CloudBeaver CE 26.2.4 on AWS User Guide

Overview

This guide covers launching and using the CloudBeaver CE 26.2.4 on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg database admin and backup tools listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

CloudBeaver Community Edition is the open source web database manager from the DBeaver team. From a browser your team gets a SQL editor with autocompletion and execution plans, a data viewer and editor (filter, sort, edit rows, import and export CSV, JSON, Excel and more), ER diagrams and a navigator over schemas, tables, views and procedures, for PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, Db2, ClickHouse, Amazon Redshift and many other databases over JDBC, directly or through an SSH tunnel. Administrators manage the connections and decide which users and teams may use them, so nobody needs a database client or the database password on their laptop.

The cloudimg image is a hardened, ready-to-use CloudBeaver server:

• The upstream release, without a container runtime. The image runs the official CloudBeaver CE 26.2.4 server, taken from the upstream dbeaver/cloudbeaver:26.2.4 image by digest (every layer hash checked), directly on the operating system as the cloudbeaver service account. There is no Docker. The installation in /opt/cloudbeaver is root-owned and read-only for the service.
• A current Java runtime. CloudBeaver runs on Amazon Corretto 25 (25.0.5, with the October 2026 Java security updates) from Amazon's signed APT repository, instead of the older Java runtime bundled in the upstream image. Corretto is kept up to date by unattended upgrades. One library with a published advisory (Guava, CVE-2026-102554) is raised to the fixed release 33.7.2; nothing else in CloudBeaver is changed.
• HTTPS from the first boot. nginx serves CloudBeaver on 443 with a certificate generated on your instance (an end-entity certificate, not a certificate authority). Port 80 redirects to HTTPS. The server's name is set from the instance's EC2 public DNS name at first boot, and requests for any other name are dropped. You can change it to your own domain.
• No default login, no anonymous access. First boot completes CloudBeaver's setup with exactly one administrator, cbadmin, with a random password unique to your instance. Anonymous access is off, sign-in failures are rate limited and locked out after 10 attempts, and passwords need at least 12 characters with mixed case and a digit.
• CloudBeaver on the loopback address only. CloudBeaver listens on 127.0.0.1:8978 (and an instance-control port on 127.0.0.1), and a firewall rule lets only nginx (and root) connect to them. nginx passes CloudBeaver the real client address from the TCP connection (never a header a client sends), limits API requests per client address, and refuses cross-site requests to the API (protection against cross-site request forgery and cross-site WebSocket hijacking).
• Closed by default. Users cannot create their own private connections until you allow it, file-based database drivers (H2, SQLite, DuckDB) are disabled so nobody can open a file on the server as a database, and header-based ("reverse proxy") sign-in is off.
• An access list. The whole web UI and API can be limited to your own networks in one file (Step 10).
• Metadata service blocked. CloudBeaver, nginx and the first-boot service cannot reach the EC2 instance metadata service, so a database connection or SSH tunnel pointed at it fails. The AMI requires IMDSv2.
• Fully patched Ubuntu 24.04 LTS at build time, with unattended security upgrades switched on.

What is on the image: CloudBeaver CE 26.2.4 (Apache-2.0), Amazon Corretto 25, nginx, nftables, cloud-init and the AWS Systems Manager agent, all from Ubuntu 24.04 except CloudBeaver and Corretto.

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large (2 vCPUs, 8 GiB)

Prerequisites

• An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet.
• A security group that allows TCP 22 (SSH) from your own networks only, TCP 443 from wherever your users are, and TCP 80 (redirects to HTTPS). Never open 8978: nothing listens on it off the instance.
• Network access from the instance to the databases you want to manage (for example, allow this instance's security group on your Amazon RDS security group's database port).
• For production, a DNS name you control (for example db.example.com) and, ideally, a certificate from a certificate authority. Until then the instance uses its EC2 public DNS name with its own self-signed certificate.

Connecting to your instance

Step 1: Launch the instance

Launch from the AWS Marketplace page (choose the CloudBeaver CE 26.2.4 on Ubuntu 24.04 version), or with the AWS CLI using the AMI ID shown on the listing's launch page:

aws ec2 run-instances --image-id ami-xxxxxxxxxxxxxxxxx --instance-type m5.large \
  --key-name my-key --security-group-ids sg-xxxxxxxx --subnet-id subnet-xxxxxxxx \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=cloudbeaver}]'

First boot takes about a minute: it creates CloudBeaver's workspace and embedded database, the administrator and the certificate. The web UI stays offline until that has finished.

