Base for Red Hat JBoss EAP 8.1 on AWS User Guide

Overview

This guide covers launching and using the Base for Red Hat JBoss EAP 8.1 on Rocky Linux 8 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg Hardened AMIs for Red Hat JBoss EAP 8.1: RHEL-Compatible Bases listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

This image contains no Red Hat software and includes no Red Hat subscription. It is a hardened, fully patched Rocky Linux 8 (RHEL-compatible) server prepared for Red Hat JBoss Enterprise Application Platform (JBoss EAP) 8.1. You install JBoss EAP 8.1 yourself, with your own active Red Hat subscription that includes JBoss EAP, using the installer helper on the image. The helper downloads JBoss EAP from Red Hat with your Red Hat service account, checks it against the SHA-256 checksum Red Hat publishes, and applies cloudimg's hardened configuration. Your Red Hat credentials are used once and never stored. JBoss EAP then runs under the terms of your agreement with Red Hat; cloudimg supports the image.

Red Hat support scope. Rocky Linux is compatible with Red Hat Enterprise Linux but is a separate distribution, and Red Hat's published supported configurations for JBoss EAP 8.1 list Red Hat Enterprise Linux, not Rocky Linux. Before you rely on Red Hat support for JBoss EAP on this image, check Red Hat's JBoss EAP 8 Supported Configurations article and your subscription terms, or ask your Red Hat account team.

The cloudimg image adds:

• An installer helper, cloudimg-install-jboss-eap. It downloads JBoss EAP 8.1 from the Red Hat Downloads API with your Red Hat service account (the same API Red Hat's own Ansible collection for JBoss EAP uses), or installs a zip you downloaded from the Red Hat Customer Portal, verifies the checksum, unpacks it into /opt/jboss-eap and starts it as a systemd service.
• HTTPS on port 8443 from the moment EAP is installed. First boot creates a TLS key and certificate unique to your instance, for its public DNS name, inside a PKCS12 keystore with its own password. The helper wires it into EAP's HTTPS listener (TLS 1.2 and 1.3) and removes the default keystore that EAP ships with the password password.
• A management password unique to your instance. First boot generates the password of the EAP management user admin and writes it to /root/jboss-eap-credentials.txt (readable by root only). No password is baked into the image.
• Management on localhost only. The management console and CLI (ports 9990 and 9993), the plain HTTP listener (8080) and every other EAP socket listen on 127.0.0.1. Only HTTPS 8443 is reachable from the network; you reach the console through an SSH tunnel.
• No demo content. The welcome page and the example H2 datasource (ExampleDS, user sa) are removed.
• Hardened defaults. EAP runs as the unprivileged jboss user in a systemd sandbox that can write only its standalone directory, and the server code belongs to root. The jboss user is blocked from the instance metadata service (169.254.169.254), so an application flaw cannot be turned into a theft of instance role credentials; the AMI requires IMDSv2. SELinux stays enforcing, the firewall allows only SSH and 8443, SSH is key only with root login disabled, and the kernel and network settings are hardened.
• Fail closed. The EAP service refuses to start until first boot has created the keystore and the password and EAP has been installed by the helper with its per instance administrator.
• Fully patched Rocky Linux 8.10 at build time, with daily automatic security updates (they also keep OpenJDK patched).

What is on the image: Rocky Linux 8.10, OpenJDK 21 (java-21-openjdk-headless, a JDK that JBoss EAP 8.1 supports), firewalld, cloud-init, the AWS Systems Manager agent and the cloudimg tools. /opt/jboss-eap is empty until you install JBoss EAP.

Default user: rocky · Architecture: x86_64 · Recommended instance type: m5.large

Prerequisites

• An active Red Hat subscription that includes Red Hat JBoss Enterprise Application Platform, and a Red Hat service account in that organisation (a client ID and client secret, created in Step 5). Without them the image can still be launched and hardened, but JBoss EAP cannot be downloaded. If you need an open source Jakarta EE server with no subscription, use WildFly from the cloudimg Java application servers listing.
• An AWS account subscribed to the listing, an EC2 key pair and a subnet with outbound HTTPS to the internet (the instance downloads EAP from sso.redhat.com and api.access.redhat.com).
• A security group that allows TCP 22 (SSH) and TCP 8443 (your applications over HTTPS) from your own networks only. Never open 9990, 9993 or 8080.

