BaseX Native XML and JSON Database

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## BaseX - Production-Ready Native XML Database AMI

Deploy a fully configured native XML and JSON database and XQuery 3.1 processor on AWS in minutes, not hours. This AMI delivers BaseX preinstalled and running as a managed system service behind an nginx TLS reverse proxy, so you can create databases, store documents and run XQuery and XPath the moment the instance boots.

BaseX is backed by a vibrant open-source community with over a decade of active development and adoption across publishing, healthcare, financial services, and research organizations worldwide.

### Why This AMI Instead of a DIY Install

• Versus manual EC2 setup: Skip installing a Java 21 runtime, downloading and checksum-verifying the BaseX distribution, writing systemd units, binding the server to loopback, provisioning a data disk, and configuring a TLS reverse proxy. This image does all of that at launch.
• Versus a raw upstream install: Stock BaseX ships a well-known default administrator credential and can expose an unauthenticated HTTP surface. This image ships no known credential: the REST API and DBA console require authentication from the very first request, and a unique administrator password is generated on every instance.
• Versus other community AMIs: Benefit from a hardened first boot that generates a per-instance administrator password, a dedicated data volume for your XML data, TLS on the wire, and 24/7 professional support from cloudimg.

### Application Stack

• BaseX installed under /opt/basex, run by a dedicated unprivileged service account bound to loopback only
• Headless OpenJDK 21 Java runtime
• A native XML and JSON store on a dedicated EBS data volume holding the databases, the admin credential store and logs, independently resizable for IOPS and capacity
• systemd services that start the database and proxy on boot and restart on failure
• nginx reverse proxy terminating TLS and publishing the DBA web admin, REST and RESTXQ API on port 443

### Native XML, JSON and XQuery 3.1

BaseX stores documents in an efficient native store, indexes them for fast full-text and structural queries, and answers queries and updates in milliseconds through a clean REST and RESTXQ HTTP API. Capabilities include native XML and JSON storage, XQuery 3.1 with full-text search, XQuery Update, the RESTXQ framework for building web applications and services, WebSockets, and client libraries for many languages.

### Industry Use Cases

• Publishing and content management: Ingest and transform DITA maps, DocBook or structured XML content for multi-channel delivery. Use RESTXQ to serve personalized content from repositories holding hundreds of thousands of documents, with full-text and structural queries returning results in milliseconds.
• Healthcare and life sciences: Store and query HL7 CDA clinical documents, FDA submissions in eCTD format, or research datasets in XML. Leverage XQuery Update to enrich and normalize incoming records before downstream analytics.
• Financial services and compliance: Maintain configuration and metadata stores for regulatory filings (XBRL, FpML) queried with XQuery and XPath. Build data integration pipelines that validate, transform and route XML messages across systems using RESTXQ endpoints.
• Data integration pipelines: Orchestrate XML transformation workflows with XQuery Update and RESTXQ, connecting upstream feeds to downstream consumers through a queryable intermediate store.

### Web Admin and API

The DBA web administration application is served on port 443 through nginx. Browse databases and resources, run interactive XQuery in the built-in editor, and manage users, sessions and settings from the browser. The REST API answers document storage, retrieval and XQuery over HTTP; RESTXQ lets you build full HTTP services in XQuery.

### Security

Secure First Boot: A one-shot service generates a fresh administrator password unique to each instance, applies it to the database and stores it in a root-only file. No shared or default credentials ship in the image, and the database service is configured so it cannot start before that password is set.

Authenticated by Default: The REST API returns 401 to unauthenticated requests and rejects the stock admin credential; the DBA console enforces its own session login. All access is over TLS, so HTTP Basic credentials never cross the wire in plaintext.

Encryption at Rest: The dedicated data volume holding your databases can leverage AWS EBS encryption. Enable EBS encryption when launching the instance or use encrypted snapshots.