Apache Doris on AWS User Guide

Overview

Apache Doris is an easy-to-use, high-performance, unified analytical (OLAP) database for real-time analytics at scale. It uses a massively parallel processing (MPP) architecture and a columnar storage engine to answer interactive sub-second queries over very large datasets, and it speaks the MySQL network protocol so any MySQL client, BI tool or application driver connects to it without change. The cloudimg image installs Apache Doris from the official Apache binary release and runs it as a ready-to-use single-node cluster: one Frontend (FE) and one Backend (BE), started by systemd and restarted on failure, so an analytical database is accepting queries within minutes of launch. Backed by 24/7 cloudimg support.

The Frontend is a Java service (OpenJDK 17) that handles SQL parsing, planning and metadata; the Backend is a native C++ engine that stores the data and executes query fragments. On a single instance the FE and BE run together as a complete, working cluster. Doris speaks the MySQL protocol on the query port 9030, and the Frontend ships a built-in HTTP console and health endpoint on port 8030.

What is included:

• Apache Doris (Apache-2.0), installed from the official Apache binary release and SHA-512 verified
• A single-node MPP cluster of one Frontend (FE) and one Backend (BE), run by systemd as doris-fe and doris-be
• OpenJDK 17 for the Frontend; the required Backend kernel tuning (max_map_count, swap off, THP off, file limits)
• A unique per instance database root password generated on first boot (no shared default credential)
• FE metadata and BE storage on a dedicated, independently resizable data volume at /var/lib/doris
• 24/7 cloudimg support

This is a database product. The Frontend serves the MySQL protocol on 9030 and the HTTP console on 8030, but the security group created by the Marketplace defaults opens port 22 only. The database ports are not exposed to the internet by default. Reach them over an SSH tunnel or open them in your own security group for trusted networks.

Prerequisites

Before you deploy this image you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network
• A MySQL command-line client (or any MySQL-compatible client or BI tool) on the machine you connect from
• The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Step 1: Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for Apache Doris by cloudimg. Select the cloudimg listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.xlarge (4 vCPU / 16 GiB RAM) or larger, because the Doris Backend needs memory. Choose your EC2 key pair under Key pair (login). Under Network settings select your VPC and subnet, and either create or select a security group that allows inbound port 22 from your management network only. No inbound application ports are needed because the database is reached over an SSH tunnel by default.

Select Launch instance. First boot initialisation starts the Frontend and Backend, registers the Backend with the Frontend, and generates the database root password. The Frontend Java service takes a little time to start, so allow a couple of minutes after the instance is running before the database accepts queries.

Step 2: Launch the Instance from the AWS CLI

Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens port 22 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.xlarge \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=apache-doris-01}]'

Retrieve the public address once the instance is running with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Step 3: Connect to your Instance

Connect over SSH with the key pair you selected. The SSH login user depends on the operating system of the AMI variant you launched:

ssh -i <path-to-key>.pem rocky@<instance-public-ip>

A welcome banner prints the most useful commands. The Frontend and Backend run as the system services doris-fe and doris-be.

Step 4: Confirm the cluster is running

systemctl is-active doris-fe doris-be

You should see both services active:

active
active

The dedicated data volume holds the FE metadata and BE storage at /var/lib/doris:

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/lib/doris

Step 5: Retrieve your per instance database password

Each instance generates its own unique Doris root password on first boot and writes it to a root-only credentials file:

sudo cat /root/apache-doris-credentials.txt

The file lists the query host and port, the root user, the generated password, and the Frontend HTTP console URL. It is mode 0600 and owned by root. Store the password in your secrets manager. In the commands below, <DORIS_ROOT_PASSWORD> stands for the value of doris.root.password.

Step 6: Connect over the MySQL protocol

Apache Doris speaks the MySQL network protocol, so any MySQL client connects unchanged. Connect on the query port 9030 as root with the per instance password and check the version and the cluster backends:

mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SELECT VERSION();"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SHOW BACKENDS;"

SHOW BACKENDS lists the single Backend with Alive = true, confirming the BE is registered with the FE and the cluster is serving. A wrong password is rejected with Access denied, so the database is never open without the credential.

Step 7: Run SQL

Doris uses standard SQL over the MySQL protocol. Create a database and a table, insert rows, and run an aggregation:

mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "CREATE DATABASE IF NOT EXISTS demo;"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "USE demo; CREATE TABLE IF NOT EXISTS events (id INT, kind VARCHAR(32), ts DATETIME) DISTRIBUTED BY HASH(id) BUCKETS 1 PROPERTIES('replication_num'='1');"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "USE demo; INSERT INTO events VALUES (1,'login',NOW()),(2,'click',NOW()),(3,'click',NOW());"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SELECT kind, COUNT(*) AS n FROM demo.events GROUP BY kind ORDER BY kind;"

+-------+------+
| kind  | n    |
+-------+------+
| click |    2 |
| login |    1 |
+-------+------+

Doris supports the Stream Load, Broker Load, Routine Load and INSERT interfaces for loading data, Duplicate / Aggregate / Unique key tables with automatic partitioning and bucketing, materialized views, a cost-based optimizer and vectorized execution.

Step 8: Check the Frontend health and console

The Frontend exposes an HTTP bootstrap health endpoint and a built-in web console on port 8030. Confirm the FE is healthy and list the Frontend node:

curl -s http://127.0.0.1:8030/api/bootstrap
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SHOW FRONTENDS;"

The bootstrap endpoint returns {"msg":"success","code":0,"data":{"status":"OK"...}}. To open the web console in a browser, tunnel port 8030 (see Step 9) and visit http://localhost:8030.

Step 9: Connect remotely over an SSH tunnel

The Frontend ports 9030 (MySQL protocol) and 8030 (HTTP console) are bound on the instance but not exposed publicly by default, which is the secure default. To reach the database from your workstation, open an SSH tunnel and point a local MySQL client at localhost:9030:

# On your workstation:
ssh -i <path-to-key>.pem -L 9030:127.0.0.1:9030 -L 8030:127.0.0.1:8030 rocky@<instance-public-ip>

# In another terminal, with a local mysql client:
mysql -h 127.0.0.1 -P 9030 -uroot -p

For BI tools and applications, point any MySQL driver at the tunnelled localhost:9030. For production remote access without a tunnel, open ports 9030 and 8030 in your security group only for trusted source ranges, or keep the instance on a private subnet. Never expose the database ports to the open internet.

Maintenance

• Persistence: the FE metadata directory and the BE storage directory both live on the dedicated data volume at /var/lib/doris, so the database survives reboots and the volume is independently resizable.
• Password: rotate the root password from a mysql session with SET PASSWORD FOR 'root' = PASSWORD('<new-password>');.
• Tuning: the FE config is /opt/apache-doris/fe/conf/fe.conf and the BE config is /opt/apache-doris/be/conf/be.conf. Raise the FE JVM heap and the BE mem_limit on a larger instance and restart with sudo systemctl restart doris-fe doris-be.
• Scaling: this is a single-node cluster (one FE + one BE). Doris scales horizontally by adding Backends; contact cloudimg support for multi-node topologies.
• Security patches: automatic security updates remain enabled so the OS continues to receive security patches.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.

Apache Doris and Apache are trademarks of the Apache Software Foundation. MySQL is a trademark of Oracle Corporation. This image is provided by cloudimg and is not affiliated with or endorsed by the Apache Software Foundation or Oracle Corporation.