OpenRefine - Secure Data Cleaning Workbench

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

OpenRefine is a popular open source power tool for working with messy tabular data. Import data from CSV, TSV, Excel, JSON or XML into a project workbench, then explore it with facets and filters, clean and normalise values with GREL, Jython or Clojure expressions, cluster and merge near-duplicate entries, and reconcile your data against external sources such as Wikidata - all through a browser-based data grid. Every change is recorded as a reproducible operation history you can undo, redo and export. This image delivers a fully installed, security-hardened OpenRefine 3.10 appliance so a working data workbench is operational within minutes of launch, self-hosted and fully under your control in your own AWS account.

## Why This Image vs a Manual Install

This image eliminates the manual Java runtime setup, systemd service authoring, reverse-proxy configuration, TLS termination and credential hardening that a bare install requires. OpenRefine has no authentication of its own - it assumes a single trusted local user - so exposing it directly would put an unauthenticated data workbench with full read and write access to your host on the network. This image never leaves it exposed: OpenRefine is bound to the loopback interface only, and an nginx reverse proxy fronts it over HTTPS with HTTP Basic authentication whose password is generated uniquely on each instance's first boot. Launch the instance, read your unique credential, and start cleaning data.

## Application Stack

OpenRefine is installed from the official pinned upstream Linux distribution under /opt/openrefine and runs as an unprivileged system user under a hardened systemd unit bound to the loopback interface. An nginx reverse proxy on port 443 forwards to it over a per-instance self-signed TLS certificate, enforcing HTTP Basic authentication; port 80 serves an unauthenticated health endpoint and redirects everything else to HTTPS. Customer projects, imported datasets and the operation-history cache live on a dedicated, independently-resizable data volume mounted at /var/lib/openrefine.

## Security Hardening

This image follows a defence-in-depth approach:

• Network isolation: OpenRefine binds exclusively to the loopback interface; only the nginx reverse proxy is exposed
• Authentication enforced: every request is authenticated except an unauthenticated health endpoint for load-balancer probes
• No default or shared credentials: a cryptographically random web password is generated on each instance's first boot and written only to a root-only file
• Encrypted transport: the reverse proxy terminates HTTPS with a certificate generated uniquely per instance
• Least privilege: the workbench runs as an unprivileged system user with NoNewPrivileges, PrivateTmp, ProtectHome and ProtectSystem=strict
• Automatic restart: systemd monitors both the workbench and nginx and restarts them on failure

## Concrete Use Cases

• Data cleanup and normalisation: Import an inconsistent export, use faceting and clustering to merge duplicate or mis-spelled values, apply GREL transforms to standardise dates, names and codes, and export clean structured data ready for a database load
• Reconciliation and enrichment: Reconcile a column of names or places against Wikidata or another reconciliation service, then pull in additional attributes to enrich the dataset in place
• Reproducible data preparation: Record a whole cleanup as an operation history, then replay that exact sequence on each new monthly data drop so the transformation is consistent and auditable

## AWS Integration

Deploy on any EC2 instance type; larger instances give OpenRefine more memory for bigger datasets. Store projects on the dedicated EBS data volume and resize or snapshot it independently with EBS or AWS Backup. Use the unauthenticated health endpoint with an Application Load Balancer for availability monitoring, and forward logs to CloudWatch.

## Pricing and Evaluation

This listing includes a software charge in addition to standard AWS infrastructure costs. See the Pricing tab on this page for the current rate. To evaluate the product at low cost, launch on a small instance type, verify the workflow meets your needs, and scale up when ready.

## Getting Started

1. Launch the AMI from this listing with a key pair and a Security Group allowing inbound ports 22, 80 and 443.

2. SSH into the instance and retrieve your unique web password from /root/openrefine-credentials.txt.

3. Open https:// in your browser, accept the self-signed certificate, and log in with username "admin" and your retrieved password.

4. Create a project by importing a CSV, Excel, JSON or XML file, explore it with facets, clean it with transforms, and export the result.