Apache Jena Fuseki 6.2.0 on AWS User Guide

Overview

This guide covers launching and using the Apache Jena Fuseki 6.2.0 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg Hardened Neo4j & Graph and RDF Databases AMIs listing on AWS Marketplace; you pick it as the software version when you subscribe and launch. Every product in the listing is described at /guides/graph-databases-aws/.

Apache Jena Fuseki is the SPARQL server from the Apache Jena project: a standards-compliant RDF triple store that serves the SPARQL 1.1 Query and Update protocols and the SPARQL Graph Store HTTP Protocol over an embedded Jetty web server, with a bundled browser UI for running queries, loading data and managing datasets. The data lives in a persistent TDB2 dataset named /ds. Apache Jena Fuseki is licensed under the Apache License, Version 2.0.

What cloudimg adds to the upstream build:

• No default login, authentication on everything. Every request — the web UI, the /$/ admin API, and every SPARQL query, update, Graph Store and upload endpoint — requires an admin login. On first boot the image generates a unique 24-character admin password for the instance; nothing authenticates until it has. There is no anonymous access except an unauthenticated /healthz load-balancer check.
• HTTPS from the first boot. nginx serves the UI and all endpoints on port 443 with a certificate generated on the instance for its own hostname. Port 80 only redirects to HTTPS, and requests for any other hostname are dropped.
• The server is loopback only. Fuseki itself listens on 127.0.0.1:3030; only SSH, 80 and 443 are reachable from the network. Fuseki runs as an unprivileged service user in a systemd sandbox and cannot reach the instance metadata service.
• Data loading is restricted to the web. SPARQL Update's LOAD and SERVICE can only read http(s) and ftp sources — never local files on the server — as defence in depth (see Security notes).
• Fully patched Ubuntu 24.04 at build time, with per-instance secrets and the cloudimg security defaults.

What is on the image: Ubuntu 24.04 LTS, OpenJDK 21 (Java runtime), Apache Jena Fuseki 6.2.0 in /opt/fuseki, a TDB2 dataset /ds on a dedicated data volume at /var/lib/fuseki, nginx, and the cloudimg first-boot service.

Connecting to your instance

Prerequisites

1. An AWS account and permission to launch EC2 instances
2. An EC2 key pair in the Region you launch in
3. A security group that allows TCP 22 from your own address, and TCP 443 (and optionally 80, which only redirects) from the clients that will use the UI or the SPARQL endpoints. The server port 3030 is never exposed: it listens on loopback only.

Recommended instance type: m5.large (2 vCPU, 8 GiB). The JVM heap defaults to 50% of instance memory; raise the instance size for large graphs.

Step 1: Launch the instance

Option A: AWS Marketplace console

1. Open the cloudimg Hardened Neo4j & Graph and RDF Databases AMIs listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
2. Choose Launch your software, then in Version choose Apache Jena Fuseki 6.2.0 on Ubuntu 24.04 - YYYY-MM-DD and your Region.
3. Instance type: m5.large is recommended.
4. Key pair: choose your EC2 key pair.
5. Security group: TCP 22 from your own address; TCP 443 (and 80) from your clients.
6. Launch. First boot takes about a minute after the instance is reachable, while it generates this instance's certificate and admin password.

Option B: AWS CLI

Run this on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and the key pair, security group and subnet with your own:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=fuseki}]'

The AMI already requires IMDSv2, so you do not need --metadata-options.

Step 2: Connect via SSH

ssh -i my-key-pair.pem ubuntu@<vm-ip>

The login banner shows the Web UI and SPARQL endpoint URLs for this instance.

Step 3: Check the services and health

Confirm Fuseki and nginx are running and the unauthenticated health endpoint answers over HTTPS:

systemctl is-active fuseki.service nginx.service
curl -sk -o /dev/null -w 'healthz: HTTP %{http_code}\n' https://localhost/healthz

Both services report active and /healthz returns HTTP 200 (the nginx-served liveness check; it needs no login).

Step 4: Read the per-instance admin credentials

The admin password is unique to this instance and is written to a root-only file at first boot. Print only the field names and the URLs — never leave the password on screen:

sudo grep -oE '^[A-Z_]+=' /root/fuseki-credentials.txt

This lists FUSEKI_HOST, FUSEKI_URL, FUSEKI_SPARQL_URL, FUSEKI_UPDATE_URL, FUSEKI_ADMIN_USER (admin) and FUSEKI_ADMIN_PASSWORD (the per-instance password). Read the password itself with sudo sed -n 's/^FUSEKI_ADMIN_PASSWORD=//p' /root/fuseki-credentials.txt when you need it, and keep it safe: it unlocks the UI, the admin API and every SPARQL endpoint.

