Authentik - Self-Hosted Identity Provider and SSO Platform

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Authentik - Self-Hosted Identity Provider and SSO on AWS

Authentik is an open source identity provider: single sign-on, multi-factor authentication, user management and access control for the applications your team already runs. It is a self-hosted alternative to hosted identity services, so your directory, your credentials and your audit trail stay inside your own AWS account.

This AMI ships the official Authentik production stack - the server, the background worker and a PostgreSQL 16 database - installed, wired together and managed by systemd. There is no compose file to write and no database to provision by hand.

## Why This AMI Instead of a Manual Install

Standing this up yourself means writing a Compose file, provisioning PostgreSQL, generating a secret key, bootstrapping the first superuser and hardening every port. This image removes all of it:

• The full production stack, pre-wired - server, worker and database come up together under one systemd unit.
• Every secret is per instance - the database password, the application secret key, the admin password and the bootstrap API token are all generated fresh on the first boot of your instance. No shared or default credential ever ships in the image.
• Database is not network reachable - PostgreSQL publishes no host ports and is reachable only on the internal container network. Only SSH and the Authentik web ports are exposed.
• Dedicated storage tier - the database, media and certificates live on their own EBS volume, resizable independently of the OS disk.
• Unattended security updates - the OS is fully patched at build time and configured for automatic security updates.

## What You Can Do With It

• Put SSO in front of internal and third-party applications using SAML, OAuth2 or OpenID Connect
• Enforce multi-factor authentication with TOTP, WebAuthn or SMS
• Serve as an LDAP provider for applications that only speak LDAP
• Build custom login, enrolment and recovery flows with the visual flow editor
• Federate against an existing directory or social provider as an upstream source
• Manage users, groups and fine-grained application access from one admin interface

## Example Production Use Case

A platform team running a mix of self-hosted tools - a Git server, a CI system, a monitoring stack and an internal wiki - can point all of them at this instance and get one login, one set of MFA rules and one place to revoke access when someone leaves. Applications that support OIDC or SAML integrate directly; older tools use the built-in LDAP provider.

## Quick Start

1. Launch the AMI with a security group allowing inbound TCP port 80 (and 443 if you terminate TLS on the instance).

2. Wait for first boot to generate your unique secrets.

3. SSH in and read the akadmin password from the root-only credentials file.

4. Open the instance in your browser and sign in as akadmin.

5. Add your first application and provider from the admin interface.

## 24/7 Support Included

cloudimg provides around-the-clock technical support covering deployment, upgrades, provider and application configuration, LDAP and SAML integration, and putting your own domain and TLS in front of the UI. Support aims to respond within one business day.

---

authentik is a trademark of Authentik Security, Inc. The Authentik core is distributed under the MIT License. PostgreSQL is distributed under the PostgreSQL License. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.