka at scale.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.