Apollo Config - Pre-Configured

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Apollo Config - Distributed Configuration Center on AWS

Launch a fully configured Apollo configuration management center on AWS in minutes - no manual installation, no shared credentials, and no complex assembly of services. This AMI eliminates the hours of provisioning normally required to stand up Apollo's multi-service stack and its database, so your team can centralize application configuration rather than wiring infrastructure.

Apollo is an open source distributed configuration management center used to centralize application configuration across environments, clusters, and services. Applications fetch typed, versioned configuration at runtime and receive updates without a redeploy, while operators get per-environment and per-cluster namespaces, release and rollback history, grey-scale (canary) releases, and a complete audit trail. This image ships Apollo 2.5.2 fully installed and running, with its MySQL database, both schemas, and all three Apollo services already wired together, so your configuration portal is usable within minutes of launch.

## About cloudimg

cloudimg specializes in pre-configured, production-hardened AMIs for open source platforms on AWS. Our engineering team maintains and supports every image we publish, providing hands-on platform expertise rather than generic hosting assistance.

## Why This AMI Over Alternatives

Unlike a bare deployment, this image is secure by default. Apollo's published sample data ships a well-known portal login, and this image destroys it: the shipped image contains no usable portal password at all, and on first boot your instance generates its own random portal administrator password, its own database credentials, and its own database root password, writing them to a root-only file. No credential is ever reused across deployments.

## Hardened Network Posture

All three Apollo services and MySQL bind to the loopback interface. An nginx reverse proxy terminates TLS and serves the portal on port 443, so the only network-reachable ports are SSH (22) and HTTPS (443) - the configuration service, administration service, and database are never exposed to the network. The self-signed certificate is regenerated per instance on first boot. The deployment guide explains restricting the HTTPS port to your own network and how to open the configuration service to your application subnet, after enabling access keys, when you are ready to onboard client applications.

## Application Stack

• Apollo Config Service - serves configuration to client applications and hosts the embedded Eureka meta server
• Apollo Admin Service - the privileged management API used by the portal
• Apollo Portal - the web console for apps, namespaces, releases, and audit history
• MySQL 8.0 database server holding ApolloConfigDB and ApolloPortalDB on a dedicated EBS volume
• OpenJDK 17 managed by apt so the runtime keeps receiving security updates
• nginx TLS reverse proxy in front of the portal

## Secure First Boot

On first launch, a one-shot systemd service generates unique credentials, rotates the database root, application, and maintenance passwords, mints a per-instance portal administrator password, regenerates the TLS certificate, and writes the credentials to a file readable only by root. No default credentials exist in the image at any point, closing the security gap present in images that rely on buyers to change shared passwords after deployment.

## Security and Hardening

The portal is served only over TLS. Buyers should attach a trusted certificate (via AWS Certificate Manager and a load balancer) for production use, restrict the security group to trusted IP ranges, and enable EBS encryption for data at rest. The database and internal services are bound to localhost and are not exposed externally. The local MySQL can be migrated to Amazon RDS for automated backups and Multi-AZ failover.

## Use Cases

• Centralized application configuration - manage configuration for many applications and environments from one console
• Dynamic configuration - push configuration changes to running applications without a redeploy
• Release governance - versioned releases, rollback, grey-scale releases, and a full audit trail

## 24/7 cloudimg Support

Every subscription includes around-the-clock technical support from cloudimg engineers via email and live chat. Our team assists with deployment, upgrades, performance tuning, database administration, and integrating Apollo with your applications. The user guide walks through launch, credential retrieval, signing in, and creating your first configuration.

Apollo is a trademark of its respective owners. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.