Step 2: Connect to your instance

ssh -i my-key.pem ubuntu@<public-ip>

Step 3: Check the services

systemctl is-active cloudbeaver.service nginx.service cloudbeaver-guard.service
sudo ss -ltnp | awk 'NR==1 || /:(22|80|443|8978) |java/'

active
active
active
State  Recv-Q Send-Q      Local Address:Port  Peer Address:PortProcess
LISTEN 0      511               0.0.0.0:443        0.0.0.0:*    users:(("nginx",pid=9505,fd=7),("nginx",pid=9504,fd=7),("nginx",pid=9503,fd=7))
LISTEN 0      511               0.0.0.0:80         0.0.0.0:*    users:(("nginx",pid=9505,fd=5),("nginx",pid=9504,fd=5),("nginx",pid=9503,fd=5))
LISTEN 0      4096              0.0.0.0:22         0.0.0.0:*    users:(("sshd",pid=893,fd=3),("systemd",pid=1,fd=118))
LISTEN 0      50     [::ffff:127.0.0.1]:40633            *:*    users:(("java",pid=9352,fd=96))
LISTEN 0      511                  [::]:443           [::]:*    users:(("nginx",pid=9505,fd=8),("nginx",pid=9504,fd=8),("nginx",pid=9503,fd=8))
LISTEN 0      511                  [::]:80            [::]:*    users:(("nginx",pid=9505,fd=6),("nginx",pid=9504,fd=6),("nginx",pid=9503,fd=6))
LISTEN 0      4096                 [::]:22            [::]:*    users:(("sshd",pid=893,fd=4),("systemd",pid=1,fd=121))
LISTEN 0      50     [::ffff:127.0.0.1]:8978             *:*    users:(("java",pid=9352,fd=117))

Only SSH, HTTP and HTTPS listen on the network. CloudBeaver's web port (8978) and its instance-control port (a random port chosen at every start, 40633 here) are on 127.0.0.1 only ([::ffff:127.0.0.1] is how Java's sockets show 127.0.0.1).

Step 4: Get your address and the administrator password

First boot writes everything that is unique to your instance to a file only root can read:

sudo cat /root/cloudbeaver-credentials.txt

# CloudBeaver CE 26.2.4 - written on first boot by cloudbeaver-firstboot.service. Unique to this instance. Keep it secret.
CLOUDBEAVER_URL=https://ec2-18-234-161-18.compute-1.amazonaws.com/
CLOUDBEAVER_TLS_SHA256=D9:D0:0E:F6:39:8A:3B:0E:BA:B2:8F:EA:E9:A4:32:16:C9:E7:C6:90:78:EB:B6:42:B7:31:C9:0D:D8:99:68:F1
CLOUDBEAVER_ADMIN_USER=cbadmin
CLOUDBEAVER_ADMIN_PASSWORD=<24 random letters and digits>
...

• CLOUDBEAVER_URL is your CloudBeaver address.
• CLOUDBEAVER_TLS_SHA256 is the fingerprint of the instance's own certificate. Your browser will warn that the certificate is not trusted; compare the fingerprint it shows with this one before you continue. Replace it with a certificate from a certificate authority for your own name when you can (Step 11).
• CLOUDBEAVER_ADMIN_USER / PASSWORD sign in to CloudBeaver. This is the only account.

Step 5: Run the self-test

The image includes an end-to-end test that signs in over HTTPS as the administrator, creates a throwaway user and checks that it can sign in but cannot see the user list, writes, reads back and deletes a SQL script, and then removes the throwaway user:

sudo cloudbeaver-selftest

round trip OK: cbadmin signed in (ADMINISTRATOR), user selftest-6891fa71 signed in (user, denied the user list), script cloudimg-selftest-65c197e4.sql written + read back + deleted on https://ec2-18-234-161-18.compute-1.amazonaws.com/
CLOUDBEAVER_SELFTEST_OK

Step 6: Sign in

Open CLOUDBEAVER_URL in your browser, check the certificate fingerprint, and sign in as cbadmin with the password from Step 4:

After signing in you see the start page and the (empty) connection navigator:

Change the administrator password first: click cbadmin at the top right, open the Authentication tab, click Change password and set a new password (at least 12 characters, mixed case and a digit). Then delete the credentials file, or keep it somewhere safe: sudo shred -u /root/cloudbeaver-credentials.txt.

