Perimattic Managed Distributed Tracing Platform on AWS

This AMI runs an open-source distributed tracing platform on Ubuntu 24.04 LTS. Your applications send traces over the OpenTelemetry protocol (OTLP), the platform stores them in an embedded database on disk, and a web UI lets you search traces by service, operation, tags and duration and open the timeline of each request across your services. It is the unmodified open-source release 2.23.0, pinned and baked into the AMI, so first start does not depend on a registry and nothing is downloaded when it starts.

What Perimattic adds

Closed by default: out of the box this kind of platform has no login on its web UI or query API and accepts traces from anyone who can reach its receivers. Here the web UI and the query API are published through Apache behind HTTP Basic authentication with a random 24-character password generated on your server at first login, stored only as a salted hash. Trace ingestion over HTTPS (OTLP/HTTP, POST /v1/traces) goes through Apache with the same password, so remote applications need only ports 80 and 443. The OTLP/gRPC receiver has no authentication and is therefore published on the server's loopback interface only; reach it with an SSH tunnel (the command is printed at the end of setup).

Durable storage: traces are kept in an embedded on-disk database (not in memory), so they survive restarts and reboots. Spans are kept for 7 days. The tests send a real trace through Apache with the password, find it through the query API, reboot the server and find it again.

Tested refusals: the tests prove that anonymous requests, wrong passwords and admin/admin are refused on the web UI, the query API and trace ingestion, and that anonymous ingestion writes nothing.

HTTPS: Apache is configured as a reverse proxy and a free Let's Encrypt certificate is requested for your domain with certbot. The platform runs as an unprivileged user. Only the OTLP receivers are enabled; the older native, Zipkin and sampling endpoints, the metrics endpoint and the AI features are off. Pinned and patched: the application version is fixed, not 'latest', and Ubuntu 24.04 LTS is built through an automated EC2 Image Builder pipeline with security updates applied at build time.

Limits you should know

There is one shared login and no per-user access control. This is a single instance with an embedded store: there is no clustering, and the store has no size limit, so size the volume for your trace volume times 7 days and watch the disk. The gRPC receiver is reachable only through the SSH tunnel or from the server itself. The platform used about 15 to 75 MB of memory when idle (about 600 MB for the whole host); busy systems need more, and large trace volumes need a larger instance and volume.

Licence and attribution

Built on the open-source Jaeger (Apache-2.0 licence), unmodified. Not affiliated with, endorsed by, or sponsored by The Linux Foundation; Jaeger is a trademark of its owner.

Getting Started Launch the AMI and open ports 22, 80 and 443 in the security group SSH in and answer the setup prompts (domain and admin email) Open https://your-domain/  and sign in as admin with the password printed at the end of setup Point your OpenTelemetry exporter at https://your-domain  with the basic authentication header, then search for your first trace

A domain name with an A record pointing at the instance is required, because the site is served over HTTPS.

This AMI is built and supported by Perimattic.

Book a free setup consultation at https://cal.com/gaurav-pareek-perimattic/marketplace-setup-consultations  or email us at aws-support@perimattic.com .

Support Managed and supported by Perimattic, a cloud infrastructure company with 13+ years of experience serving global clients. We offer free setup assistance, custom integrations, infrastructure consulting, and 24/7 support.