Perimattic Managed Team Password Vault on AWS

This AMI runs a self-hosted team password manager, the open-source Community Edition 5.17.0, with MariaDB on Ubuntu 24.04 LTS. Your team stores and shares credentials through a browser extension; each person's private encryption key is generated and kept entirely on their own device, and a server-side GPG key pair this instance generates for itself protects data in transit between them. The vendor's own Community Edition container image is pinned and baked into the AMI, so first start does not depend on a registry.

What Perimattic adds

There is no username and password to hand you. Instead, at first login this AMI creates the organization's administrator through the application's own command line, which returns a one-time setup link; setup checks that link once before handing it to you (in access.txt, root only), and proves a wrong or reused link is refused, that self-registration is closed, and that nothing can be read anonymously. You open that link yourself, with the matching browser extension, to choose your own master passphrase; the server never sees it. Apache provides HTTPS with a free Let's Encrypt certificate for your domain.

Limits you should know

Every other account is created by you, as the administrator; there is no sign-up page. No mail server is configured, so the one-time links other new accounts need are not emailed automatically; share them directly, or add SMTP settings. The application used under 150 MB of memory and MariaDB about 140-160 MB in our tests, so a t3.small (2 GB) is the recommended starting size. Losing the generated GPG server key without a backup makes stored secrets unreadable, so back up the whole instance.

Licence and attribution

Built on the open-source passbolt Community Edition (AGPL-3.0), using the vendor's own image, unmodified; the -ce tag only, not the commercial -pro edition. Not affiliated with, endorsed by, or sponsored by Passbolt SA; Passbolt is a trademark of its owner. MariaDB Server is released under GPL-2.0.

Getting Started Launch the AMI and open ports 22, 80 and 443 in the security group SSH in and answer the setup prompts (domain and admin email) Copy the one-time setup link printed at the end of setup Open it in a browser with the matching extension installed and choose your own passphrase

A domain name with an A record pointing at the instance is required, because the site is served over HTTPS.

This AMI is built and supported by Perimattic.

Book a free setup consultation at https://cal.com/gaurav-pareek-perimattic/marketplace-setup-consultations  or email us at aws-support@perimattic.com .

Support Managed and supported by Perimattic, a cloud infrastructure company with 13+ years of experience serving global clients. We offer free setup assistance, custom integrations, infrastructure consulting, and 24/7 support.