Apache Cassandra

• Open AWS Marketplace and search for "Apache Cassandra SecureAnyCloud".

• Choose Continue to Subscribe, accept the terms, then choose Continue to Configuration.

• Choose your Region and Software Version.

• Choose Continue to Launch.

• Choose Launch through EC2 for full control over instance configuration.

• Choose your instance type (m5.large is recommended).

• Configure storage: 20 GB gp3 minimum for the root volume. Use larger volumes for production data.

• Configure your Security Group with these inbound rules:

Port Protocol Source Purpose

22 TCP Your IP SSH access

7199 TCP Your IP JMX monitoring port

7000 TCP VPC only Internode communication

9042 TCP Your IP CQL native transport port

Important: Allow ports 7000 and 7199 only within your VPC, for cluster communication and monitoring. Restrict port 9042 to trusted application servers or your IP address.

• Choose your EC2 key pair and launch the instance.

When your instance is running and has passed both status checks (2/2), connect over SSH:

ssh -i your-key.pem ec2-user@<public-ip-address>

To switch to the root user:

sudo su -

Important: Wait until the instance reaches 2/2 successful status checks before you connect. Early connection attempts can fail with permission denied errors.

Check the status of the Cassandra node:

nodetool status

Expected output:

Datacenter: datacenter1 ======================== Status=Up/Down |/ State=Normal/Leaving/Joining/Moving -- Address Load Tokens Owns (effective) Host ID Rack UN 127.0.0.1 69.05 KiB 16 100.0% bb9d3091-c1e0-4ed2-92b4-2897099aba7d rack1

The UN status indicates the node is Up and in a Normal state.

Start the interactive CQL shell:

cqlsh

Expected output:

Connected to Test Cluster at 127.0.0.1:9042 [cqlsh 6.0.0 | Cassandra 4.0.4 | CQL spec 3.4.5 | Native protocol v5] Use HELP for help. cqlsh>

Create a keyspace:

CREATE KEYSPACE my_app WITH replication = { 'class': 'SimpleStrategy', 'replication_factor': 1 };

Use the keyspace:

USE my_app;

Create a table:

CREATE TABLE users ( user_id UUID PRIMARY KEY, name text, email text, created_at timestamp );

Insert data:

INSERT INTO users (user_id, name, email, created_at) VALUES (uuid(), 'John Doe', 'john@example.com', toTimestamp(now()));

Query data:

SELECT * FROM users;

Type EXIT to leave the CQL shell.

Sign in to the AWS Management Console, open the EC2 service and choose Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Apache Cassandra. Choose Select on the SecureAnyCloud listing, then choose Continue on the subscription summary.

Choose an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, choose your VPC and subnet, then create or choose a security group that allows inbound port 22 from your management network. Keep the root volume at the default size or larger. The Cassandra data volume is attached automatically from the image.

Choose Launch instance. First boot initialization generates the superuser password and starts Cassandra. It takes a minute or two after the instance state becomes Running and the status checks pass.

The following command launches an instance from the SecureAnyCloud Apache Cassandra Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens inbound port 22.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options HttpTokens=required \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=cassandra-01}]'

On success, the command prints a JSON document. Note the instance ID, then get the public address once the instance is running with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you chose and the public IP address from step 2. The SSH login user depends on the operating system of the AMI variant you launched:

AMI variant SSH login user

Apache Cassandra 5.0 on Ubuntu 24.04 ubuntu

ssh <login-user>@<public-ip>

Wait until the instance has passed both EC2 status checks before you connect. The first boot service runs before the SSH daemon is ready, so Cassandra is initialized by the time you can log in.

The first boot service generates a fresh cassandra superuser password for this instance. It writes the password, with the connection details, to /root/cassandra-credentials.txt, which only the root user can read. Display the file from your SSH session:

sudo cat /root/cassandra-credentials.txt

The file looks like this, with a unique password on your instance:

# Apache Cassandra 5.0 — Per-Instance Credentials
# Generated on first boot: Thu May 21 14:05:56 UTC 2026
#
# Open the CQL shell with:
# cqlsh-sac -u cassandra -p '<password below>'
# CASSANDRA_USER=cassandra CASSANDRA_PASSWORD=<your generated password> CQL_HOST=127.0.0.1 CQL_PORT=9042 CLUSTER_NAME=sac-cassandra

The default cassandra / cassandra account that ships with Apache Cassandra is rotated away during first boot, so it no longer works. Use the generated password for every connection.

Cassandra runs under systemd as the cassandra service and starts automatically on boot. Confirm that it is active:

systemctl is-active cassandra

The command prints active. Next, confirm that the CQL native transport is listening. By default, Cassandra binds to the loopback address 127.0.0.1 on port 9042, so it is reachable from the instance itself:

ss -tln | grep 9042

You should see a listening socket on 127.0.0.1:9042.

