Base for Red Hat JBoss EAP 8.1 on Rocky Linux 8

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Select Base for Red Hat JBoss EAP 8.1 on Rocky Linux 8 as the software version, pick your Region, and choose Launch through EC2.

Choose m5.large (or larger for your applications), your key pair and the security group described above.

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --image-id <ami-id> --instance-type m5.large \
  --key-name <your-key-pair> --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=jboss-eap-81}]'

Connect as the rocky user with your key pair:

ssh -i <your-key.pem> rocky@<public-ip>

The login message names the image and the installer helper.

First boot runs once, within a minute of launch. It creates the management password, the keystore password and the HTTPS keystore. Check its status and read your instance's values:

sudo systemctl status jboss-eap-firstboot --no-pager | head -4 sudo grep -oE '^[A-Z_]+=' /root/jboss-eap-credentials.txt
sudo grep -E '^JBOSS_EAP_(HOSTNAME|HTTPS_URL|ADMIN_USER|MANAGEMENT_URL|TLS_STORE|STATUS)=' /root/jboss-eap-credentials.txt

The output looks like this:

● jboss-eap-firstboot.service - sac Base for Red Hat JBoss EAP: per-instance management password and HTTPS keystore Loaded: loaded (/etc/systemd/system/jboss-eap-firstboot.service; enabled; vendor preset: disabled) Active: active (exited) since Tue 2026-10-20 11:16:47 UTC; 1min 47s ago Main PID: 9718 (code=exited, status=0/SUCCESS) JBOSS_EAP_HOSTNAME= JBOSS_EAP_HTTPS_URL= JBOSS_EAP_ADMIN_USER= JBOSS_EAP_ADMIN_PASSWORD= <set-at-first-boot>= JBOSS_EAP_TLS_STORE= JBOSS_EAP_KEYSTORE_PASSWORD= <set-at-first-boot>= JBOSS_EAP_HOSTNAME=ec2-100-58-201-223.compute-1.amazonaws.com JBOSS_EAP_HTTPS_URL=https://ec2-100-58-201-223.compute-1.amazonaws.com:8443/ JBOSS_EAP_ADMIN_USER=admin JBOSS_EAP_MANAGEMENT_URL=http://127.0.0.1:9990/ JBOSS_EAP_TLS_STORE=/etc/sac/jboss-eap/tls/server.p12 JBOSS_EAP_STATUS=not installed - run:
sudo sac-install-jboss-eap

The host name comes from the instance's EC2 metadata (public DNS name, else public IP, else private IP), never from a request. To use your own DNS name, see Step 9.

Print the management password only when you need it: sudo grep '^JBOSS_EAP_ADMIN_PASSWORD=' /root/jboss-eap-credentials.txt | cut -d= -f2-.

The preflight check needs no credentials. It confirms first boot, the keystore, Java, the firewall, SELinux and free disk space, and it checks that the instance can reach Red Hat:

sudo sac-install-jboss-eap --preflight

Preflight (sac Base for Red Hat JBoss EAP 8.1): PASS first boot completed (per-instance password and keystore) PASS per-instance HTTPS keystore /etc/sac/jboss-eap/tls/server.p12 opens with its own password PASS OpenJDK 21 (21.0.12.1) PASS jboss system user present PASS firewalld active, 8443/tcp open PASS SELinux enforcing PASS 6452 MiB free for /opt/jboss-eap PASS Red Hat SSO reachable (sso.redhat.com, HTTP 401 without credentials) PASS Red Hat Downloads API reachable (api.access.redhat.com, HTTP 401 without credentials)

If a Red Hat endpoint check fails, allow outbound HTTPS (TCP 443) to sso.redhat.com and api.access.redhat.com in your network ACLs, proxy or NAT gateway.

You can also check the installation status, the Java version and the SELinux mode:

sudo sac-install-jboss-eap --status java -version 2>&1 | head -1 getenforce

JBoss EAP: not installed (/opt/jboss-eap is empty). Run:
sudo sac-install-jboss-eap --preflight HTTPS: https://ec2-100-58-201-223.compute-1.amazonaws.com:8443/ management: http://127.0.0.1:9990/ (loopback only) openjdk version "21.0.12.1" 2026-08-18 LTS Enforcing

The helper authenticates to Red Hat with a service account of the Red Hat organization that holds your JBoss EAP subscription. To create one:

• Sign in to the Red Hat Hybrid Cloud Console at console.redhat.com as an organization administrator.
• Open the Service Accounts page (from the gear icon, under Identity & Access Management) and choose Create service account. Give it a name such as eap-downloads-aws.
• Copy the Client ID and Client secret. Red Hat shows the secret only once.

The service account belongs to the organization that holds the JBoss EAP subscription, and it must be allowed to download that software. Your organization administrator manages its access in User Access.

Red Hat documents service accounts and their use with its downloads in the Hybrid Cloud Console help and in the README of its redhat.eap Ansible collection. Delete or rotate the service account when you no longer need it.

