Apache Zeppelin

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Apache Zeppelin. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of t3.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and either create or select a security group that opens port 22 from your management network and port 80 for the notebook UI. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation generates the admin password. The JVM notebook server then takes roughly 45 to 90 seconds to become ready after the instance state becomes Running and the status checks pass.

The following command launches an instance from the SecureAnyCloud Apache Zeppelin Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=apache-zeppelin}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. Find it in the EC2 console or with aws ec2 describe-instances.

Connect over SSH using your key pair and the login user for your operating system variant.

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i <key-name>.pem ubuntu@<public-ip>

The notebook admin password is unique to your instance and was generated on first boot. Read it as root with the command below. The file lists the notebook URL, the admin user (admin) and the generated password. Keep this password somewhere safe.

sudo cat /root/apache-zeppelin-credentials.txt

Over SSH, confirm that the notebook server and the nginx proxy are active. The notebook server is a JVM application and is slow to start, so allow up to 90 seconds after boot before it answers.

sudo systemctl is-active zeppelin nginx

Both services should report active. The notebook server binds to loopback only and is fronted by nginx on port 80. Confirm that its liveness endpoint answers locally:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080/api/version

This returns 200 once the notebook server has finished starting. The same endpoint is reachable through nginx at http://127.0.0.1/api/version.

nginx serves the Apache Zeppelin notebook UI on port 80, with Apache Shiro form-based authentication. In a browser, go to:

http://<instance-public-ip>/

The browser redirects you to the sign-in page. Sign in as admin with the password from the credentials file. After you log in, you land on the Zeppelin home page, which lists your notebooks and offers Import Note and Create new Note.

From the home page, choose Create new Note, give the note a name, pick a default interpreter and select Create. The note opens with an empty paragraph.

Type code into the paragraph and run it with the play control or with Shift+Enter. For a quick test, enter a Markdown paragraph:

%md
# Hello from sac Apache Zeppelin running through the nginx WebSocket reverse proxy.

Running the paragraph drives the live editor over the WebSocket that nginx proxies to the notebook server. The rendered Markdown appears below the paragraph with a FINISHED status.

You can mix code, queries, Markdown and visualisations across paragraphs in the same note, and Zeppelin renders tabular output as interactive charts.

Apache Zeppelin ships with a rich set of interpreters for data work. Open the user menu at the top right and choose Interpreter to reach the interpreter settings page. Here you can search the bundled interpreters, edit their properties, restart an interpreter, and bind or unbind interpreters from your notes.

Each interpreter has its own properties, for example the connection details for a database interpreter or the master URL for the Spark interpreter. After changing an interpreter's properties, select Save and restart the interpreter so your notebooks pick up the new configuration.

The notebook directory, configuration (shiro.ini, zeppelin-site.xml, zeppelin-env.sh), interpreter state and the local repo live on a dedicated EBS volume mounted at /var/lib/zeppelin. This keeps your notebooks off the operating system disk and lets you resize or snapshot them independently. Confirm the mount:

df -h /var/lib/zeppelin

To grow the store, expand the EBS volume in the AWS console, then grow the filesystem on the instance with sudo resize2fs on the underlying device. Because the notebooks and configuration live on this volume, they survive instance replacement when you re-attach or restore the volume.

nginx serves the notebook UI over plain HTTP on port 80, so place it behind TLS for production use. Obtain a certificate for your domain, for example with a managed certificate on an Application Load Balancer in front of the instance, or with Certbot installed on the instance.

Then configure nginx to listen on 443 with your certificate and proxy to 127.0.0.1:8080 exactly as the bundled site does for port 80. Keep the WebSocket upgrade headers and the Apache Shiro login in place. Restrict the security group so that ports 80 and 443 are reachable only from the networks that use the notebook.

Back up your notebooks and configuration by snapshotting the /var/lib/zeppelin EBS volume, which captures the entire data tier.

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed. Apache Zeppelin and nginx start automatically on boot, and the notebook server takes roughly 45 to 90 seconds to become ready again after a reboot.