Sold by: Lynxroute
Deployed on AWS
Free Trial
This product has charges associated with it for hardening, security configuration, and support.
Ory Hydra is an OpenID Certified OAuth 2.0 and OpenID Connect provider, paired here with Ory Kratos for identity and user management - two Go services wired together, with the official Ory login and consent UI and a bundled PostgreSQL 17. This Lynxroute build is hardened and ready out of the box: every secret generated on your own instance at first launch, both administrative APIs bound to the loopback interface, self-registration that closes itself after the first account, an HTTPS perimeter with a per-instance certificate, UFW firewall pre-configured, and a CIS Level 1 hardened Ubuntu 24.04 LTS base.
Apache-2.0 license - fully auditable, no vendor lock-in.
Overview
This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.
WHAT IS ORY
Ory is an open-source identity stack. This AMI runs two of its servers wired together so they behave as one product. Ory Hydra is an OpenID Certified OAuth 2.0 and OpenID Connect provider written in Go: it issues access, refresh and ID tokens for your applications and supports the authorization code, client credentials, refresh, device and token-exchange flows, publishing a standard discovery document and JWKS. Hydra holds no user accounts of its own by design. Ory Kratos supplies them - registration, login, account settings, TOTP two-factor, recovery codes and session management, all API-first. The official Ory reference user interface renders the login, registration, settings and consent screens for both, so an application points at one discovery URL and is done. Accounts, OAuth2 clients, tokens and sessions persist in a bundled PostgreSQL 17, with a separate database and role per service. Apache-2.0 license, no vendor lock-in.
WHAT THIS AMI ADDS
Security hardening:
- No credentials in the image - both database passwords, the token-signing and cookie secrets and the encryption key are generated on your own instance at first launch and written to /root/ory-credentials.txt
- Both administrative APIs bound to 127.0.0.1 only - Ory ships them without authentication by design, so they are also blocked in the firewall and never exposed through the HTTPS perimeter
- Self-registration closes itself once the first account exists, so nobody else can claim your identity server
- Database schemas are migrated on the instance at first launch, before either service starts
- HTTPS perimeter on 443 with a per-instance certificate generated at first launch; Certbot pre-installed for a CA-signed one
- PostgreSQL 17 bound to 127.0.0.1 only, scram-sha-256, no trust rule
- Login and consent screens cannot be framed (X-Frame-Options DENY)
- Anonymous usage reporting switched off in both services
- CVE scan - every image is scanned for vulnerabilities before release
- UFW firewall - only 22, 80 and 443 open; every Ory service port and PostgreSQL blocked
- fail2ban, AppArmor
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, SSH hardening, Kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
SIGN-IN METHODS
On by default: passwords, authenticator-app two-factor and single-use recovery codes. Passkeys and WebAuthn are enabled by the included ory-set-domain command once you point a domain name at the instance - the WebAuthn standard requires a domain and does not accept an IP address. Email login codes, account recovery and email verification need an SMTP server of your own; social sign-in needs your own provider credentials.
Highlights
- Ory security baked in: every secret generated on your own instance at first launch with nothing baked into the image, both administrative APIs bound to the loopback interface and blocked in the firewall, self-registration that closes itself after the first account is created, and PostgreSQL reachable only from localhost.
- CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
- Standards-based single sign-on for your own applications: OpenID Certified OAuth 2.0 and OpenID Connect, with user accounts, two-factor authentication and the login and consent screens included. Apache-2.0 license - fully auditable, no vendor lock-in.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.large Recommended | $0.05 |
t3.medium | $0.03 |
m6i.xlarge | $0.05 |
m6i.large | $0.05 |
Dimensions summary
You pay by the hour for the EC2 instance size you choose to run this hardened image. Four instance options are available: t3.medium, t3.large, m6i.large, and m6i.xlarge. Each represents a different compute and memory capacity, so your rate scales with the instance you select. Larger instances suit heavier workloads, while smaller ones fit lighter needs. These are independent choices, not tiers with different features. All four deliver the same software image, so pick based on the compute capacity your deployment requires. Billing runs hourly through AWS Marketplace with no upfront commitment.
Top-of-mind questions for buyers
Each option maps to an EC2 instance size. The t3 sizes are burstable, general-purpose instances suited to lighter or variable loads. The m6i sizes are steady-state, general-purpose instances with more consistent compute and memory. You choose based on the compute and memory your deployment needs.
Software charges meter running instance-hours only. A stopped or powered-off instance does not accrue hourly software charges. Underlying AWS storage fees for the attached volume may still apply while the instance is stopped. Only running time triggers the hourly software rate.
Every instance runs the same hardened Ubuntu 24.04 LTS image with the identity server software. It ships CIS Level 1 hardening, a CycloneDX SBOM, a CIS Conformance Report, and unique credentials generated at first boot. The image content is identical across all four sizes; only compute capacity differs.
lynxroute.com
Helpful?
