Sold by: Systematics
Deployed on AWS
AWS Free Tier
Hardened, ready-to-run Apache Guacamole 1.6 gateway: clientless RDP, VNC, SSH, Telnet and Kubernetes access from any browser, nothing to install on user devices. A first-run setup wizard sets the admin password, MFA, TLS certificate and SSO/LDAP/RADIUS backends. CIS-aligned Ubuntu 24.04, TLS 1.2/1.3, IMDSv2, brute-force protection, session recording and CloudWatch logging. x86_64 and AWS Graviton.
5
Overview
Guacamole Bastion Packaged by Systematics is a hardened, ready-to-run Apache Guacamole 1.6 gateway. Users open a browser and get remote desktop and shell access to RDP, VNC, SSH, Telnet and Kubernetes hosts inside your VPC, with nothing to install on their devices and no inbound ports on the targets.
FIRST-RUN SETUP WIZARD. Launch the instance and open it in a browser. A one-time wizard signs you in as the administrator (the EC2 instance ID is the initial password), requires a new password, and lets you choose from one screen: multi-factor authentication (TOTP), the TLS certificate (self-signed or automatic Let's Encrypt), identity backends (LDAP / Active Directory, SAML 2.0, OpenID Connect, CAS, RADIUS, Duo, client certificates, HTTP-header SSO) and features such as brute-force protection, per-user login restrictions, session recording playback and quick connect. You can upload your own logo and product name for the sign-in screen. The wizard then switches itself off and the standard Guacamole console takes over.
HARDENED FOR AWS MARKETPLACE. Ubuntu 24.04 LTS with CIS-aligned hardening, nginx front end with TLS 1.2/1.3, HSTS and a strict Content-Security-Policy, IMDSv2 only, no default passwords or keys (per-instance database password, forced admin password change), auditd and fail2ban, automatic security updates, and a Syft SBOM with a Grype vulnerability gate on every build. Only 443 (and optionally 80 and 22) listen externally.
COMPLETE GUACAMOLE. Every upstream 1.6 extension is included and can be switched on with one command or in the wizard: TOTP, LDAP, SAML, OpenID, CAS, RADIUS, Duo, SSL client auth, header auth, encrypted JSON auth, quick connect, login restrictions, brute-force ban, session recording storage and playback, display statistics and Keeper Secrets Manager. Recordings and file transfer drives are kept on the instance.
DAY-TWO OPERATIONS. Logs ship to CloudWatch; the OS is managed with AWS Systems Manager Session Manager or SSH; the built-in guacamole-admin CLI handles extensions, properties, certificates, branding and the wizard; documentation is built into the portal at /help/. A CloudFormation template for a single-instance deployment is provided. Available for x86_64 and AWS Graviton (arm64).
Apache Guacamole is an Apache Software Foundation project distributed under the Apache License 2.0; this listing packages, hardens and supports it. Apache Guacamole and the Guacamole logo are trademarks of the Apache Software Foundation.
Highlights
- First-run setup wizard: sign in with the instance ID, set a new password, then switch on MFA, Let's Encrypt TLS, LDAP/SAML/OpenID/RADIUS/Duo backends and features from one screen. No configuration files to edit.
- Hardened by default: CIS-aligned Ubuntu 24.04, TLS 1.2/1.3 with HSTS and CSP, IMDSv2 only, no default passwords, brute-force protection, auditd and fail2ban, automatic security updates, SBOM and vulnerability-gated builds.
- Full Apache Guacamole 1.6 in the browser: RDP, VNC, SSH, Telnet and Kubernetes, session recording with playback, every upstream extension, customer login branding, CloudWatch logging, x86_64 and Graviton.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
If you are an AWS Free Tier customer with a free plan, you are eligible to subscribe to this offer. You can use free credits to cover the cost of eligible AWS infrastructure. See AWS Free Tier for more details. If you created an AWS account before July 15th, 2025, and qualify for the Legacy AWS Free Tier, Amazon EC2 charges for Micro instances are free for up to 750 hours per month. See Legacy AWS Free Tier for more details.