Step 7: Connect to a database

Click New Connection and choose the database type:

Enter the host (for example your Amazon RDS endpoint), port, database, user and password, click Test and then Create. To reach a database on a private network through a bastion host, open the SSH tab of the connection and configure an SSH tunnel. The JDBC drivers for the common databases are included in the image.

Connections that an administrator creates are shared: you choose who may use them on the Connections access tab of each user or team in Administration > Users and Teams (Step 8). Users cannot add their own private connections unless you switch on Enable private connections in Administration > Server Configuration.

Step 8: Add users for your team

Open Administration (the gear icon at the top right) > Users and Teams, click Create and give each person their own account; add them to teams, and on the Connections access tab choose the connections they may use:

New users are in the user team (no administration rights). Give a second person the admin team only if they need to manage the server.

Step 9: Server configuration

Administration > Server Configuration shows the server settings:

• Allowed Server URLs is the instance's configured name. Change it with cloudbeaver-set-hostname (Step 11), which also updates nginx and the certificate, rather than here.
• Force HTTPS mode is not needed: CloudBeaver is only reachable through nginx over HTTPS, and its session cookie is already marked Secure, HttpOnly and SameSite=Lax.
• AI Integration adds an AI assistant to the SQL editor. It does nothing until an administrator configures an AI provider and API key under Administration > AI Settings; the requests then go from this instance to that provider.

Step 10: Restrict CloudBeaver to your networks

The whole web UI and API use the access list in /etc/nginx/cloudimg/cloudbeaver-access.conf. By default it is allow all;. To allow only your own networks, replace it with your addresses and a final deny all; (keep 127.0.0.1 so the self-test and local monitoring still work):

sudo tee /etc/nginx/cloudimg/cloudbeaver-access.conf >/dev/null <<'EOF'
allow 127.0.0.1;
allow 203.0.113.0/24;
allow 198.51.100.7;
deny all;
EOF
sudo nginx -t && sudo systemctl reload nginx

Everyone else then gets 403 Forbidden for every page and API call, whatever the spelling of the path; a path with a ; is refused outright. You can also restrict TCP 443 in the security group if CloudBeaver serves only an internal network.

Step 11: Use your own domain and certificate

Point a DNS name at the instance (an Elastic IP is a good idea), then:

sudo cloudbeaver-set-hostname <your-domain>

This makes the name CloudBeaver's allowed server URL, renders nginx for it (the instance's other names redirect to it), creates a new self-signed certificate for it and updates the URL and fingerprint in /root/cloudbeaver-credentials.txt. CloudBeaver restarts, so signed-in users sign in again. To use a certificate from a certificate authority, replace /etc/ssl/cloudbeaver/cloudbeaver.crt and cloudbeaver.key (keep the key 0600 root) and run sudo systemctl reload nginx.

Step 12: Check the security posture

systemctl show -p IPAddressDeny cloudbeaver.service
sudo nft list table inet cloudimg_cloudbeaver_guard
sudo -u nobody curl -s -m 5 -o /dev/null -w 'CloudBeaver port 8978 from another local user: %{http_code}\n' http://127.0.0.1:8978/status || true
curl -s -m 5 -o /dev/null -w 'metadata service without a token: %{http_code}\n' http://169.254.169.254/latest/meta-data/ || true
curl -s http://127.0.0.1/status; echo

IPAddressDeny=::ffff:169.254.169.254/128 168.63.129.16/32 fd00:ec2::254/128 169.254.169.254/32
table inet cloudimg_cloudbeaver_guard {
    chain output {
        type filter hook output priority filter; policy accept;
        oifname "lo" tcp dport { 8978, 32768-60999 } ct state new meta skuid != { 0, 33, 997 } counter packets 4 bytes 240 reject with tcp reset
    }
}
CloudBeaver port 8978 from another local user: 000
metadata service without a token: 401
{"health":"ok","product.name":"CloudBeaver Community","product.version":"26.2.4.202611021133"}

• IPAddressDeny is the metadata-service block on the CloudBeaver service; nginx and the first-boot service have the same one. Every database connection, connection test and SSH tunnel runs inside the CloudBeaver service, so none of them can reach the metadata service.
• The nftables rule lets only root (0), nginx (www-data, 33) and CloudBeaver itself connect to CloudBeaver's loopback ports.
• http://127.0.0.1/status is CloudBeaver's health endpoint for a monitoring agent on the instance. It is not served on 443.

