Carbone - Most efficient document generator

• Open port TCP/4000 in your EC2 Security Group (inbound)
• Attach the AWSMarketplaceMeteringFullAccess IAM role to your EC2 instance

Once the instance is booted, check the status endpoint: GET http://<EC2_IP>:4000/status

Upload a template and generate a document: POST http://<EC2_IP>:4000/template POST http://<EC2_IP>:4000/render/:templateId Full API reference: https://carbone.io/documentation/developer/http-api/introduction.html 

---

Set parameters in AWS Systems Manager Parameter Store  using the following prefixes:

• CARBONE_EE_* - Carbone core options (e.g. CARBONE_EE_STUDIO=true to enable Studio)
• CARBONE_S3_* - S3 storage options (e.g. CARBONE_S3_templateS3Bucket)
• CARBONE_PUBKEY - Public key for API authentication

To manage multiple environments, set the EC2 tag CARBONE_CONFIG_PREFIX (e.g. /PROD/).

Required IAM policy:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ["ssm:GetParameter", "ssm:DescribeParameters", "ec2:DescribeTags"], "Resource": "*" } ] }

---

Set the following parameters in AWS Systems Manager:

• CARBONE_S3_templateS3Bucket - Template bucket name
• CARBONE_S3_templateS3BucketRegion - Bucket region
• CARBONE_S3_renderS3Bucket - Render bucket name

Authentication uses the EC2 IAM role. Required S3 policy:

{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": ["s3:PutObject","s3:GetObject","s3:GetObjectAttributes","s3:ListBucket","s3:DeleteObject"], "Resource": ["arn:aws:s3:::my-template-bucket/*", "arn:aws:s3:::my-render-bucket/*"] }] }

---

Attach the CloudWatchAgentServerPolicy to your EC2 IAM role to enable automatic log export to CloudWatch. No additional configuration required.

---

API authentication is disabled by default. Enable it for any production deployment: https://carbone.io/on-premise.html#server-authentication 

---

Set CARBONE_EE_STUDIO=true in AWS Systems Manager. Studio is a visual template designer accessible directly from your browser.

---

Carbone auto-detects its base path when served behind a reverse proxy or an AWS ALB under a subpath (e.g. <https://mydomain.com/carbone>). No additional configuration needed.

Full deployment guide: https://carbone.io/documentation/developer/self-hosted-deployment/deploy-on-aws.html