Trusted Images - Valkey 9.1 Cluster Mode on Debian 12 AMI

This AMI is maintained by Trusted Images and includes open source software packages for the target operating system.

Valkey 9.1 Cluster Mode on Debian 12 provides a maintained AMI for teams that want a hardened Valkey base image with cluster mode enabled and published evidence artifacts. The image starts as a single localhost-bound Valkey node with cluster slots assigned locally. It is intended as a secure, evidence-backed starting point for operators who will intentionally configure multi-node topology, authentication, TLS or private networking, persistence, backups, monitoring, and EC2 security groups for their deployment.

What's included:

• Valkey 9.1.0 built from the official upstream source tag with pinned SHA256 verification.
• Valkey cluster mode enabled and bootstrapped on localhost for local service verification.
• TCP listener configured on localhost by default so remote access requires deliberate operator configuration.
• Protected mode enabled.
• Systemd service hardening with a dedicated unprivileged user, restricted writable paths, private temporary directory, and no Linux capabilities.
• Monthly rebuild cadence applies Debian package updates and refreshes supply-chain and hardening evidence.
• Package inventory, SBOM, root filesystem scan, and runtime hardening evidence captured for supported AMI versions.

Security hardening: The image keeps Valkey network exposure conservative by default. Remote application access and production multi-node clustering require the operator to review /etc/valkey/valkey.conf, configure ACLs or password authentication, configure TLS or private networking where required, assign cluster topology across instances, and open only the necessary VPC security group paths. The image does not include prebuilt credentials, TLS certificates, external monitoring, backups, a separately attached data volume, or a managed high-availability service. The image makes no claim of complete vulnerability absence, formal benchmark certification, cryptographic module validation, or regulated compliance certification.

Patch and rebuild cadence: Trusted Images rebuilds supported AMIs monthly and when security updates require an out-of-band rebuild. Supported AMI versions include source checks, package inventory, SBOM data, root filesystem scan results, and runtime hardening checks.

Launch and configuration basics: Launch the AMI in a private subnet or controlled VPC security group. Confirm the service with systemctl status valkey and test local health with valkey-cli -h 127.0.0.1 -p 6379 ping. Confirm cluster mode with valkey-cli -h 127.0.0.1 -p 6379 cluster info. Persistent files use the root volume under /var/lib/valkey unless the operator moves data to a separately managed volume.

Support: Trusted Images provides email support for image packaging, rebuild, hardening evidence, and Valkey-on-Debian configuration questions. Support does not include application code development, custom migrations, custom cluster operations, or continuous operations.

Trusted Images is not affiliated with, endorsed by, or sponsored by LF Projects, the Linux Foundation, or the Valkey project maintainers.