Sold by: Lynxroute
Deployed on AWS
Free Trial
This is a repackaged open source software product wherein additional charges apply for hardening, security configuration, and setup support.
Apache Pulsar is a cloud-native distributed messaging and event-streaming platform that combines publish-subscribe messaging with durable log storage, multi-tenancy and four subscription modes on one broker. This image runs Pulsar in standalone mode - broker, Apache BookKeeper and the metadata store in a single JVM on OpenJDK 21, no cluster to assemble. Upstream ships with authentication and authorization switched off; this Lynxroute build enables JWT token authentication and enforces authorization out of the box, separates a superuser administrator token from the client token handed to applications, exposes clients only over a TLS listener on 6651, and puts the admin REST API behind an nginx TLS perimeter. 100% Apache-2.0 - no proprietary components, no vendor lock-in - on CIS Level 1 hardened Ubuntu 24.04 LTS.
Overview
This is a repackaged open source software product wherein additional charges apply for hardening, security configuration, and setup support.
WHAT IS APACHE PULSAR
Apache Pulsar is a cloud-native distributed messaging and event-streaming platform maintained by the Apache Software Foundation. It combines publish-subscribe messaging with durable log storage in Apache BookKeeper, and supports multi-tenancy, per-topic subscriptions in four modes (exclusive, shared, failover, key-shared), and both queueing and streaming workloads on the same broker. This image runs Pulsar in standalone mode: the broker, the BookKeeper storage layer and the metadata store all run inside a single JVM on OpenJDK 21 - one instance, no cluster to assemble. The official Apache binary distribution is verified against both the upstream SHA-512 checksum and the ASF detached GPG signature. It contains ONLY the Apache-2.0 licensed distribution - no proprietary add-ons - so it is fully auditable with no vendor lock-in.
WHAT THIS AMI ADDS
Secure by default, not by configuration:
- Token authentication and authorization ENABLED - upstream ships both switched off. JWT authentication is on, authorization is enforced, and a superuser administrator role is kept separate from the ordinary client role handed to applications
- All secrets generated per instance at first boot - the JWT signing key, both tokens and the broker TLS certificate are written to /root/pulsar-credentials.txt (mode 600); nothing sensitive is baked into the image
- Applications connect over pulsar+ssl:// on port 6651 with a token; the plaintext broker port 6650 and the plaintext web port 8080 are reachable only on the instance itself
- The admin REST API sits behind an nginx TLS perimeter on port 443
- Runs as a non-root pulsar system user with UMask 0027, an explicitly pinned JVM heap, and its data on the persistent volume
- UFW firewall pre-configured (only ports 22, 443 and 6651 open)
- certbot pre-installed - one command swaps the self-signed certificate for a CA-signed one
- CVE scan - every image is scanned for vulnerabilities before release
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Highlights
- Pulsar security baked in: upstream ships with authentication and authorization switched off, so this build turns both on, generates the JWT signing key and tokens per instance at first boot, keeps the superuser administrator token separate from the client token given to applications, and exposes clients only over a TLS listener on 6651 with the admin REST API behind nginx TLS on 443.
- CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
- Official Apache Pulsar in standalone mode on OpenJDK 21 - broker, Apache BookKeeper and the metadata store in a single JVM, verified against the upstream checksum and GPG signature. 100% Apache-2.0 - no proprietary components, no vendor lock-in.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.large Recommended | $0.03 |
m6i.2xlarge | $0.05 |
m6i.xlarge | $0.05 |
m6i.large | $0.05 |
Dimensions summary
You pay by the hour based on the EC2 instance size you run. The four options map to different compute and memory capacities: t3.large, m6i.large, m6i.xlarge, and m6i.2xlarge. The m6i family scales up from large to xlarge to 2xlarge, so you select higher capacity as your messaging and streaming workload grows. Each option runs the same hardened image, so pricing differs only by the underlying instance resources you choose. Billing is usage-based and handled through AWS Marketplace, with charges tied to the hours each instance runs.