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Ory 26.2.0 - Initial release (August 2026)
- Ory Hydra 26.2.0 and Ory Kratos 26.2.0 on Ubuntu 24.04 LTS - an OpenID Certified OAuth 2.0 and OpenID Connect provider paired with identity and user management, wired together so the identity server drives the OAuth2 login and consent screens
- Includes the official Ory reference login UI, serving registration, login, account settings, consent and logout on the same origin as the API
- Bundled PostgreSQL 17 with a separate database and role per service - a complete self-contained deployment, no external database required
- Database schemas are migrated on this instance at first launch, before either service starts
- CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
- CVE-scanned before every release
- No credentials baked into the image - every secret, both database passwords and the per-instance TLS certificate are generated at first launch and written to /root/ory-credentials.txt
- Self-registration closes automatically once the first account is created
- Both administrative APIs bound to the loopback interface and blocked externally, as Ory documents
- HTTPS perimeter on 443 with a per-instance certificate generated at first launch
- PostgreSQL bound to 127.0.0.1 only and blocked externally in the firewall
- Login and consent screens cannot be framed (X-Frame-Options DENY)
- Anonymous usage reporting switched off in both services
- Certbot pre-installed for a trusted certificate in one command
- ory-set-domain moves the instance onto your own hostname so the OpenID Connect issuer follows, and enables passkeys
- UFW firewall pre-configured (ports 22, 80, 443 only)
- fail2ban, auditd, AppArmor pre-configured
- SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
- CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
- IMDSv2 enforced
Additional details
Usage instructions
- Launch instance (t3.large recommended)
- Open Security Group - allow TCP 443 and TCP 80 from your IP, and TCP 22 for SSH
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- Read the getting-started file: sudo cat /root/ory-credentials.txt
- Open https://<PUBLIC_IP>/registration in your browser - accept the self-signed certificate warning - and create the first account. It is yours, and public sign-up closes automatically once it exists
- Register your first application: sudo hydra create client --endpoint http://127.0.0.1:4445 --name "My App" --grant-type authorization_code,refresh_token --response-type code --scope openid,offline_access --redirect-uri https://myapp.example.com/callback
- Point your application at https://<PUBLIC_IP>/.well-known/openid-configuration
Restrict port 443 to your own address until you have created that first account - whoever reaches the registration page first claims it.
Move the instance onto your own hostname before registering applications: sudo ory-set-domain idp.example.com. The hostname is the OpenID Connect issuer and is embedded in every token, so changing it later invalidates them. The same command enables passkeys, which the WebAuthn standard requires a domain for.
Both administrative APIs (Hydra on 4445, Kratos on 4434) are bound to localhost and are not reachable from the network - Ory ships them without authentication, so they are administered over SSH.
Sign-in methods on by default: passwords, authenticator-app two-factor and single-use recovery codes. Email login codes, account recovery and email verification need an SMTP server of your own; social sign-in needs your own provider credentials.
All generated secrets and both database passwords are saved to /root/ory-credentials.txt at first launch. Back up that file - the encryption keys in it are needed to read a database backup.
Replace the self-signed TLS certificate with a CA-signed certificate for production use: sudo certbot --nginx -d yourdomain.com
Resources
Vendor resources
Support
Vendor support
Visit us online: https://lynxroute.com
For Ory Hydra documentation:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
ORI is an end-to-end customer experience company focusing on quicker, better, cost-effective, and Conversational AI-enabled customer journeys to create innovative brand experiences, by leveraging Machine Learning and Artificial intelligence. ORI is leading the way into the future of human-machine conversations that mimic human interactions and works closely with enterprises on two major fronts - cost optimization and revenue acceleration. ORI develops completely connected, cognitive, multilingual, omnichannel bots through the application of design thinking principles, and leading technologies, thereby enabling enterprises to exponentially improve the customer experience, even while optimising costs.
![DialoGLUE: A Natural Language Understanding Benchmark for Task-Orie[...]](https://d1ewbp317vsrbd.cloudfront.net/99bef72e-e6e0-4e7e-a24b-b068cfbef716.png)
This bucket contains the checkpoints used to reproduce the baseline results reported in the DialoGLUE benchmark hosted
on EvalAI (https://evalai.cloudcv.org/web/challenges/challenge-page/708/overview). The associated scripts for using the checkpoints are located here:
https://github.com/alexa/dialoglue. The associated paper describing the benchmark and checkpoints is here: https://arxiv.org/abs/2009.13570.
The provided checkpoints include the CONVBERT model, a BERT-esque model trained on a large open-domain conversational
dataset. It also includes the CONVBERT-DG and BERT-DG checkpoints described in the linked
paper.
The Web Hosting service under the category of Platform as a Service (PaaS) offer a cloud service that provides a platform and environment for hosting web applications, allowing Orión to take care of the hardware, networking and operating system.
Ethical Hacking focuses on detecting vulnerabilities that can affect company assets on AWS Cloud. Orión's Ethical Hacking process is centered on thoroughly conducting security tests following the international OWASP testing methodology.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.