Drupal 11

cd /var/www/html/drupal && sudo -u www-data vendor/bin/drush status | head -20

sudo ss -tlnp | grep -E ':(80|3306) ' php -v mysql --version

sudo cat /stage/scripts/drupal-credentials.log

Copy DRUPAL_ADMIN_PASSWORD and DRUPAL_ADMIN_URL from the file.

Browse to http://<vm-ip>/. The default Drupal 11 Welcome page appears in the Olivero theme.

Browse to http://<vm-ip>/user/login and sign in as the SecureAnyCloud administrator with the password from Step 6.

Open the Status Report (/admin/reports/status). It shows site health, PHP version, database connectivity, file system permissions and update advisories.

Drupal's strength is its module ecosystem, with 45,000+ contributed modules. Browse /admin/modules to see the bundled core modules. Add more with drush pm:install <module> or Composer.

Use this list to find the main files and directories on the VM:

• Drupal install: /var/www/html/drupal/
• settings.php: /var/www/html/drupal/sites/default/settings.php
• Apache vhost: /etc/apache2/sites-available/drupal.conf
• Apache logs: /var/log/apache2/drupal-{access,error}.log
• MySQL data: /var/lib/mysql/
• Drush: /var/www/html/drupal/vendor/bin/drush, symlinked to /usr/local/bin/drush
• First-boot script: /usr/local/sbin/drupal-firstboot.sh
• Credentials: /stage/scripts/drupal-credentials.log (mode 0600 root:root)

• Enable HTTPS. Install Certbot and obtain a Let's Encrypt certificate: sudo apt-get install -y certbot python3-certbot-apache && sudo certbot --apache
• Restrict the NSG. Open port 80 only to your CDN or load balancer, and limit port 22 to your management CIDR.
• Update modules monthly with drush pm:update --security-only.
• Update Drupal core with Composer: cd /var/www/html/drupal && composer update drupal/core --with-dependencies
• Patch the OS monthly: apt-get update && apt-get upgrade && reboot

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Drupal CMS. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger, because the Drupal workload is PHP and MariaDB heavy. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your visitors use. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization takes approximately one minute after the instance state becomes Running and the status checks pass.

Run the following command to launch an instance from the SecureAnyCloud Drupal Marketplace AMI into an existing subnet and security group.

Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=drupal-cms-01}]'

The command prints a JSON document on success. Note the instance ID. Once the instance is running, retrieve its public address withaws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the public IP address from step 2. The SSH login user depends on the AMI variant you launched:

AMI variant SSH login user

Drupal 11 on Ubuntu 24.04 ubuntu

The first-boot service runs before the SSH daemon becomes ready, so the credentials file is in place when you first log in.

ssh <login-user>@<public-ip>
sudo cat /root/drupal-credentials.txt

The file is plain text. It contains the Drupal URL, the administrator username admin, the administrator password, and the MariaDB database name, user and password. Copy these values to a password manager or encrypted vault, and do not commit them to source control.

From the same SSH session, confirm that the deployment is healthy:

curl -fsS -o /dev/null -w 'login page HTTP %{http_code}\n' http://127.0.0.1/user/login

A login page HTTP 200 response confirms that the full stack (nginx, PHP and MariaDB) is serving Drupal.

Open a web browser and go to http://<public-ip>/user/login. Drupal shows the sign-in form to visitors who do not yet have a session.

Enter the administrator username admin and the administrator password from /root/drupal-credentials.txt, then select Log in. After you sign in, the administration toolbar appears across the top of every page.

The dark administration toolbar gives you every management area:

• Content for pages and articles
• Structure for content types, menus, blocks and taxonomy
• Appearance for themes
• Extend for modules
• Configuration for site settings
• People for user accounts and roles
• Reports for logs and status

The content overview at /admin/content lists every page and article on the site, with filters for type, status and author.

Open Reports, then Status report, to check the health of a deployment. It flags pending updates, cron status and configuration warnings.

For a production deployment, replace the administrator password that was generated on first boot. Select your account in the toolbar and choose Edit. Enter a new password in the Password and Confirm password fields, then select Save.

You can do the same from the command line with the preinstalled drush tool:

sudo -u www-data /var/www/drupal/vendor/bin/drush --root=/var/www/drupal/web \
  user:password admin '<new-password>'

Select Content in the toolbar, then Add content. Choose Basic page for a static page or Article for a dated, taggable post.

Enter a title and body, set the Published checkbox in the right-hand sidebar, and select Save.

To add fields to a content type or create your own content types, open Structure, then Content types. Manage menus under Structure, then Menus. Set the front page under Configuration, then System, then Basic site settings.

Contributed modules and themes from https://www.drupal.org/ extend Drupal's functionality. The Extend page at /admin/modules lists every module installed on the site and lets you enable or disable each one.

This image installs Drupal with Composer. To add a module, require it with Composer and then enable it with drush:

cd /var/www/drupal
sudo -u www-data composer require drupal/<module-name>
sudo -u www-data /var/www/drupal/vendor/bin/drush --root=/var/www/drupal/web \
  pm:install <module-name>

Themes are installed the same way and activated under Appearance at /admin/appearance.

By default, Drupal sends mail through the server's PHP mail function. For reliable delivery on a cloud instance, route mail through an SMTP provider such as Amazon SES, SendGrid or Mailgun. Install a mail module to do this:

cd /var/www/drupal
sudo -u www-data composer require drupal/symfony_mailer
sudo -u www-data /var/www/drupal/vendor/bin/drush --root=/var/www/drupal/web \
  pm:install symfony_mailer

After the module is installed, open Configuration, then System, then Mailer. Enter your provider's SMTP host, port, encryption and credentials, then send a test message.

For any production Drupal deployment, serve the site over HTTPS so that session cookies and authentication tokens cannot be intercepted. The image ships with nginx, which Certbot can configure automatically.

The following commands assume a DNS record that points your fully qualified domain name at the instance's public IP address.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d drupal.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

After Certbot finishes, rebuild Drupal's caches so it serves assets under the new HTTPS base URL:sudo -u www-data /var/www/drupal/vendor/bin/drush --root=/var/www/drupal/web cache:rebuild.

Drupal has two data sources that you must back up together: the MariaDB database and the site files in /var/www/drupal. The site files include the code tree, the Composer dependencies and the uploaded files under web/sites/default/files.

sudo mysqldump --single-transaction drupal > /var/backups/drupal-db-$(date +%F).sql
sudo tar --acls --xattrs -czf /var/backups/drupal-files-$(date +%F).tgz -C /var/www drupal

Copy both backups to an Amazon S3 bucket or another object store. The drush cron timer installed with the image runs Drupal's scheduled tasks hourly. Review its status under Reports, then Status report.

Ubuntu's unattended-upgrades is enabled by default, so security patches for the kernel and packages apply automatically. To update Drupal core and contributed modules, use Composer:sudo -u www-data composer update in /var/www/drupal, followed by drush updatedb and drush cache:rebuild.

For larger deployments, decouple Drupal from the single-instance pattern:

• Move MariaDB to Amazon RDS for MariaDB and update the database connection in /var/www/drupal/web/sites/default/settings.php
• Put the Drupal web tier behind an Application Load Balancer and scale horizontally with an Auto Scaling group, with web/sites/default/files on Amazon EFS shared storage
• Offload caching to Amazon ElastiCache for Redis through the Drupal redis module
• Push static assets and uploaded files to Amazon S3 through the Drupal s3fs module

The official Drupal documentation at https://www.drupal.org/docs covers each of these under "Hosting, installing, and upgrading".