Sold by: Lynxroute
Deployed on AWS
Free Trial
This is a repackaged open source software product wherein additional charges apply for hardening, security configuration, and setup support.
OpenSearch is an open source search, analytics and observability suite: the OpenSearch engine (Java) plus OpenSearch Dashboards (Node), deployed single-node on one host. This Lynxroute build is hardened and ready out of the box: the demo certificates and admin password are replaced with per-instance values generated at first boot, the REST API on 9200 stays TLS-encrypted and authenticated, Dashboards is served through a TLS-terminating nginx with a startup readiness gate, UFW firewall pre-configured, and a CIS Level 1 hardened Ubuntu 24.04 LTS base.
Apache-2.0 engine and Dashboards - not Elastic SSPL - fully auditable, no vendor lock-in.
Overview
This is a repackaged open source software product wherein additional charges apply for hardening, security configuration, and setup support.
WHAT IS OPENSEARCH
OpenSearch is a community-driven, open source suite for search, log analytics and observability, forked from Elasticsearch and Kibana and now governed by the OpenSearch Software Foundation under the Linux Foundation. This image runs the suite single-node on one host: the OpenSearch engine (a Java/Lucene distributed search and analytics engine that indexes JSON documents and serves a REST API) and OpenSearch Dashboards (the Node visualization and management UI). It powers full-text and vector search, log and event analytics, dashboards, alerting and anomaly detection, with role-based access control and TLS enforced by the bundled security plugin. The engine and Dashboards are licensed Apache-2.0 - not Elastic SSPL - so the full stack is auditable with no vendor lock-in and no SaaS fees.
WHAT THIS AMI ADDS
Security hardening:
- The security plugin's well-known demo TLS certificates are regenerated per-instance at first boot (a fresh private certificate authority, node and admin certificates) - the demo certificates never reach your instance
- The default admin password is replaced with a strong password generated uniquely at first boot and written to /root/opensearch-credentials.txt (mode 0600)
- The REST API on port 9200 is TLS-encrypted and authenticated (the security plugin) so it is safe to expose for ingestion; the inter-node transport port 9300 is bound to 127.0.0.1 only
- Dashboards listens on 127.0.0.1:5601 and is reachable only through a TLS-terminating nginx on port 443, with a loading splash and readiness gate during startup
- The JVM heap is sized to the instance, locked into memory, and vm.max_map_count is set so the engine starts reliably
- UFW firewall pre-configured: only TCP 22, 443, and 9200 are open
- fail2ban, auditd, and AppArmor pre-configured
- CVE-scanned before every release
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, SSH hardening, kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Highlights
- OpenSearch security baked in: the security plugin's demo TLS certificates are regenerated per-instance at first boot and the default admin password is replaced with a unique generated one, the REST API on 9200 stays TLS-encrypted and authenticated, and Dashboards is reachable only through a TLS nginx.
- CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
- Full open-source search and analytics: full-text and vector search, log and observability analytics, Dashboards visualizations, alerting and anomaly detection, with TLS and role-based access control enforced by the bundled security plugin. Apache-2.0 engine and Dashboards - not Elastic SSPL, no vendor lock-in.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
m6i.xlarge Recommended | $0.05 |
m6i.2xlarge | $0.05 |
m6i.large | $0.05 |
Dimensions summary
You pay by the hour for the EC2 instance size you run. The three options map to different compute capacities: m6i.large, m6i.xlarge, and m6i.2xlarge. Pricing scales with instance size, so larger instances cost more per hour. You choose the size that fits your workload and billing follows actual usage. All three deliver the same hardened OpenSearch image; they differ only in compute capacity. Hourly software charges are separate from the underlying AWS infrastructure costs. The marketplace sets and collects all fees.
Top-of-mind questions for buyers
Each option maps to an EC2 m6i instance size. The m6i.large gives the smallest vCPU and memory allocation, the m6i.xlarge roughly doubles it, and the m6i.2xlarge doubles again. All run the same hardened OpenSearch image on Ubuntu 24.04. You pick the size that matches your search and analytics load.
