Sold by: Lynxroute
Deployed on AWS
Free Trial
This product has charges associated with it for hardening, security configuration, and support.
Metabase is a business intelligence and analytics platform that lets a whole team ask questions of company data without writing SQL, running as a Java application with a bundled PostgreSQL database. This Lynxroute build is hardened and ready out of the box: no administrator account shipped in the image so the first person you invite creates it, PostgreSQL application storage instead of the evaluation-only file database, saved data-source credentials encrypted at rest with a key generated on your instance, the application server bound to loopback behind an nginx TLS perimeter, UFW firewall pre-configured, and a CIS Level 1 hardened Ubuntu 24.04 LTS base.
AGPL-3.0 license - fully auditable, no vendor lock-in.
Overview
This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.
WHAT IS METABASE
Metabase is a self-service business intelligence and analytics platform, distributed as a single Java application. Users build questions in a visual query builder without writing SQL, turn them into charts, and assemble dashboards with filters and drill-through, while analysts drop into native SQL, save queries as reusable models, and share results by link, subscription or embedded iframe. Bundled drivers connect it to PostgreSQL, MySQL, SQL Server, ClickHouse, Snowflake, BigQuery, Redshift, MongoDB and many more. Permissions are managed per group down to the table and column level, so one instance serves analysts and read-only business users alike. Metabase stores its own questions, dashboards and users in a PostgreSQL database included in this image. AGPL-3.0 license, no vendor lock-in.
WHAT THIS AMI ADDS
Security hardening:
- No administrator account exists in the image - the setup wizard creates the first administrator, and closes itself permanently once that account exists
- Metabase application data is stored in a bundled PostgreSQL database, not the file database that upstream supports for local evaluation only
- Saved data-source credentials are encrypted at rest with an encryption key generated on your own instance at first launch
- The application server listens on 127.0.0.1 only, reachable through an nginx TLS perimeter; PostgreSQL is bound to 127.0.0.1 only
- HTTPS enabled from launch with a self-signed certificate, and Certbot preinstalled to switch to a CA-signed certificate in one command
- Every credential is generated per instance at first launch, so no two deployments share a secret
- UFW firewall pre-configured - only SSH 22, HTTP 80 and HTTPS 443 reachable
- fail2ban and AppArmor pre-configured
- CVE scan - every image is scanned for vulnerabilities before release
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, SSH hardening, Kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
- License text and a written offer for the corresponding source at /usr/share/doc/lynxroute/LICENSES.txt
Highlights
- Metabase security baked in: no administrator account shipped in the image so the first person you invite creates it, PostgreSQL application storage instead of the evaluation-only file database, saved data-source credentials encrypted at rest with a per-instance key, application server bound to loopback behind an nginx TLS perimeter, UFW firewall pre-configured.
- CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
- Self-service analytics for the whole team: visual query builder, native SQL, dashboards with filters and drill-through, per-group permissions down to the column, and bundled drivers for PostgreSQL, MySQL, SQL Server, ClickHouse, Snowflake, BigQuery and Redshift. AGPL-3.0 license - fully auditable, no vendor lock-in.
Details
Sold by
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.large Recommended | $0.05 |
t3.medium | $0.03 |
m6i.xlarge | $0.05 |
m6i.large | $0.05 |
Dimensions summary
You pay by the hour for the running instance, with the rate set by the AWS EC2 instance size you choose. Four instance sizes are available: t3.medium and t3.large use burstable general-purpose hardware, while m6i.large and m6i.xlarge use fixed-performance general-purpose hardware. Within each family, the larger size gives you more CPU and memory and carries a higher hourly rate. Billing scales with how long each instance runs. All four sizes deliver the same hardened Metabase image, so the choice is about the compute capacity your workload needs.
Top-of-mind questions for buyers
Each hour covers one running EC2 instance of the size you pick. The software charge meters wall-clock time the instance runs. Each of the four sizes maps to a fixed AWS hardware spec, so the CPU and memory you get depend on which size you launch.
The hourly software charge meters running time only. A stopped or powered-off instance does not accrue software charges. You may still pay underlying AWS fees for attached storage while the instance is stopped, but that is separate from the software rate.
No. All four sizes deliver the same hardened Metabase image, built on CIS Level 1 hardened Ubuntu 24.04 LTS. Only the compute capacity and hourly rate change. To scale, stop your instance and relaunch on a size that fits your workload.
lynxroute.com
Helpful?
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Metabase 0.63.2 - Initial release (August 2026)
- Metabase 0.63.2 on Ubuntu 24.04 LTS
- CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
- CVE-scanned before every release
- No administrator account in the image - the setup wizard creates the first administrator and then closes permanently
- Metabase application data stored in a bundled PostgreSQL database
- Saved data-source credentials encrypted at rest with a per-instance key
- Application server bound to 127.0.0.1, nginx TLS perimeter on 443
- HTTPS from launch with a self-signed certificate; Certbot preinstalled
- UFW firewall pre-configured (ports 22, 80, 443 only)
- fail2ban, auditd, AppArmor pre-configured
- SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
- CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
- IMDSv2 enforced
Additional details
Usage instructions
- Launch instance (t3.large recommended, t3.medium minimum)
- Open Security Group - allow TCP 443 from YOUR IP only until you finish step 6
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- Read the instance notes: sudo cat /root/metabase-credentials.txt
- Open https://<PUBLIC_IP>/ in your browser - accept the self-signed certificate warning. The first launch takes 2-4 minutes while the application database initialises; until then the page shows a status screen that refreshes itself
- Complete the setup wizard to create YOUR administrator account, then add your databases from Admin settings, Databases, Add a database
- A Sample Database is included, so you can build a question or a dashboard before connecting any real data source
No administrator password is shipped in this AMI - there is no default account. The first person to reach the setup page becomes the administrator, so keep port 443 restricted to your own address until you have completed step 6. The setup wizard closes permanently once that account exists.
Instance notes, including the bundled PostgreSQL credentials, are saved to /root/metabase-credentials.txt at first launch.
Saved data-source credentials are encrypted at rest with an encryption key generated on your instance. That key is stored in /opt/metabase/metabase.env and is not recoverable - back it up together with your database dumps, or a restored dump cannot decrypt any saved database credential.
Replace the self-signed TLS certificate with a CA-signed certificate for production use: sudo certbot --nginx -d yourdomain.com
Resources
Vendor resources
Support
Vendor support
Visit us online: https://lynxroute.com
For Metabase documentation:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
This product has charges associated with it for technical support with a 24-hour response time. This AMI provides ClickHouse 25.8 LTS on a CentOS Stream 9 minimal installation with the latest updates, repackaged by Easycloud with continuous support.
This product has charges associated with it for seller support. Metabase is an open-source business intelligence (BI) tool that allows users to easily analyze data and create visualizations without needing to write SQL queries. It's designed to be user-friendly, making it accessible to both technical and non-technical users for creating dashboards and generating insights from their data.
Unlock data insights effortlessly with Metabase pre-configured on AWS. Includes Apache2, MySQL, PHP, phpMyAdmin, and Webmin for seamless deployment and management.
This product has charges associated with it for Websoft9 support. Pre-configured, web-based, cloud-native, secure, one-click to deploy Metabase Open Source Edition with Websoft9 Applications Hosting Platform on AWS. Metabase is a user-contributed database of biological databases, used for Data Application and Visualization.
This product has charges associated with it for seller support. Metabase is the easy, open-source way for everyone in your company to ask questions and learn from data.
This product has charges associated with it for seller support. Metabase is open source Business Intelligence (BI) alternative to other propitiatory and closed source solutions like QlikSense, Tableau, Power BI
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.