Sold by: Lynxroute
Deployed on AWS
Free Trial
This product has charges associated with it for hardening, security configuration, and support.
Apache Pulsar is a cloud-native distributed messaging and event-streaming platform that combines publish-subscribe messaging with durable log storage, multi-tenancy and four subscription modes on one broker. This image runs Pulsar in standalone mode - broker, Apache BookKeeper and the metadata store in a single JVM on OpenJDK 21, no cluster to assemble. Upstream ships with authentication and authorization switched off; this Lynxroute build enables JWT token authentication and enforces authorization out of the box, separates a superuser administrator token from the client token handed to applications, exposes clients only over a TLS listener on 6651, and puts the admin REST API behind an nginx TLS perimeter. 100% Apache-2.0 - no proprietary components, no vendor lock-in - on CIS Level 1 hardened Ubuntu 24.04 LTS.
Overview
This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.
WHAT IS APACHE PULSAR
Apache Pulsar is a cloud-native distributed messaging and event-streaming platform maintained by the Apache Software Foundation. It combines publish-subscribe messaging with durable log storage in Apache BookKeeper, and supports multi-tenancy, per-topic subscriptions in four modes (exclusive, shared, failover, key-shared), and both queueing and streaming workloads on the same broker. This image runs Pulsar in standalone mode: the broker, the BookKeeper storage layer and the metadata store all run inside a single JVM on OpenJDK 21 - one instance, no cluster to assemble. The official Apache binary distribution is verified against both the upstream SHA-512 checksum and the ASF detached GPG signature. It contains ONLY the Apache-2.0 licensed distribution - no proprietary add-ons - so it is fully auditable with no vendor lock-in.
WHAT THIS AMI ADDS
Secure by default, not by configuration:
- Token authentication and authorization ENABLED - upstream ships both switched off. JWT authentication is on, authorization is enforced, and a superuser administrator role is kept separate from the ordinary client role handed to applications
- All secrets generated per instance at first boot - the JWT signing key, both tokens and the broker TLS certificate are written to /root/pulsar-credentials.txt (mode 600); nothing sensitive is baked into the image
- Applications connect over pulsar+ssl:// on port 6651 with a token; the plaintext broker port 6650 and the plaintext web port 8080 are reachable only on the instance itself
- The admin REST API sits behind an nginx TLS perimeter on port 443
- Runs as a non-root pulsar system user with UMask 0027, an explicitly pinned JVM heap, and its data on the persistent volume
- UFW firewall pre-configured (only ports 22, 443 and 6651 open)
- certbot pre-installed - one command swaps the self-signed certificate for a CA-signed one
- CVE scan - every image is scanned for vulnerabilities before release
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Highlights
- Pulsar security baked in: upstream ships with authentication and authorization switched off, so this build turns both on, generates the JWT signing key and tokens per instance at first boot, keeps the superuser administrator token separate from the client token given to applications, and exposes clients only over a TLS listener on 6651 with the admin REST API behind nginx TLS on 443.
- CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
- Official Apache Pulsar in standalone mode on OpenJDK 21 - broker, Apache BookKeeper and the metadata store in a single JVM, verified against the upstream checksum and GPG signature. 100% Apache-2.0 - no proprietary components, no vendor lock-in.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.large Recommended | $0.03 |
m6i.2xlarge | $0.05 |
m6i.xlarge | $0.05 |
m6i.large | $0.05 |
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Apache Pulsar 4.2.4 - Initial release (August 2026)
- Apache Pulsar 4.2.4 in standalone mode on Ubuntu 24.04 LTS (OpenJDK 21)
- Broker, Apache BookKeeper and the metadata store in a single JVM
- Distribution verified against the upstream SHA-512 checksum and ASF GPG signature
- JWT token authentication and authorization enabled by default
- Superuser administrator token kept separate from the client token
- All secrets generated per instance at first boot; nothing baked into the image
- TLS client listener on 6651; admin REST API behind nginx TLS on 443
- Plaintext broker port 6650 and web port 8080 not reachable off the instance
- CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
- CVE-scanned before every release
- Runs as non-root pulsar user (UMask 0027); JVM heap set explicitly
- certbot pre-installed for CA-signed TLS certificates
- UFW firewall pre-configured (ports 22, 443, 6651 only)
- fail2ban, auditd, AppArmor pre-configured
- SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
- CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
- IMDSv2 enforced
Additional details
Usage instructions
- Launch instance (t3.large recommended and minimum)
- Open Security Group - allow TCP 443 (admin REST API) and TCP 6651 (Pulsar clients) from your IP
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- Read credentials: sudo cat /root/pulsar-credentials.txt
- Call the admin REST API with the administrator token (accept the self-signed certificate on first use): curl -sk -H "Authorization: Bearer $(sudo cat /var/lib/pulsar/tokens/admin.jwt)" https://<PUBLIC_IP>/admin/v2/clusters
- Connect an application over the TLS listener on 6651 with the client token. A ready-made client configuration is written to /root/pulsar-client.conf - note that pulsar-client reads it from the PULSAR_CLIENT_CONF environment variable, it has no --conf-file flag: sudo env PULSAR_CLIENT_CONF=/root/pulsar-client.conf /opt/pulsar/bin/pulsar-client produce persistent://public/default/demo -m "hello" -n 1 sudo env PULSAR_CLIENT_CONF=/root/pulsar-client.conf /opt/pulsar/bin/pulsar-client consume persistent://public/default/demo -s sub1 -p Earliest -n 1
- Replace the self-signed TLS certificate with a CA-signed one for production: sudo certbot --nginx -d yourdomain.com
Standalone runs the broker, Apache BookKeeper and the metadata store in a single JVM, with data on the persistent volume under /var/lib/pulsar. The plaintext broker port 6650 and the plaintext web port 8080 are bound to the instance and are not exposed. The public IP is bound to the loopback interface so applications running on the same instance can reach the broker at its advertised address.
Retention: Pulsar keeps a message only while a subscription is waiting for it. Create your subscription before publishing, or set a retention policy on the namespace, for example: sudo /opt/pulsar/bin/pulsar-admin --admin-url http://127.0.0.1:8080 --auth-plugin org.apache.pulsar.client.impl.auth.AuthenticationToken --auth-params "token:$(sudo cat /var/lib/pulsar/tokens/admin.jwt)" namespaces set-retention public/default --size 1G --time 24h
Resources
Vendor resources
Support
Vendor support
Visit us online: https://lynxroute.com
For Pulsar documentation:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Unlock the power of data messaging and streaming with StreamNative Cloud on-demand, powered by Apache Kafka® & Apache Pulsar™
This product has charges associated with it for hardening, security configuration, and support.
NATS is a cloud-native messaging system for connecting services, devices and edge systems, shipped here as a single statically linked Go binary with JetStream persistence built in. This Lynxroute build is hardened and ready out of the box: TLS required on the client port, per-instance account passwords generated at first boot and stored as bcrypt hashes, anonymous connections refused, the unauthenticated monitoring endpoint bound to loopback only, JetStream persisted to disk with limits sized to the instance, UFW firewall pre-configured, and a CIS Level 1 hardened Ubuntu 24.04 LTS base.
Apache-2.0 license - fully auditable, no vendor lock-in.
This product has charges associated with it for Websoft9 support. Pre-configured, web-based, cloud-native, secure, one-click to deploy RocketMQ with Websoft9 Applications Hosting Platform on AWS. Apache RocketMQ is a distributed messaging and streaming platform.
Unlock the power of data messaging, cost-effective and ready for the enterprise, powered by Apache Kafka® & Apache Pulsar™
This CentOS Stream 10 image has charges associated with it for seller support and maintenance. CentOS Stream 10 delivers a continuously evolving enterprise Linux platform designed for cloud environments on AWS EC2, providing early visibility into the technologies that shape the next generation of RHEL. As an upstream development track, CentOS 10 Stream allows organizations to build, test, and operate applications on a platform closely aligned with future enterprise releases. This CentOS10 AMI supports fast EC2 instance initialization, integrated cloud-init automation for configuration workflows, and optimized networking using ENA drivers. With SELinux security enforcement and compatibility with the broader RHEL ecosystem, CentOS Stream 10 is well suited for modern application hosting, container platforms, and automated DevOps pipelines. Built, validated, and continuously maintained by ProComputers, this image provides a dependable foundation for scalable AWS infrastructure.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.