Hourly software charges meter running time only. A fully stopped instance stops accruing the software fee. Stopped instances may still incur underlying AWS storage costs for the attached disk, but those are separate from the Lynxroute software charge. The marketplace sets and collects all fees.
You choose the instance size at launch, and billing follows whichever size runs. To change capacity, you deploy a new instance of a different size. The images are vendor neutral and run on multiple cloud providers, so you are not locked to one provider.
lynxroute.com
Helpful?
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
OpenSearch 3.9.0
- OpenSearch and OpenSearch Dashboards updated 3.8.0 -> 3.9.0. Apache-2.0 unchanged
- Security: completion suggester bounded against heap exhaustion (CVE-2026-63136), Log4j updated to 2.25.5 (CVE-2026-49844), and Dashboards plugin dependencies updated to address multiple CVEs
- Vector search: new half_float vector type roughly halves k-NN memory, plus 2-bit and 4-bit scalar quantization and opt-in dynamic mapping for knn_vector fields
- Time-range queries now skip whole indexes outside the range before any shard work, and a new DELETE /_tasks/{task_id} API removes stored task results
- Richer audit events (request correlation ID, user agent, roles and authentication method), and the Resource Sharing framework is now generally available
- Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com
- Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates
Additional details
Usage instructions
- Launch instance (m6i.xlarge recommended; m6i.large minimum; 50 GB disk)
- Open Security Group - allow TCP 443 (Dashboards) and TCP 9200 (REST API) from your IP
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- First launch takes about a minute while the engine warms up and per-instance certificates and the admin password are generated; until then https://<PUBLIC_IP>/ shows a loading page that refreshes automatically
- Read credentials: sudo cat /root/opensearch-credentials.txt
- Open https://<PUBLIC_IP>/ in your browser - accept the self-signed certificate warning - and log in to OpenSearch Dashboards as admin with the password from the credentials file
- Use the REST API over TLS with authentication: curl -k -u admin:<password> https://<PUBLIC_IP>:9200 Create an index, add a document, and search it: curl -k -u admin:<password> -X PUT https://<PUBLIC_IP>:9200/myindex curl -k -u admin:<password> -X POST https://<PUBLIC_IP>:9200/myindex/_doc -H 'Content-Type: application/json' -d '{"hello":"world"}' curl -k -u admin:<password> https://<PUBLIC_IP>:9200/myindex/_search
- In Dashboards, open Dashboards Management to create an index pattern over your data, then build visualizations
The admin password and per-instance TLS certificates are generated at first boot and the demo certificates are removed. The inter-node transport port 9300 and the Dashboards backend port 5601 are bound to 127.0.0.1 only and are not reachable from outside the instance. On a single node cluster health is yellow when an index requests replicas (there is no second node to place them on) - this is expected, not an error.
Replace the self-signed TLS certificate with a CA-signed certificate (or run sudo certbot --nginx) for production use.
Resources
Vendor resources
Support
Vendor support
Visit us online: https://lynxroute.com
For OpenSearch documentation: https://opensearch.org/docs/ For OpenSearch upstream issues:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
This is a repackaged open source software product wherein additional charges apply for hardening, security configuration, and setup support.
Meilisearch is a lightning-fast, typo-tolerant search engine shipped as a single Rust binary, exposing a developer-friendly REST API for full-text, semantic, and hybrid search. This Lynxroute build is hardened and ready out of the box: production mode with a strong master key generated at first boot, the engine bound to localhost behind an nginx TLS reverse proxy on 443, analytics disabled, UFW firewall pre-configured, and a CIS Level 1 hardened Ubuntu 24.04 LTS base.
MIT license - fully auditable, no vendor lock-in.
OpenText™ Knowledge Discovery for AWS brings the expansive ingestion, data enrichment and analytics capabilities of IDOL to AWS. Allowing users to ingest more than 1900 document types and 160 different repositories while extracting all the data within, powering Enterprise Search and File Analysis.
Our Elasticsearch consulting experts know how to get the best out of this powerful technology – and we can empower your team to deliver the value your business requires. Our relevance tuning methods help you deliver the right results to users.
Simplify and accelerate data center migration with compliant cloud archiving
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.