Top-of-mind questions for buyers
Each option is an EC2 instance size with set compute and memory. The t3.large is a smaller general-purpose instance. The m6i options scale from large to xlarge to 2xlarge, adding vCPUs and memory at each step. You pick the size matching your workload.
The software fee meters running instance-hours. A fully stopped instance does not accrue software charges. Stopped instances may still incur underlying AWS storage fees for attached volumes, but the hourly software charge applies only while the instance runs.
Every option runs the same hardened image on the same Ubuntu base. Each ships with CIS Level 1 OS hardening, a CVE scan, a software bill of materials, and a conformance report. Unique credentials are generated at first boot. Pricing differs only by instance resources, not features.
lynxroute.com
Helpful?
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Apache Pulsar 4.2.5
- Apache Pulsar updated 4.2.4 -> 4.2.5, a patch release. Apache-2.0 unchanged
- Security: dependency fixes including lz4-java CVE-2026-59949, gRPC GHSA-hrxh-6v49-42gf, Netty 4.1.138, BouncyCastle 1.85, Jackson, Avro and log4j
- Bundled ZooKeeper 3.9.6 and BookKeeper 4.17.4
- Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build
Additional details
Usage instructions
- Launch instance (t3.large recommended and minimum)
- Open Security Group - allow TCP 443 (admin REST API) and TCP 6651 (Pulsar clients) from your IP
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- Read credentials: sudo cat /root/pulsar-credentials.txt
- Call the admin REST API with the administrator token (accept the self-signed certificate on first use): curl -sk -H "Authorization: Bearer $(sudo cat /var/lib/pulsar/tokens/admin.jwt)" https://<PUBLIC_IP>/admin/v2/clusters
- Connect an application over the TLS listener on 6651 with the client token. A ready-made client configuration is written to /root/pulsar-client.conf - note that pulsar-client reads it from the PULSAR_CLIENT_CONF environment variable, it has no --conf-file flag: sudo env PULSAR_CLIENT_CONF=/root/pulsar-client.conf /opt/pulsar/bin/pulsar-client produce persistent://public/default/demo -m "hello" -n 1 sudo env PULSAR_CLIENT_CONF=/root/pulsar-client.conf /opt/pulsar/bin/pulsar-client consume persistent://public/default/demo -s sub1 -p Earliest -n 1
- Replace the self-signed TLS certificate with a CA-signed one for production: sudo certbot --nginx -d yourdomain.com
Standalone runs the broker, Apache BookKeeper and the metadata store in a single JVM, with data on the persistent volume under /var/lib/pulsar. The plaintext broker port 6650 and the plaintext web port 8080 are bound to the instance and are not exposed. The public IP is bound to the loopback interface so applications running on the same instance can reach the broker at its advertised address.
Retention: Pulsar keeps a message only while a subscription is waiting for it. Create your subscription before publishing, or set a retention policy on the namespace, for example: sudo /opt/pulsar/bin/pulsar-admin --admin-url http://127.0.0.1:8080 --auth-plugin org.apache.pulsar.client.impl.auth.AuthenticationToken --auth-params "token:$(sudo cat /var/lib/pulsar/tokens/admin.jwt)" namespaces set-retention public/default --size 1G --time 24h
Resources
Vendor resources
Support
Vendor support
Visit us online: https://lynxroute.com
For Pulsar documentation:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Unlock the power of data messaging and streaming with StreamNative Cloud on-demand, powered by Apache Kafka® & Apache Pulsar™
Unlock the power of data messaging, cost-effective and ready for the enterprise, powered by Apache Kafka® & Apache Pulsar™
Automatically launch a containerized Apache Pulsar Standalone container in seconds. Apache Pulsar is an open-source all-in-one messaging and streaming platform equipped for high throughput and low latency workloads.
Stream enables developers to build rich, scalable in-app messaging, activity feeds, live video, and moderation with minimal effort. It includes feature-rich SDKs, pre-built UI components, and powerful moderation tools. Designed for performance at scale, Stream supports everything from 1:1 messaging to group calling to For-You-Feeds to large-scale livestreams with enterprise-grade reliability.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.