Cloudwrxs - CouchDB on Microsoft Windows Server 2022

Prerequisite: IAM Role Requirement (Before Launching the Instance) Before launching the EC2 instance from this AMI, you must ensure that an IAM Role with AWS Secrets Manager permissions is attached. During first boot, the MariaDB root password is: a. Automatically generated b. Securely stored in AWS Secrets Manager If the instance does not have proper IAM permissions, the password will not be stored.

Option 1: Use Existing Role with SecretsManagerReadWrite (Quick Setup) If you already have an IAM role with the AWS managed policy: SecretsManagerReadWrite You may attach that role to the EC2 instance during launch.

Option 2: Recommended (Least Privilege Policy) Step 1: Create Custom IAM Policy Go to: IAM, Policies, Create Policy, JSON Paste: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "secretsmanager:CreateSecret", "secretsmanager:PutSecretValue", "secretsmanager:DescribeSecret" ], "Resource": "arn:aws:secretsmanager:<region>:<account-id>:secret:/awsmarketplace/mariadb/*" } ] } Save the policy.

Step 2: Create IAM Role for EC2

1. Go to IAM, Roles, Create Role 2.Select AWS Service
2. Choose EC2
3. Attach: a. The custom policy you created b. (Recommended) AmazonSSMManagedInstanceCore
4. Name the role (example: MariaDBSecretsRole)
5. Create the role

Step 3: Attach Role During EC2 Launch When launching the instance from the AMI:

1. Go to Advanced Details

2. Under IAM Instance Profile

3. Select the IAM role you created

4. Launch the instance

5. Launch EC2 Instance from AMI Create Instance from AMI. Retrieve the Windows password from the AWS EC2 console:

6. Select your instance

7. Click Connect

8. Choose RDP Client

9. Click Get Windows Password

10. Upload your EC2 key pair to decrypt

11. Retrieve the Administrator password

12. Connect to the Instance via RDP Use Remote Desktop Connection (mstsc) on your Windows or Mac machine. In the Computer field, enter:

    <your-ec2-public-ip>

Log in using: Username: Administrator Password: Retrieved from AWS EC2 console

3. Retrieve CouchDB Admin Password (Required) The CouchDB administrator password is automatically generated during first boot and securely stored in AWS Secrets Manager. The installation-time password is NOT valid. To Retrieve the Password: a. Go to AWS Console b. Open AWS Secrets Manager c. Locate the secret: /awsmarketplace/couchdb/<instance-id> d. Click Retrieve secret value e. Copy the password field Example: { "username": "admin", "password": "AutoGeneratedSecurePassword", "engine": "couchdb", "host": "localhost", "port": 5984 }

4. Verify CouchDB Installation After connecting via RDP: Check CouchDB Service Status Open PowerShell: Get-Service couchdb Status should be: Running

Verify via Browser (Local Access) Open browser on the server: http://localhost:5984/_utils/  This opens the CouchDB Fauxton UI. Login with: Username: admin Password: Retrieved from AWS Secrets Manager

5. Connect Remotely (Optional) If allowing remote access: Open Windows Firewall for port 5984 Update CouchDB local.ini bind address if required Default API endpoint: http://<instance-public-ip>:5984 Login with: Username: admin Password: Retrieved from AWS Secrets Manager

6. Changing the CouchDB Admin Password (Optional) If you change the password manually: Option A: Using Fauxton UI

7. Open: http://localhost:5984/_utils/ 

8. Go to: Settings, Admins

9. Update password

Option B: Direct API Call From PowerShell: $pair = "admin:CurrentPassword" $encoded = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes($pair))

Invoke-RestMethod -Method PUT -Uri http://localhost:5984/_node/_local/_config/admins/admin  -Headers @{Authorization="Basic $encoded"} -Body '"NewStrongPasswordHere"'

If you change the password manually, update the value in AWS Secrets Manager to keep it synchronized.