Easegress Traffic Gateway - AMI | Support by cloudimg

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Standing up Easegress by hand means downloading and checksum-verifying the release binary, writing the server config, keeping the administration API off the public network, generating an admin credential, wiring a reverse-proxy pipeline, and running it as an unprivileged service that can still bind port 80. This AMI does all of that for you: a working traffic gateway is serving requests within minutes of launch, with a unique administration credential generated automatically on first boot. Unlike a default install that leaves the admin API reachable without authentication, this image binds the admin API to loopback only and puts the one network-facing administration path behind a per-instance basic-auth credential. It runs as native systemd services with no container runtime required.

Easegress is a single Go binary (easegress-server) with an embedded configuration store, driven by declarative HTTPServer and Pipeline objects applied with the egctl command-line tool. The data-plane HTTP server owns port 80 and runs as a dedicated unprivileged service account. A health-probe pipeline answers an unauthenticated load-balancer check, a demo pipeline round-robin load-balances a real proxied route across two local upstreams, and an administration pipeline gates the REST API behind basic authentication. The administration API and its embedded config store are bound to the loopback interface so they are never exposed to the network directly.

Easegress routes and shapes traffic through pipelines built from composable filters: proxy and load balancing, request and response building, header manipulation, request validation, rate limiting, circuit breaking, retries, and more. Point a pipeline at your own upstreams to place any service behind the gateway. The bundled demo route shows a real request being proxied and round-robin load-balanced across two distinct backends, so the full orchestration path works end to end out of the box.

Easegress fits in front of any HTTP workload. Pair it with an Application Load Balancer or Amazon Route 53 for public ingress, back it with services running on Amazon EC2, Amazon ECS, or Amazon EKS, and terminate TLS at the gateway or upstream. Its declarative objects are managed with egctl or the REST API, so configuration can be version-controlled and applied through your existing automation.

On the first boot of your instance, a one-shot service generates a fresh administration password unique to that instance, stores it as a bcrypt hash for the gateway to validate against, and writes it to a root-only file. No shared or default credential ships in the image, and the gateway's own administration API stays bound to loopback so the only network administration path is the authenticated one.

A team wanting a single point of control in front of an internal API replaces the demo upstreams with their own backends, applies the change with one egctl command, and immediately gets load balancing, health checking, and a place to add rate limiting, retries, and request validation - without writing that logic into every service.

• A reverse proxy and load balancer for self-hosted HTTP services
• An API gateway with rate limiting, circuit breaking, and request validation
• A traffic-shaping layer for canary and blue-green rollouts

Launch the AMI, retrieve the generated admin credential from the root-only file, and call the unauthenticated health endpoint and the demo route to see traffic being proxied and load-balanced. To bring your own service under the gateway, edit the objects file to point the demo pipeline at your upstreams and re-apply it with egctl. The user guide walks through it.

24/7 technical support by email and live chat. Our engineers help with deployment, pipeline and filter configuration, load balancing and health checks, rate limiting and resilience, securing and exposing the administration API, and putting your own services behind the gateway.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.