Apicurio Registry Schema & API Registry

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Apicurio Registry - Schema and API Registry AMI

Deploy a fully configured Apicurio Registry on AWS in minutes - not hours. Apicurio Registry is a popular open source runtime registry and datastore for API definitions and event schemas. It stores and serves Avro, Protobuf, JSON Schema, OpenAPI, AsyncAPI, GraphQL and WSDL/XSD artifacts through a REST API, a Confluent-compatible Schema Registry API and a React web interface, so producers and consumers across your event-streaming and API estate can share a single source of truth for their contracts. This AMI delivers the registry preinstalled with a JDK 21 runtime and local PostgreSQL storage, so your schema registry is operational within minutes of launch.

### Why This AMI Instead of a DIY Install

• Versus manual EC2 setup: Skip the hours of installing a Java 21 runtime, downloading and checksum-verifying the Apicurio distribution, extracting the official web UI, wiring a PostgreSQL datasource, writing systemd units and configuring a reverse proxy. This image handles all of that at launch.
• Versus a raw upstream install: Apicurio Registry has no built-in authentication in this configuration, so exposing it directly is unsafe - anyone could read, write or delete your schemas. This image binds the registry backend to loopback and fronts it with nginx behind an HTTP Basic Auth gate whose password is generated uniquely and at random on the first boot of every instance. No shared or default credential ever ships in the AMI.
• Versus other community images: Benefit from a hardened first-boot process that rotates both the Basic Auth password and the PostgreSQL password, recreates a fresh empty database, a dedicated EBS data volume for the SQL store, and 24/7 professional support from cloudimg.

### Application Stack

• Apicurio Registry 3.2.6 Quarkus backend under a headless OpenJDK 21 runtime, run by a dedicated unprivileged service account
• Local PostgreSQL SQL storage on a dedicated EBS data volume - independently resizable for IOPS and capacity
• The official pre-built React web UI served statically by nginx, same origin as the REST API
• systemd services that start the registry, PostgreSQL and nginx on boot and restart on failure
• nginx reverse proxy publishing the UI and API on port 80 behind the per-instance Basic Auth gate, plus an unauthenticated health endpoint for load-balancer probes

### APIs and Formats

The registry exposes the Apicurio core REST API v3, a Confluent-compatible Schema Registry API (ccompat) so Kafka producers and consumers using the Confluent serializers work unchanged, and Swagger API documentation. It stores Avro, Protobuf, JSON Schema, OpenAPI, AsyncAPI, GraphQL and WSDL/XSD artifacts, with grouping, versioning and content rules. A set of example schemas is registered on first boot so the browsing UI is immediately populated.

### Security

Secure First Boot: A one-shot service generates a fresh HTTP Basic Auth password unique to each instance, writes a bcrypt .htpasswd, rotates the PostgreSQL password and recreates a fresh empty database, then stores the credentials in a root-only file. No shared or default credentials ship in the image.

Loopback Binding: The Apicurio backend listens only on 127.0.0.1; nginx on port 80 is the sole public listener and every UI and API path except the health endpoint requires authentication.

Encryption at Rest: The dedicated data volume holding the PostgreSQL store can leverage AWS EBS encryption - enable EBS encryption when launching the instance or use encrypted snapshots.

Network Isolation: Deploy in a private VPC subnet and use security groups to restrict access to only the ports your clients require (80 for the UI and API, 443 for optional TLS).

### Use Cases

• A central schema registry for Kafka and event-streaming platforms using the Confluent-compatible API
• A shared source of truth for API contracts (OpenAPI, AsyncAPI, GraphQL) across teams
• Governance and versioning of data schemas across microservices

### 24/7 cloudimg Support

Technical support by email and live chat covers deployment and instance sizing, PostgreSQL storage and backups, the REST and Confluent-compatible APIs, authentication and TLS setup, and JVM administration.

Apicurio is a trademark of Red Hat, Inc. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.