The image provides cqlsh-sac, a wrapper that starts the Cassandra CQL shell against the local node. Open an interactive session with the generated superuser password. Replace <password> with the value from /root/cassandra-credentials.txt:

cqlsh-sac -u cassandra -p '<password>'

To run a single statement without entering the interactive shell, add -e. The screenshot below shows a complete session that reads the credentials file, opens cqlsh, creates a keyspace and a table, inserts two rows and reads them back.

To verify the connection non-interactively from your SSH session, query the server version. Replace <password> with your generated password:

cqlsh-sac -u cassandra -p '<password>' \
  -e "SELECT cluster_name, release_version, cql_version FROM system.local;"

The query returns the cluster name, the Cassandra release and the CQL specification version:

cluster_name | release_version | cql_version --------------------+-----------------+------------- sac-cassandra | 5.0.8 | 3.4.7 (1 rows)

A keyspace is the top-level container for data in Cassandra, and it defines the replication strategy. Run the following statements inside cqlsh to create a keyspace, switch to it, create a table, insert a row and query it. They mirror the session in the screenshot above.

CREATE KEYSPACE store WITH replication = { 'class': 'SimpleStrategy', 'replication_factor': 1 }; USE store; CREATE TABLE products ( id uuid PRIMARY KEY, name text, price decimal ); INSERT INTO products (id, name, price) VALUES (uuid(), 'Mechanical Keyboard', 89.00); SELECT name, price FROM products;

For a single-node image, the SimpleStrategy class with a replication_factor of 1 is appropriate. When you add nodes, raise the replication factor and consider NetworkTopologyStrategy so that copies of the data are spread across the cluster. Type EXIT to leave the cqlsh shell.

nodetool is the cluster administration utility. nodetool status reports the state of every node. On this single-node image it lists one node, and the UN prefix means the node is Up and in a Normal state.

nodetool status

nodetool info reports detailed health for the local node. It shows the JVM heap in use, the uptime, the data load and whether gossip and the native transport are active.

nodetool info

nodetool describecluster summarises the cluster as a whole, listing the snitch, the partitioner and the keyspaces with their replication settings:

nodetool describecluster

Cassandra stores its data, the commit log and saved caches under /var/lib/cassandra, a dedicated EBS volume separate from the operating system disk. Confirm the mount:

findmnt /var/lib/cassandra

The output shows /var/lib/cassandra is its own ext4 filesystem on a separate device:

TARGET SOURCE FSTYPE OPTIONS /var/lib/cassandra /dev/nvme1n1 ext4 rw,relatime

Because the data directory is on its own volume, you can take an Amazon EBS snapshot of it on its own schedule and grow it independently of the root volume. Check the available space at any time with:

df -h /var/lib/cassandra

Systemd manages Cassandra, and the service starts automatically on boot.

Check the service status:

systemctl status cassandra --no-pager

Stop, start and restart the service when needed:

sudo systemctl stop cassandra
sudo systemctl start cassandra
sudo systemctl restart cassandra

Drain a Cassandra node before you stop it. Draining flushes memtables to disk and stops the node accepting writes:

nodetool drain

Cassandra writes its log files under /var/log/cassandra. The main log is /var/log/cassandra/system.log. Read it first when you diagnose a startup or runtime problem:

sudo tail -f /var/log/cassandra/system.log

Back up the contents of the data directory. nodetool snapshot creates a consistent, hard-linked snapshot of every keyspace:

nodetool snapshot

Cassandra writes the snapshot files under /var/lib/cassandra/data/<keyspace>/<table>/snapshots/. Archive them to durable storage, for example an Amazon S3 bucket:

sudo tar -czf /var/backups/cassandra-snapshot-$(date +%F).tgz -C /var/lib/cassandra/data .

Because /var/lib/cassandra is a dedicated EBS volume, you can also take an EBS snapshot of the volume itself for a point-in-time copy of all Cassandra data. Remove a snapshot you no longer need with nodetool clearsnapshot.

This image runs Cassandra as a single-node cluster, which suits development, testing and smaller production workloads. Cassandra scales horizontally by adding nodes. To build a multi-node cluster:

• Launch additional instances from this same AMI, one per node, in the same VPC.

• Allow inbound TCP port 7000 between the nodes for internode communication, and port 9042 from your application tier.

• On every node, edit /etc/cassandra/cassandra.yaml. Set listen_address and rpc_address to the node's own private IP address, and set the seeds value under seed_provider to the private IP addresses of one or two seed nodes.

• Raise the replication_factor of your keyspaces, and consider NetworkTopologyStrategy, so that data is replicated across the cluster.

• Restart Cassandra on each node and confirm with nodetool status that every node reaches the UN state.

The Apache Cassandra documentation at https://cassandra.apache.org/doc/latest/ covers cluster topology, replication, repair and performance tuning in depth.