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick Base for Red Hat JBoss EAP 8.1 on Rocky Linux 8 as the software version and your Region, then Launch through EC2. Choose m5.large (or larger for your applications), your key pair and a security group as above.

With the AWS CLI (replace the values in angle brackets):

aws ec2 run-instances --image-id <ami-id> --instance-type m5.large \
  --key-name <your-key-pair> --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=jboss-eap-81}]'

Step 2: Connect over SSH

ssh -i <your-key.pem> rocky@<public-ip>

The login message names the image and the installer helper.

Step 3: Check first boot and your instance's values

First boot runs once, within a minute of launch. It creates the management password, the keystore password and the HTTPS keystore:

sudo systemctl status jboss-eap-firstboot --no-pager | head -4
sudo grep -oE '^[A-Z_]+=' /root/jboss-eap-credentials.txt
sudo grep -E '^JBOSS_EAP_(HOSTNAME|HTTPS_URL|ADMIN_USER|MANAGEMENT_URL|TLS_STORE|STATUS)=' /root/jboss-eap-credentials.txt

Example output:

● jboss-eap-firstboot.service - cloudimg Base for Red Hat JBoss EAP: per-instance management password and HTTPS keystore
   Loaded: loaded (/etc/systemd/system/jboss-eap-firstboot.service; enabled; vendor preset: disabled)
   Active: active (exited) since Tue 2026-10-20 11:16:47 UTC; 1min 47s ago
 Main PID: 9718 (code=exited, status=0/SUCCESS)
JBOSS_EAP_HOSTNAME=
JBOSS_EAP_HTTPS_URL=
JBOSS_EAP_ADMIN_USER=
JBOSS_EAP_ADMIN_PASSWORD=
JBOSS_EAP_MANAGEMENT_URL=
JBOSS_EAP_TLS_STORE=
JBOSS_EAP_KEYSTORE_PASSWORD=
JBOSS_EAP_STATUS=
JBOSS_EAP_HOSTNAME=ec2-100-58-201-223.compute-1.amazonaws.com
JBOSS_EAP_HTTPS_URL=https://ec2-100-58-201-223.compute-1.amazonaws.com:8443/
JBOSS_EAP_ADMIN_USER=admin
JBOSS_EAP_MANAGEMENT_URL=http://127.0.0.1:9990/
JBOSS_EAP_TLS_STORE=/etc/cloudimg/jboss-eap/tls/server.p12
JBOSS_EAP_STATUS=not installed - run: sudo cloudimg-install-jboss-eap

The host name comes from the instance's EC2 metadata (public DNS name, else public IP, else private IP), never from a request. To use your own DNS name, see Step 9. Print the management password only when you need it: sudo grep '^JBOSS_EAP_ADMIN_PASSWORD=' /root/jboss-eap-credentials.txt | cut -d= -f2-.

Step 4: Run the preflight check

The preflight check needs no credentials. It confirms first boot, the keystore, Java, the firewall, SELinux, free disk space and that the instance can reach Red Hat:

sudo cloudimg-install-jboss-eap --preflight

Preflight (cloudimg Base for Red Hat JBoss EAP 8.1):
  PASS  first boot completed (per-instance password and keystore)
  PASS  per-instance HTTPS keystore /etc/cloudimg/jboss-eap/tls/server.p12 opens with its own password
  PASS  OpenJDK 21 (21.0.12.1)
  PASS  jboss system user present
  PASS  firewalld active, 8443/tcp open
  PASS  SELinux enforcing
  PASS  6452 MiB free for /opt/jboss-eap
  PASS  Red Hat SSO reachable (sso.redhat.com, HTTP 401 without credentials)
  PASS  Red Hat Downloads API reachable (api.access.redhat.com, HTTP 401 without credentials)

If a Red Hat endpoint fails, allow outbound HTTPS (TCP 443) to sso.redhat.com and api.access.redhat.com in your network ACLs, proxy or NAT gateway.

sudo cloudimg-install-jboss-eap --status
java -version 2>&1 | head -1
getenforce

JBoss EAP: not installed (/opt/jboss-eap is empty). Run: sudo cloudimg-install-jboss-eap --preflight
HTTPS:     https://ec2-100-58-201-223.compute-1.amazonaws.com:8443/   management: http://127.0.0.1:9990/ (loopback only)
openjdk version "21.0.12.1" 2026-08-18 LTS
Enforcing

Step 5: Create a Red Hat service account

The helper authenticates to Red Hat with a service account of the Red Hat organisation that holds your JBoss EAP subscription:

1. Sign in to the Red Hat Hybrid Cloud Console at console.redhat.com as an organisation administrator.
2. Open the Service Accounts page (from the gear icon, under Identity & Access Management) and choose Create service account. Give it a name such as eap-downloads-aws.
3. Copy the Client ID and Client secret. Red Hat shows the secret only once.