CloudBeaver's configuration is /etc/cloudbeaver/cloudbeaver.conf (rendered by cloudbeaver-set-hostname from /usr/local/lib/cloudimg/cloudbeaver/cloudbeaver.conf.tmpl; readable by root and the cloudbeaver service account only). Its logs go to the journal: sudo journalctl -u cloudbeaver.

Step 13: Passwords and secrets

• The administrator password is in /root/cloudbeaver-credentials.txt until you change it and remove the file (Step 6). CloudBeaver stores only a salted hash.
• CloudBeaver's embedded database (users, teams, permissions and the saved connections) has its own password, generated on first boot and kept in the workspace, /var/lib/cloudbeaver/workspace (readable by the cloudbeaver account only). Saved database passwords are encrypted in the workspace.
• The TLS key is in /etc/ssl/cloudbeaver/cloudbeaver.key (root only).
• No secret is on any command line, in a systemd unit or in a log.

Step 14: Your data and backups

Everything CloudBeaver stores (users, teams, connections, saved credentials, scripts) is in its workspace, /var/lib/cloudbeaver/workspace. Stop CloudBeaver briefly and archive it to a file only root can read:

sudo systemctl stop cloudbeaver
sudo sh -c 'umask 077; tar -C /var/lib/cloudbeaver -czf /var/backups/cloudbeaver-$(date +%F).tar.gz workspace'
sudo systemctl start cloudbeaver
sudo ls -l /var/backups/cloudbeaver-*.tar.gz

-rw------- 1 root root 37559 Nov  7 13:11 /var/backups/cloudbeaver-2026-11-07.tar.gz

The archive holds the saved database credentials and the embedded database password: store it encrypted and off the instance (for example in an S3 bucket with encryption and restricted access). EBS snapshots of the instance are a simple way to keep point-in-time copies of the whole server.

Step 15: Updates

Ubuntu security updates and Amazon Corretto updates install automatically (unattended upgrades; CloudBeaver picks up a new Java runtime when it restarts). New CloudBeaver releases are published as new versions of this listing: launch the new version and move your workspace across with the backup from Step 14.

Step 16: Licences and source

ls /usr/share/doc/cloudimg-cloudbeaver/
sed -n '3,4p' /usr/share/doc/cloudimg-cloudbeaver/BUILD-INFO

BUILD-INFO
LICENSE-cloudbeaver-Apache-2.0.txt
SOURCE-OFFER.txt
Upstream: CloudBeaver Community 26.2.4 (github.com/dbeaver/cloudbeaver, branch release_26_2_4), product
  io.cloudbeaver.product.ce, plugins 26.2.4.202611021133. Taken from the official image by DIGEST (no container runtime):

CloudBeaver is licensed under the Apache License 2.0. BUILD-INFO records the exact upstream image digests, the one library change (Guava 33.7.2) and the Java runtime; SOURCE-OFFER.txt says where to get the source of the GPL-licensed components (Amazon Corretto is GPL-2.0 with the Classpath Exception).

Step 17: Security notes

• Advisories. CloudBeaver 26.2.4 is the current release and includes the fixes for every published CloudBeaver advisory, among them an LDAP filter injection (GHSA-pc2c-mv8m-7fwv, rated high) and a server-side request forgery in connection testing (GHSA-8wwr-2cv6-q65q), both fixed in 26.1.3. A scan of its bundled libraries reports the Guava issue fixed in this image (CVE-2026-102554), a copy of Guava inside the GraphQL library that is not reachable from any request, and lower-rated issues in the MariaDB driver and the logging library that do not affect this configuration.
• Java compiler. Amazon Corretto ships only as a full JDK, so javac is present; nothing on the image uses it.
• Outbound requests. CloudBeaver connects to the databases, SSH hosts and AI provider that administrators configure. Those connections cannot reach the EC2 metadata service.

Support

cloudimg provides support for this image by e-mail at support@cloudimg.co.uk. CloudBeaver itself is documented at https://dbeaver.com/docs/cloudbeaver/.