Streamlit on AWS User Guide

Overview

This image runs Streamlit, the fast, open source Python framework for building and sharing beautiful, interactive data and machine learning apps. You write plain Python scripts and Streamlit turns them into rich web apps with widgets, charts, dataframes and layout, with no front end code required.

Streamlit 1.58.0 is installed into a dedicated Python virtual environment under /opt/streamlit and run by an unprivileged streamlit system account under a systemd service that starts it on boot and restarts it on failure. The application directory, which holds the virtual environment and the app.py you replace with your own app, lives at /opt/streamlit, a dedicated, independently resizable EBS data volume that survives an operating system disk reimage. A polished multi widget demo app ships at /opt/streamlit/app.py so the app is non empty out of the box and you have a working example to learn from.

Streamlit ships with no built in authentication, so the runtime binds to the loopback interface only (127.0.0.1:8501) and is never exposed directly. An nginx reverse proxy publishes the app on port 80 behind HTTP Basic authentication, forwarding the WebSocket upgrade that Streamlit needs to render fully. The admin password is generated on the first boot of every deployed instance, so two instances launched from the same Amazon Machine Image never share a password. It is written to /root/streamlit-credentials.txt with mode 0600 so that only the root user can read it.

Prerequisites

Before you deploy this image you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and port 80 for the Streamlit app
• The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Step 1: Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for Streamlit. Select the cloudimg listing and choose Select, then Continue on the subscription summary.

Pick an instance type of t3.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings select your VPC and subnet, and either create or select a security group that opens port 22 from your management network and port 80 for the Streamlit app. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass; this is when the per instance admin password is generated.

Step 2: Launch the Instance from the AWS CLI

The following block launches an instance from the cloudimg Streamlit Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=streamlit}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name from the EC2 console or with aws ec2 describe-instances.

Step 3: Connect to Your Instance

Connect over SSH using your key pair and the login user for your operating system variant.

ssh -i <key-name>.pem ubuntu@<public-ip>

Step 4: Retrieve the Admin Password

The admin password is unique to your instance and was generated on first boot. Read the credentials file as root:

sudo cat /root/streamlit-credentials.txt

The file lists the app URL, the admin user (admin) and the generated password, along with hints for replacing the demo app and installing extra Python packages. Keep this password somewhere safe.

Step 5: Sign In to the Streamlit App

The Streamlit app is served on port 80 by nginx, which proxies to the runtime on 127.0.0.1:8501 with the WebSocket upgrade Streamlit needs. In a browser, go to:

http://<instance-public-ip>/

You are prompted for credentials by the nginx proxy. Sign in as admin with the password from the credentials file. The bundled demo app then loads, with the sidebar controls on the left, the chart and summary in the centre and an interactive dataframe further down the page.

The demo app is a multi widget showcase. The sidebar holds a row count slider, a series count slider, a random seed input and a chart type selector. Every time you change a control, Streamlit reruns the script and re renders the page. Switch the chart type from Line to Bar to see the chart update instantly.

Scroll down to the Interactive data section to see the underlying pandas DataFrame rendered as a sortable, scrollable table that updates with the sidebar controls.

Step 6: Confirm Streamlit Is Running

Over SSH, confirm the runtime and the nginx proxy are active and that the health endpoint answers:

sudo systemctl is-active streamlit nginx

curl -s http://127.0.0.1:8501/_stcore/health

You should see both services reported as active, and the Streamlit health endpoint returns ok. The runtime listens on 127.0.0.1:8501 (loopback only) and nginx publishes it on port 80 behind the login. The /_stcore/health endpoint is left unauthenticated so external health checks work.

Confirm the installed Streamlit version with:

/opt/streamlit/venv/bin/streamlit version

Step 7: Replace the Demo App with Your Own

The demo app lives at /opt/streamlit/app.py. To go live with your own app, replace that file with your own Streamlit script and restart the service. Copy your file onto the instance (for example with scp), then move it into place and restart:

sudo systemctl restart streamlit.service

After the restart, reload the app in your browser. The service runs streamlit run /opt/streamlit/app.py bound to loopback, so anything you put in app.py is served on port 80 through the same authenticating proxy. Keep the file owned by the streamlit user so the service can read it.

Step 8: Install Extra Python Packages

Streamlit and its dependencies are installed into a dedicated virtual environment at /opt/streamlit/venv. To use additional Python libraries in your app, install them into that same virtual environment so the service picks them up:

sudo /opt/streamlit/venv/bin/pip install --upgrade pip

Then install whatever your app needs, for example sudo /opt/streamlit/venv/bin/pip install plotly altair scikit-learn, and restart the service with sudo systemctl restart streamlit.service. Because the virtual environment lives on the dedicated data volume, your installed packages persist independently of the operating system disk.

Step 9: The Data Volume

The application directory lives on a dedicated EBS volume mounted at /opt/streamlit. This keeps the virtual environment and your app.py off the operating system disk and lets you resize or snapshot them independently. Confirm the mount with:

df -h /opt/streamlit

To grow the application directory, expand the EBS volume in the AWS console, then grow the filesystem on the instance with sudo resize2fs on the underlying device. Because this volume holds both the virtual environment and your app, snapshotting it captures the complete state of your Streamlit deployment.

Step 10: Enable HTTPS

The Streamlit app is served over plain HTTP on port 80 by nginx. For production use, place it behind TLS. Obtain a certificate for your domain (for example with a managed certificate on an Application Load Balancer in front of the instance, or with Certbot installed on the instance), then configure nginx to listen on 443 with your certificate and proxy to 127.0.0.1:8501 exactly as the bundled site does for port 80, keeping the WebSocket upgrade headers and the HTTP Basic authentication in place so the app continues to render. Restrict the security group so ports 80 and 443 are reachable only from the networks that need the app.

Step 11: Backup and Maintenance

Back up your deployment by snapshotting the /opt/streamlit EBS volume, which captures the virtual environment, your installed packages and your app.py. You can also keep your app under version control and redeploy it to a fresh instance. Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade and reboot when a new kernel is installed; Streamlit and nginx start automatically on boot.

Support

This image is published and supported by cloudimg. Support covers deployment, deploying your own app, Python dependency management, the virtual environment, the authenticating proxy, TLS, authentication and performance tuning. Contact cloudimg through the support channel listed on the AWS Marketplace listing.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.