The service account belongs to the organisation that holds the JBoss EAP subscription and must be allowed to download its software; your organisation administrator manages its access in User Access. Red Hat documents service accounts and their use with its downloads in the Hybrid Cloud Console help and in the README of its redhat.eap Ansible collection. Delete or rotate the service account when you no longer need it.

Step 6: Install JBoss EAP 8.1 with your subscription

Option A: answer two prompts (recommended). The secret is not echoed, and it never reaches your shell history:

sudo cloudimg-install-jboss-eap
# Red Hat service account client ID: <your-client-id>
# Red Hat service account client secret (hidden): <your-token>

Option B: a credentials file. Create a root-only file, put the two values in it with an editor, and pass it to the helper. The helper refuses a file other users can read and shreds it after reading (add --keep-credentials-file to keep it):

sudo install -m 600 /dev/null /root/rh-service-account.txt
sudo vi /root/rh-service-account.txt
#   client_id=<your-client-id>
#   client_secret=<your-token>
sudo cloudimg-install-jboss-eap --credentials-file /root/rh-service-account.txt

Option C: a zip you downloaded yourself. Download Red Hat JBoss Enterprise Application Platform 8.1.0 (jboss-eap-8.1.0.zip) from the Red Hat Customer Portal (Downloads, JBoss Enterprise Application Platform, version 8.1), note the SHA-256 checksum shown on the download page, copy the zip to the instance and install it:

scp -i <your-key.pem> jboss-eap-8.1.0.zip rocky@<public-ip>:/tmp/
sudo cloudimg-install-jboss-eap --archive /tmp/jboss-eap-8.1.0.zip --sha256 <sha256-from-portal>
rm -f /tmp/jboss-eap-8.1.0.zip

To see which EAP 8.1 files your subscription can download, run sudo cloudimg-install-jboss-eap --list, and pick one with --file-name.

What the helper does, in order:

1. Exchanges your service account for a short-lived access token at sso.redhat.com. The token stays in memory and is sent only to Red Hat hosts.
2. Finds jboss-eap-8.1.0.zip in the Red Hat Downloads API, downloads it and compares its SHA-256 with the checksum Red Hat publishes for it. A mismatch deletes the file and stops.
3. Checks that the archive is JBoss EAP 8.1 and unpacks it into /opt/jboss-eap (server code owned by root, runtime directories owned by jboss).
4. Applies cloudimg's configuration to standalone.xml with the JBoss CLI: the HTTPS listener on 0.0.0.0:8443 uses your instance's keystore (TLS 1.2 and 1.3); the public and management interfaces are pinned to 127.0.0.1; EAP's default keystore, the welcome content and ExampleDS are removed; web service WSDL addresses use your configured host name over HTTPS.
5. Creates the management user admin with the password from /root/jboss-eap-credentials.txt.
6. Enables and starts jboss-eap.service, and checks that HTTPS answers and that the management interface accepts the password.

If Red Hat does not accept the service account, the helper stops before downloading anything and prints, for example:

ERROR: Red Hat SSO refused the service account (invalid_client: Invalid client or Invalid client credentials). Check the client ID and secret at console.redhat.com -> Service Accounts; nothing was downloaded or stored.

Step 7: Use JBoss EAP

After the install, check the service and the listeners:

sudo cloudimg-install-jboss-eap --status
sudo systemctl status jboss-eap --no-pager | head -5
sudo ss -ltn

Only port 22 and port 8443 listen on the network; 8080, 9990 and the other EAP ports listen on 127.0.0.1.