Option A: answer two prompts (recommended). The helper does not echo the secret, and it never reaches your shell history:

sudo sac-install-jboss-eap
# Red Hat service account client ID: <your-client-id>
# Red Hat service account client secret (hidden): <your-token>

Option B: a credentials file. Create a root-only file, put the two values in it with an editor, and pass it to the helper. The helper refuses a file that other users can read, and it shreds the file after reading. Add --keep-credentials-file to keep it:

sudo install -m 600 /dev/null /root/rh-service-account.txt
sudo vi /root/rh-service-account.txt
# client_id=<your-client-id>
# client_secret=<your-token>
sudo sac-install-jboss-eap --credentials-file /root/rh-service-account.txt

Option C: a zip you downloaded yourself. Download Red Hat JBoss Enterprise Application Platform 8.1.0 (jboss-eap-8.1.0.zip) from the Red Hat Customer Portal (Downloads, JBoss Enterprise Application Platform, version 8.1). Note the SHA-256 checksum shown on the download page, copy the zip to the instance, and install it:

scp -i <your-key.pem> jboss-eap-8.1.0.zip rocky@<public-ip>:/tmp/
sudo sac-install-jboss-eap --archive /tmp/jboss-eap-8.1.0.zip --sha256 <sha256-from-portal> rm -f /tmp/jboss-eap-8.1.0.zip

To see which EAP 8.1 files your subscription can download, run sudo sac-install-jboss-eap --list. Pick one with --file-name.

The helper works in this order:

• Exchanges your service account for a short-lived access token at sso.redhat.com. The token stays in memory and is sent only to Red Hat hosts.
• Finds jboss-eap-8.1.0.zip in the Red Hat Downloads API, downloads it, and compares its SHA-256 with the checksum that Red Hat publishes for it. A mismatch deletes the file and stops the install.
• Checks that the archive is JBoss EAP 8.1 and unpacks it into /opt/jboss-eap. The server code is owned by root, and the runtime directories are owned by jboss.
• Applies SecureAnyCloud's configuration to standalone.xml with the JBoss CLI. The HTTPS listener on 0.0.0.0:8443 uses your instance's keystore (TLS 1.2 and 1.3). The public and management interfaces are pinned to 127.0.0.1. EAP's default keystore, the welcome content and ExampleDS are removed. Web service WSDL addresses use your configured host name over HTTPS.
• Creates the management user admin with the password from /root/jboss-eap-credentials.txt.
• Enables and starts jboss-eap.service, then checks that HTTPS answers and that the management interface accepts the password.

If Red Hat does not accept the service account, the helper stops before it downloads anything. For example, it prints:

ERROR: Red Hat SSO refused the service account (invalid_client: Invalid client or Invalid client credentials). Check the client ID and secret at console.redhat.com -> Service Accounts; nothing was downloaded or stored.

After the install, check the service and the listeners:

sudo sac-install-jboss-eap --status sudo systemctl status jboss-eap --no-pager | head -5 sudo ss -ltn

Only port 22 and port 8443 listen on the network. Ports 8080, 9990 and the other EAP ports listen on 127.0.0.1.

Reach your applications over HTTPS. Run this from your computer. The certificate is self-signed for your instance, so a browser shows a warning until you add your own certificate (see Step 9):

curl -k https://<public-dns-name>:8443/

A fresh server answers 404 Not Found because the welcome page is removed. To deploy an application, copy it into the deployments directory as the jboss user, or use the management CLI:

sudo install -o jboss -g jboss -m 0640 myapp.war /opt/jboss-eap/standalone/deployments/
sudo /opt/jboss-eap/bin/jboss-cli.sh --connect --controller=127.0.0.1:9990 --command="deployment-info"

Open the management console. Open an SSH tunnel from your computer. Then browse to http://localhost:9990/ and sign in as admin with the password from /root/jboss-eap-credentials.txt:

ssh -i <your-key.pem> -L 9990:127.0.0.1:9990 rocky@<public-ip>

Change settings. Put JVM options in /etc/sysconfig/jboss-eap (for example JAVA_OPTS="-Xms1g -Xmx2g"), then run sudo systemctl restart jboss-eap. The server runs standalone.xml.

To change the HTTPS port or open the HTTP listener, edit the configuration with the JBoss CLI. Then open the port in both your security group and firewalld (sudo firewall-cmd --permanent --add-port=<port>/tcp && sudo firewall-cmd --reload).

• Rocky Linux and OpenJDK: dnf-automatic installs security updates daily. Run sudo dnf -y upgrade for all updates, and restart EAP after a Java update (sudo systemctl restart jboss-eap).
• JBoss EAP: apply Red Hat's EAP 8.1 updates with your subscription, as described in Red Hat's guide Updating Red Hat JBoss Enterprise Application Platform. Use the management CLI installer update commands or the jboss-eap-installation-manager.

To issue the instance certificate for your own DNS name, for example after you point a Route 53 record at the instance, run:

sudo sac-jboss-eap-tls --hostname eap.example.com

The tool records the name in /etc/sac/jboss-eap-hostname and mints a new key and certificate into the keystore. When EAP is installed, it also restarts EAP and updates the WSDL host.

To use a certificate from your own certificate authority, import it into a PKCS12 keystore and point the sacKS key store in standalone.xml at it. Alternatively, put an Application Load Balancer with an AWS Certificate Manager certificate in front of port 8443.