Step 5: The authentication gate

Every endpoint requires the admin login. An anonymous request, or a wrong password, is rejected with 401:

curl -sk -o /dev/null -w 'anonymous UI:        HTTP %{http_code}\n' https://localhost/
curl -sk -o /dev/null -w 'anonymous update:    HTTP %{http_code}\n' -X POST https://localhost/ds/update
curl -sk -u 'admin:wrong-password' -o /dev/null -w 'wrong password:      HTTP %{http_code}\n' 'https://localhost/$/datasets'

Each returns HTTP 401. With the per-instance password the admin API answers 200:

PW=$(sudo sed -n 's/^FUSEKI_ADMIN_PASSWORD=//p' /root/fuseki-credentials.txt)
curl -sk -u "admin:$PW" -o /dev/null -w 'authenticated admin:  HTTP %{http_code}\n' 'https://localhost/$/datasets'

Step 6: Use the web UI

Open https://<public-dns>/ in your browser and sign in as admin with the per-instance password. The certificate is self-signed and unique to this instance, so your browser will warn once; serve the instance under your own DNS name with a trusted certificate for production (Step 8). The dashboard lists the pre-configured /ds dataset with its query, add-data, edit and info actions.

From the UI you can:

• run SPARQL queries against the /ds dataset in the query editor;
• add RDF with the upload panel or SPARQL Update;
• inspect and manage datasets under the admin (/$/) views.

The manage view lists the existing datasets with actions to create, back up or remove them, and a tasks tab for long-running operations:

The info view reports the dataset's endpoints and current statistics:

Step 7: Query and update over SPARQL

The query editor runs SPARQL against /ds directly in the browser, with example queries, prefix helpers and table, response and geo result views:

The dataset /ds serves the standard endpoints: /ds/query, /ds/sparql, /ds/update, /ds/data (Graph Store) and /ds/upload. Load a triple and read it back over HTTPS:

PW=$(sudo sed -n 's/^FUSEKI_ADMIN_PASSWORD=//p' /root/fuseki-credentials.txt)
curl -sk -u "admin:$PW" --data-urlencode \
  'update=INSERT DATA { <http://example/book1> <http://purl.org/dc/elements/1.1/title> "SPARQL Tutorial" }' \
  https://localhost/ds/update
curl -sk -u "admin:$PW" -H 'Accept: application/sparql-results+json' --data-urlencode \
  'query=SELECT ?t WHERE { ?b <http://purl.org/dc/elements/1.1/title> ?t }' \
  https://localhost/ds/query

The query returns the SPARQL Tutorial title you just inserted. Remove the demo triple with DELETE WHERE { <http://example/book1> ?p ?o } through the same /ds/update endpoint.

Step 8: Serve under your own DNS name

Point a DNS record at the instance, then regenerate the certificate and pin the served hostname:

sudo fuseki-set-hostname fuseki.example.com

This issues a new self-signed certificate for that name (replace it with your own CA- or ACM-issued certificate for production) and makes the server answer only for it. For a public, browser-trusted certificate, terminate TLS at an Application Load Balancer or CloudFront in front of the instance and keep the security group's 443 open only to that front.

Security notes

Fuseki 6.2.0 is the latest release at the time of writing. It addresses CVE-2026-61372 (SPARQL Update requests could escape file restrictions). As defence in depth, this image restricts SPARQL Update LOAD and SERVICE to http(s) and ftp sources, and runs the server in a systemd sandbox that cannot read system secrets: an authenticated administrator can load data only from http(s)/ftp sources; the service cannot read system secrets. A LOAD of a local file is refused:

PW=$(sudo sed -n 's/^FUSEKI_ADMIN_PASSWORD=//p' /root/fuseki-credentials.txt)
curl -sk -u "admin:$PW" -o /dev/null -w 'LOAD file:///etc/passwd: HTTP %{http_code}\n' --data-urlencode \
  'update=LOAD <file:///etc/passwd> INTO GRAPH <http://x/g>' https://localhost/ds/update

The server returns HTTP 400 and loads nothing. Keep your instance patched (sudo apt-get update && sudo apt-get upgrade), keep the admin password safe, and expose only ports 22 and 443 to the networks that need them.

Support

cloudimg provides 24/7 technical support for every version in this listing by email and live chat, 365 days a year, with a 24-hour response SLA: support@cloudimg.co.uk.

Trademarks

Apache, Apache Jena and Apache Jena Fuseki are trademarks of the Apache Software Foundation. cloudimg is not affiliated with or endorsed by the Apache Software Foundation.