Sold by: Lynxroute
Deployed on AWS
Free Trial
This product has charges associated with it for hardening, security configuration, and support.
Rundeck is an open-source runbook automation server - a JVM application that turns scripts and operational procedures into scheduled or on-demand jobs with role-based access control and a full audit trail. This Lynxroute build is hardened and ready out of the box: a random admin password generated at first boot instead of the packaged default, per-instance key-storage encryption keys, a bundled PostgreSQL database bound to localhost instead of the file-based test database, the application port bound to loopback behind an nginx TLS perimeter, UFW firewall pre-configured, and a CIS Level 1 hardened Ubuntu 24.04 LTS base.
Apache-2.0 license - fully auditable, no vendor lock-in. Rundeck is a trademark of PagerDuty, Inc.
Overview
This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.
WHAT IS RUNDECK
Rundeck is an open-source runbook automation and job scheduling server: it turns the scripts and procedures an operations team already runs by hand into jobs that any authorised user can run from a browser, the REST API, or a schedule. It is a Java application (a single WAR on the JVM with an embedded web server) built around projects, node inventories, and workflows: a job is a sequence of shell commands, scripts, or plugin steps, optionally parameterised with options, dispatched across nodes over SSH, with per-execution logs retained for audit. Access is governed by role-based ACL policies, so routine operations - restarts, backups, provisioning, data fixes - can be delegated without handing out SSH keys or shell access. Rundeck persists projects, jobs, executions, and encrypted key storage in a relational database; this image bundles PostgreSQL for that purpose. Apache-2.0 license, no vendor lock-in.
WHAT THIS AMI ADDS
Security hardening:
- No default credentials - the packaged admin/admin login is removed and a random 24-character admin password is generated at first launch, stored only as a digest and surfaced to /root/rundeck-credentials.txt (mode 600)
- Per-instance encryption keys - the key storage and project configuration encryption passwords are regenerated at first launch, so no two instances share a secret
- Bundled PostgreSQL bound to 127.0.0.1 only, with its own randomly generated role password - the file-based database that ships by default is not supported by the project for production use
- Rundeck bound to 127.0.0.1:4440 (loopback only); nginx terminates TLS on port 443 and reverse-proxies to it - the application port is never exposed
- A per-instance REST API token generated at first launch for automation, revocable in one line
- certbot pre-installed - one command swaps the self-signed certificate for a CA-signed one
- JVM heap auto-sized to the instance RAM at first launch; temp directory kept off the noexec /tmp so job scripts run cleanly
- Runs as a non-root rundeck system user with UMask 0027
- UFW firewall pre-configured (only ports 22 and 443 open)
- CVE scan - every image is scanned for vulnerabilities before release
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Rundeck is a trademark of PagerDuty, Inc. This is an independently hardened build of the open-source project, not affiliated with or endorsed by PagerDuty, Inc.
Highlights
- Rundeck security baked in: a random admin password generated at first launch instead of the packaged default, per-instance key-storage encryption keys, a bundled PostgreSQL bound to localhost with its own generated password, the application port bound to loopback behind an nginx TLS perimeter on 443, and a per-instance REST API token for automation.
- CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
- Delegate operations safely: scheduled and on-demand jobs, node dispatch over SSH, role-based ACL policies, per-execution audit logs, and a full REST API. Apache-2.0 license - fully auditable, no vendor lock-in. Rundeck is a trademark of PagerDuty, Inc.
Details
Sold by
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.large Recommended | $0.05 |
t3.medium | $0.05 |
m6i.xlarge | $0.05 |
m6i.large | $0.05 |
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Rundeck 6.1.0 - Initial release (August 2026)
- Rundeck 6.1.0 on Ubuntu 24.04 LTS (OpenJDK 17)
- CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
- CVE-scanned before every release
- Random admin password generated at first launch and stored only as a digest - the packaged default login is removed
- Per-instance key storage and project configuration encryption keys generated at first launch
- Bundled PostgreSQL bound to 127.0.0.1 with a randomly generated role password, replacing the file-based database that upstream supports for testing only
- Rundeck bound to 127.0.0.1:4440; nginx terminates TLS on port 443
- Per-instance REST API token generated at first launch for automation
- JVM heap auto-sized to the instance RAM; temp kept off noexec /tmp
- Runs as non-root rundeck user (UMask 0027)
- certbot pre-installed for CA-signed TLS certificates
- UFW firewall pre-configured (ports 22, 443 only)
- fail2ban, auditd, AppArmor pre-configured
- SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
- CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
- IMDSv2 enforced
Additional details
Usage instructions
- Launch instance (t3.large recommended; t3.medium minimum)
- Open Security Group - allow TCP 443 from your IP
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- Read the generated login: sudo cat /root/rundeck-credentials.txt
- Open https://<PUBLIC_IP>/ in your browser - accept the self-signed certificate warning. First launch takes 2-4 minutes while the database is prepared; until the service is ready the page shows a loading screen that refreshes itself.
- Sign in as "admin" with the password from step 4.
- Create a project, then add a job with a command step and run it - the execution log and history are stored in the bundled PostgreSQL database.
Rundeck is bound to 127.0.0.1:4440; nginx terminates TLS on port 443 and reverse-proxies to it. The admin password, the PostgreSQL role password, both key-storage encryption keys and a REST API token are generated uniquely per instance at first launch and saved to /root/rundeck-credentials.txt. The admin password is stored only as a digest in /etc/rundeck/realm.properties - change it there (the file documents the exact syntax) and restart with: sudo systemctl restart rundeckd
Restrict Security Group port 443 to your own IP until you have signed in and changed the admin password.
Replace the self-signed TLS certificate with a CA-signed certificate for production use: sudo certbot --nginx -d yourdomain.com
Resources
Vendor resources
Support
Vendor support
Visit us online: https://lynxroute.com
For Rundeck documentation: https://docs.rundeck.com/docs/
Rundeck is a trademark of PagerDuty, Inc.; this is an independently hardened build of the open-source project, not affiliated with or endorsed by PagerDuty, Inc.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
This product has charges associated with it for seller support. Rundeck is an open-source automation and orchestration tool designed to help with workflow automation, job scheduling, and managing complex tasks across distributed infrastructure. It provides a web-based user interface for defining, running, and scheduling jobs or workflows on multiple nodes or systems.
This product has charges associated with it for seller support. Rundeck is an open source automation and orchestration tool designed to help with workflow automation, job scheduling, and managing complex tasks across distributed infrastructure. It provides a web-based user interface for defining, running, and scheduling jobs or workflows on multiple nodes or systems.
The Cloud Security Connector is the most straightforward way to connect to Zscaler (ZIA) solution with High Availability, protecting public and private traffic.
This product has charges associated with it for Websoft9 support. Pre-configured, web-based, cloud-native, secure, one-click to deploy GitLab CE with Websoft9 DevOps Platform on AWS. GitLab is an integrated product that unifies issues, code review, CI and CD into a single UI.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.