- ...
Dimension | Cost/hour |
|---|---|
t3.medium Recommended | $0.12 |
t2.micro | $0.04 |
t3.micro | $0.04 |
m7a.large | $0.18 |
t2.nano | $0.02 |
c7a.xlarge | $0.30 |
t2.medium | $0.12 |
m6a.large | $0.18 |
c6in.large | $0.18 |
m5a.large | $0.18 |
Dimensions summary
You pay by the hour for Guacamole Bastion, which provides a controlled remote access path to your cloud infrastructure. Pricing is not tiered by features. Instead, each dimension maps to a specific EC2 instance type you choose to run the software on. Your hourly rate depends on that instance's size and family, such as general-purpose, compute-optimized, memory-optimized, storage-optimized, or GPU-accelerated options. Larger or more specialized instances carry higher hourly rates. You scale cost up or down by selecting the instance that fits your performance and capacity needs.
Top-of-mind questions for buyers
Each dimension matches one EC2 instance type running Guacamole Bastion. You pay the software rate per hour for every running instance of that type. The rate reflects the instance size and family, such as general-purpose, compute-optimized, or GPU-accelerated. Running multiple instances means paying each one's hourly rate separately.
The software rate meters running hours only. A fully stopped instance stops accruing the hourly software charge. Underlying AWS storage fees may still apply while the instance is stopped, since those come from AWS infrastructure rather than the software license itself.
Your cost follows the instance type you run. To change it, you move Guacamole Bastion to a different instance type and pay that type's hourly rate instead. Larger or specialized instances carry higher rates. There are no feature tiers, so cost changes come only from the instance you select.
www.systematics.net
Helpful?
Vendor refund policy
No refund policy is applicable.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Updated setup wizard
Additional details
Usage instructions
Launch the AMI in a public subnet with a security group that allows TCP 443 from your users (and TCP 80 if you want automatic Let's Encrypt certificates), and an IAM instance profile with the AmazonSSMManagedInstanceCore policy. About three minutes after launch open https://<public DNS>/ in a browser (a self-signed certificate is used until you choose Let's Encrypt). The first-run setup wizard asks you to sign in as "guacadmin" with the EC2 instance ID (e.g. i-0123456789abcdef0) as the password, to choose a new password, and to decide multi-factor authentication (recommended), the certificate and any LDAP/SAML/OpenID/RADIUS/Duo backends. When it finishes, sign in to Guacamole with your new password (and enrol your authenticator app if you kept MFA on). The console is branded by Systematics; built-in documentation is available in the portal at https://<public DNS>/help/. Administer the operating system over SSH as user "ubuntu" with your key pair, or with AWS Systems Manager Session Manager; run "sudo guacamole-admin --help" for the built-in management CLI. Documentation is on the instance under /usr/share/doc/guacamole-ami/.
Resources
Vendor resources
Support
Vendor support
Free support is provided via support@systematics.net . For free support, we do not provide a guaranteed response time, however we do our best to respond to questions within one business day.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
The ArcGIS products suite includes vast capabilities and is capable of high adjustment and flexibility to suite each customer’s specific needs & configuration.
The ArcGIS products suite includes vast capabilities and is capable of high adjustment and flexibility to suite each customer’s specific needs & configuration.
A production-ready NGINX AMI with HTTPS, self-signed SSL, security headers, rate limiting, Fail2Ban, and UFW pre-configured.
This product has charges associated with it for a pre-configured deployment of ArcGIS Pro (BYOL) - a powerful desktop GIS application which enables creating maps in 2D and 3D, editing and analyzing spatial data and publishing content to the organization enterprise portal. A valid Esri license is required.
Customer reviews
Principal Security Specialist
Stable product with security
Reviewed on Apr 19, 2025
Review from a verified AWS customer
This Guacamole packaging is secure and production ready. Very stable and vulnerability free. many options for customisation. Highly recommended for production usage.