Locust - Secure Distributed Load Testing

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Locust is a popular open source, developer-friendly distributed load-testing tool. You write your load scenarios as plain Python code in a locustfile, then Locust swarms simulated users at your target system and reports response times, throughput and failures live in a browser-based web dashboard. This AMI delivers a fully installed, security-hardened Locust appliance so a working load generator is operational within minutes of launch - giving you a private, self-hosted performance-testing instance you run and control in your own AWS account.

## Why This Image vs a Manual Install

This image eliminates the manual Python environment setup, systemd service authoring, reverse-proxy configuration, and credential hardening that a bare install requires. Locust's web UI normally ships with no authentication of its own - anyone who can reach it can start, stop and reconfigure load tests, and therefore drive traffic at an arbitrary target. This image never leaves it exposed: Locust is pinned into a self-contained virtual environment and bound to the loopback interface, and an nginx reverse proxy fronts it with HTTP Basic authentication whose password is generated uniquely on each instance's first boot. Launch the instance, read your unique credential, and start a test.

## Application Stack

Locust is installed from the official Python package index into a pinned, self-contained virtual environment under /opt/locust, and runs as an unprivileged system user under a hardened systemd unit bound to the loopback interface only. An nginx reverse proxy on port 80 forwards to it, upgrading the connection for the live-stats websocket stream and enforcing HTTP Basic authentication. systemd starts the load tester and the web server on boot and restarts them on failure. A representative sample locustfile ships in the image so a test runs out of the box.

## Security Hardening

This image follows a defence-in-depth approach:

• Network isolation: the load tester binds exclusively to the loopback interface; only the nginx reverse proxy is exposed, so the authentication cannot be bypassed by reaching the app directly
• Authentication enforced: every request to the web UI and stats API is authenticated - nothing is served anonymously except an unauthenticated health endpoint for load-balancer probes
• No default or shared credentials: a cryptographically random web password is generated on each instance's first boot and written only to a root-only file
• Least privilege: the load tester runs as an unprivileged system user with NoNewPrivileges, PrivateTmp and ProtectHome set
• Pinned runtime: Locust is version-locked in an isolated virtual environment, independent of the distribution Python
• Automatic restart: systemd monitors both the load tester and nginx and restarts them on failure

Buyers requiring formal compliance documentation should contact cloudimg to discuss specific requirements.

## Concrete Use Cases

• Pre-release performance gates: An engineering team runs a locustfile modelling peak checkout traffic against a staging API before each release, watching latency and error-rate charts in real time and failing the release if thresholds are breached
• Capacity and scalability planning: A platform team ramps simulated users against a new service to find the point where response times degrade, sizing autoscaling policies from the observed breakpoint
• API and microservice stress testing: A QA team scripts realistic request mixes across REST and GraphQL endpoints, driving thousands of concurrent users and measuring throughput, failures and percentile response times per endpoint

## AWS Integration

Deploy on any EC2 instance type; larger instances generate more concurrent simulated users. Use the unauthenticated health endpoint with an Application Load Balancer for availability monitoring. Place the load generator in a VPC subnet with security-group control over what it can reach, and forward its logs to CloudWatch for long-running test runs. Snapshot the instance with EBS or AWS Backup once you have loaded your own locustfiles.

## Getting Started

Read your credential from the root-only file, open the web interface in your browser, sign in, set a target Host and the number of users, and start the swarm. Watch requests, failures and response-time percentiles update live, then edit the shipped sample locustfile or upload your own scenarios to model real traffic.

## cloudimg Support

24/7 technical support by email and chat. Help with deployment, reverse-proxy termination with your own domain and certificate, writing and structuring locustfiles, distributed multi-worker test setups, and interpreting the live statistics.