Apache RocketMQ Messaging and Streaming

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Apache RocketMQ - Production-Ready Distributed Messaging Platform AMI

Deploy a fully configured, low-latency messaging and streaming platform on AWS in minutes - not hours. This AMI delivers Apache RocketMQ preinstalled and running as managed system services so you can start publishing and consuming messages immediately after launch.

### Why This AMI Instead of a DIY Install or Managed Service

• Versus manual EC2 setup: Skip the hours of downloading the release, tuning JVM heaps, wiring up systemd units, provisioning a data disk, and hardening the web console. This image handles all of that at launch.
• Versus rolling your own broker: Get a correctly ordered NameServer, Broker and Dashboard topology out of the box, with the message store on a dedicated data disk and the broker advertised address set correctly on first boot so remote clients connect without hand-editing configuration.
• Versus other community AMIs: Benefit from a hardened first-boot process that generates a unique Dashboard password per instance (no shared or default credentials), a web console gated behind an authenticating reverse proxy, and 24/7 professional support from cloudimg.

### Application Stack

• Apache RocketMQ installed under /opt/rocketmq, run by a dedicated unprivileged service account
• Headless OpenJDK Java runtime with JVM heaps tuned for the instance
• NameServer routing registry and Broker message store started and ordered by systemd, restarting on failure
• Message store (commitlog, consume queues and index) on a dedicated EBS data disk - independently resizable for IOPS and capacity
• RocketMQ Dashboard web console fronted by an nginx reverse proxy on port 80 with HTTP Basic authentication

### Messaging and Streaming Capabilities

The NameServer listens on 9876 as the routing registry; the Broker listens on 10911 for producers and consumers. Point your RocketMQ clients at the instance on those ports and start publishing and consuming. RocketMQ supports normal, ordered, scheduled/delayed and transactional messages, publish-subscribe topics with consumer groups, and message trace - suitable for event streaming, asynchronous decoupling and reliable task processing at scale.

### Security

Secure First Boot: A one-shot service generates a fresh Dashboard password unique to each instance, writes it to the nginx credentials store and a root-only file, and sets the broker advertised address. No shared or default web credentials ship in the image.

Authenticated Web Console: The RocketMQ Dashboard binds to loopback only and is published on port 80 through an nginx reverse proxy that enforces HTTP Basic authentication, so the console is never exposed unauthenticated.

Encryption at Rest: The dedicated data disk holding the message store can leverage AWS EBS encryption. Enable EBS encryption when launching the instance or use encrypted snapshots.

Network Isolation: Deploy the platform in a private VPC subnet and use security groups to restrict access to only the ports your clients require (9876, 10911, 80).

### Web Management Console

The RocketMQ Dashboard is served on port 80 through nginx. Sign in with the generated credentials to inspect the cluster, topics and consumer groups, browse and send messages, view message trace, and monitor broker health and throughput.

### Use Cases

• E-commerce order processing: An order placement event triggers inventory reservation, payment capture, and shipment scheduling via transactional messages - ensuring exactly-once delivery across services handling thousands of orders per second.
• Event streaming and log/metric pipelines at high throughput for DevOps and platform teams.
• Asynchronous decoupling of microservices with durable topics and consumer groups, ideal for teams running containerized workloads on ECS or EKS.
• Reliable task processing with ordered and scheduled/delayed messages for fintech settlement workflows and logistics dispatch systems.

### Evaluation Path

Launch this AMI on a small instance type to evaluate the platform with minimal AWS infrastructure cost. The NameServer, Broker and Dashboard are fully functional on any supported instance size, letting you validate connectivity, console access and message flow before scaling up for production workloads.

### Architecture Overview

The AMI runs three systemd-managed services in dependency order: NameServer starts first as the routing registry, then the Broker registers and begins accepting producer/consumer connections, and finally the Dashboard provides web-based cluster management. An nginx reverse proxy sits in front of the Dashboard on port 80, enforcing HTTP Basic authentication.