Your applications over HTTPS. From your computer (the certificate is self-signed for your instance, so a browser shows a warning until you add your own certificate, see Step 9):

curl -k https://<public-dns-name>:8443/

A fresh server answers 404 Not Found because the welcome page is removed. Deploy an application by copying it into the deployments directory as the jboss user, or with the management CLI:

sudo install -o jboss -g jboss -m 0640 myapp.war /opt/jboss-eap/standalone/deployments/
sudo /opt/jboss-eap/bin/jboss-cli.sh --connect --controller=127.0.0.1:9990 --command="deployment-info"

The management console. Open an SSH tunnel from your computer, then browse to http://localhost:9990/ and sign in as admin with the password from /root/jboss-eap-credentials.txt:

ssh -i <your-key.pem> -L 9990:127.0.0.1:9990 rocky@<public-ip>

Settings. JVM options go in /etc/sysconfig/jboss-eap (for example JAVA_OPTS="-Xms1g -Xmx2g"), followed by sudo systemctl restart jboss-eap. The server runs standalone.xml. To change the HTTPS port or open the HTTP listener, edit the configuration with the JBoss CLI and open the port in both your security group and firewalld (sudo firewall-cmd --permanent --add-port=<port>/tcp && sudo firewall-cmd --reload).

Step 8: Keep EAP and the operating system patched

• Rocky Linux and OpenJDK: dnf-automatic installs security updates daily. Run sudo dnf -y upgrade for all updates, and restart EAP after a Java update (sudo systemctl restart jboss-eap).
• JBoss EAP: apply Red Hat's EAP 8.1 updates as described in Red Hat's guide Updating Red Hat JBoss Enterprise Application Platform (the management CLI installer update commands or the jboss-eap-installation-manager), with your subscription.

Step 9: Use your own host name or certificate

To issue the instance certificate for your own DNS name (for example after pointing a Route 53 record at the instance), run:

sudo cloudimg-jboss-eap-tls --hostname eap.example.com

The tool records the name in /etc/cloudimg/jboss-eap-hostname, mints a new key and certificate into the keystore and, when EAP is installed, restarts it and updates the WSDL host. To use a certificate from your own certificate authority, import it into a PKCS12 keystore and point the cloudimgKS key store in standalone.xml at it, or put an Application Load Balancer with an AWS Certificate Manager certificate in front of port 8443.

Firewall and security model

sudo firewall-cmd --list-services
sudo firewall-cmd --list-ports
sudo ss -ltn
systemctl show -p UnitFileState jboss-eap

dhcpv6-client ssh
8443/tcp
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0      128          0.0.0.0:22        0.0.0.0:*
LISTEN 0      128             [::]:22           [::]:*
UnitFileState=disabled

jboss-eap.service stays disabled until the helper installs EAP. The jboss user cannot reach the instance metadata service: firewalld rejects its traffic to 169.254.169.254, and the service unit also carries IPAddressDeny for it. If an application genuinely needs AWS credentials, give it explicit credentials (or a sidecar) rather than relaxing this rule.

Uninstall or reinstall

sudo cloudimg-install-jboss-eap --uninstall stops and disables the service and removes /opt/jboss-eap, including deployments and data, and returns the instance to its base state. Your keystore and management password stay, so you can install again.

Troubleshooting

• first boot has not completed: check sudo journalctl -u jboss-eap-firstboot. The instance needs IMDSv2 to read its host name, or a name in /etc/cloudimg/jboss-eap-hostname.
• Red Hat SSO refused the service account: the client ID or secret is wrong, or the service account was deleted. Create a new secret in the Hybrid Cloud Console.
• the Red Hat Downloads API refused this service account: the organisation's subscription does not include JBoss EAP, or the account cannot download it. Ask your Red Hat account team, or use Option C with a zip from the Customer Portal.
• jboss-eap start refused: the service refuses to start without first boot, an install by the helper and a per instance administrator; the message names what is missing.
• The service does not start after you edited the configuration: sudo journalctl -u jboss-eap -n 100 and /opt/jboss-eap/standalone/log/server.log.

Support

cloudimg provides 24/7 support for this image (launch, first boot, the installer helper, networking and hardening) by email and live chat at support@cloudimg.co.uk. Questions about JBoss EAP itself, its updates and your subscription go to Red Hat under your subscription.

Red Hat, JBoss and Red Hat JBoss Enterprise Application Platform are trademarks of Red Hat, Inc., used here only to describe compatibility. Rocky Linux is a trademark of the Rocky Enterprise Software Foundation. cloudimg is not affiliated with or endorsed by Red Hat, Inc. or the Rocky Enterprise Software Foundation.