Kong Gateway - Open Source API Gateway

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Why This AMI Over Manual Setup

Platform engineers and DevOps teams building API-driven backends spend hours installing Kong, configuring PostgreSQL, running migrations, and hardening credentials - often repeating the work for every environment. This AMI eliminates that toil. A fully configured Kong Gateway stack is running and authenticated within minutes of launch, so your team can focus on defining routes and plugins rather than provisioning infrastructure.

## Gateway Stack

Kong Gateway runs as a systemd service in single-node mode, persisting its configuration in a local PostgreSQL 16 database. The proxy listens on port 8000 (HTTP) and 8443 (HTTPS with TLS). A lightweight nginx instance on port 80 forwards traffic to the Kong proxy so the gateway is reachable from a browser or curl without specifying a port. The Admin API is bound exclusively to the loopback interface - unlike many competing Kong images that expose it on 0.0.0.0 by default, creating an unnecessary attack surface. Access the Admin API securely over an SSH tunnel.

## Secure First Boot

On first boot a one-shot service generates a fresh PostgreSQL password for the Kong role, runs database migrations, and wires an example service, route, and key-authentication plugin. A per-instance API key is generated for a sample consumer named cloudimg, and the plain-text values are stored in a file readable only by root. No shared or default credentials ship in the image. This means every instance starts with unique secrets - reducing the credential-reuse risk common in pre-built AMIs.

## Dedicated Storage Tier

The PostgreSQL data directory lives on a separate, independently resizable EBS volume mounted at the database root. Most competing images place the database on the OS disk, making storage expansion risky and requiring downtime. With this architecture you can grow the data volume without disturbing the operating system or Kong configuration.

## Security and Network Guidance

• HTTPS traffic on port 8443 is served with TLS.
• Admin API bound to 127.0.0.1 prevents remote exploitation.
• Credentials file restricted to root with 0600 permissions.
• Recommend deploying within a private VPC subnet with security groups limiting inbound access to ports 80, 443, 8000, 8443, and 22 only from trusted CIDRs.
• EBS volume encryption can be enabled at launch for data-at-rest protection.

## Getting Started

1. Launch the AMI in your preferred AWS region and instance type.

2. SSH into the instance and inspect the credentials file at the documented path.

3. Send a request to the example route with the consumer API key to confirm the gateway is forwarding and authenticating traffic.

4. Define your own services, routes, and plugins via the Admin API over SSH tunnel.

5. Point your DNS or load balancer at the instance to begin serving production traffic.

## Use Cases

• SaaS API monetization - Expose your product API with key authentication and per-consumer rate limiting, suitable for teams handling thousands of requests per second on standard EC2 instance types.
• Microservice ingress - Replace hand-rolled reverse proxy configs with Kong's declarative routing for teams running 10-100 backend services on EC2 or ECS.
• Public API protection - Add authentication, IP restriction, and request-size limiting in front of payment or data APIs where unauthorized access carries compliance risk.
• Request and response transformation - Use Kong plugins to reshape headers, payloads, and status codes without modifying upstream application code.
• Multi-tenant API hosting - Isolate consumers with distinct credentials and rate-limit tiers on a single gateway instance.

## cloudimg Support

24/7 technical support by email and live chat. Our engineers assist with Kong deployment, route and plugin configuration, upstream wiring, rate limiting, observability setup, and gateway upgrades. Critical issues receive a one-hour average response.

To discuss your deployment requirements or request a guided onboarding walkthrough, contact us at support@cloudimg.co.uk.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.