Eclipse RDF4J 6.1.0

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened Neo4j & Graph and RDF Databases AMIs listing on AWS Marketplace, choose View purchase options, and then choose Subscribe. One subscription covers every version in the listing.
• Choose Launch your software. In Version, choose Eclipse RDF4J 6.1.0 on Ubuntu 24.04 - YYYY-MM-DD, then choose your Region.
• Select an instance type. m5.large is recommended.
• Choose your EC2 key pair.
• Configure the security group to allow TCP 22 from your own address and TCP 443 (and 80) from your clients.
• Choose Launch. First boot takes about a minute after the instance is reachable. During that time it generates this instance's certificate and admin password and starts Tomcat.

Option B: AWS CLI

Run the following on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and replace the key pair, security group and subnet with your own:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=rdf4j}]'

The AMI already requires IMDSv2, so you do not need --metadata-options.

ssh -i my-key-pair.pem ubuntu@<vm-ip>

The login banner shows the Workbench and RDF4J Server URLs for this instance.

Confirm that Tomcat and nginx are running and that the unauthenticated health endpoint answers over HTTPS. The certificate is unique to the instance and covers localhost, so curl can verify it with --cacert:

systemctl is-active tomcat.service nginx.service curl -s --cacert /etc/ssl/rdf4j/rdf4j.crt -o /dev/null -w 'healthz: HTTP %{http_code}\n' https://localhost/healthz

Both services report active, and /healthz returns HTTP 200. nginx answers this endpoint itself, and it needs no login.

The admin password is unique to this instance. First boot writes it to a root-only file. Print only the field names, never the password itself:

sudo grep -oE '^[A-Z0-9_]+=' /root/rdf4j-credentials.txt

The output lists RDF4J_HOST, RDF4J_WORKBENCH_URL, RDF4J_SERVER_URL, RDF4J_ADMIN_USER (admin) and RDF4J_ADMIN_PASSWORD (the per-instance password). When you need the password, read it with sudo sed -n 's/^RDF4J_ADMIN_PASSWORD=//p' /root/rdf4j-credentials.txt. Keep it safe, because it unlocks the Workbench, the REST API and every SPARQL endpoint.

Every path requires the admin login. The server rejects an anonymous request, or a wrong password, with 401:

CA=/etc/ssl/rdf4j/rdf4j.crt curl -s --cacert $CA -o /dev/null -w 'anonymous Workbench: HTTP %{http_code}\n' https://localhost/rdf4j-workbench/ curl -s --cacert $CA -o /dev/null -w 'anonymous repositories: HTTP %{http_code}\n' https://localhost/rdf4j-server/repositories curl -s --cacert $CA -u 'admin:wrong-password' -o /dev/null -w 'wrong password: HTTP %{http_code}\n' https://localhost/rdf4j-server/repositories

Each returns HTTP 401. With the per-instance password the server answers 200:

PW=$(sudo sed -n 's/^RDF4J_ADMIN_PASSWORD=//p' /root/rdf4j-credentials.txt)
curl -s --cacert /etc/ssl/rdf4j/rdf4j.crt -u "admin:$PW" -o /dev/null -w 'authenticated: HTTP %{http_code}\n' https://localhost/rdf4j-server/repositories

Open https://<public-dns>/rdf4j-workbench/ in your browser and sign in as admin with the per-instance password. The certificate is self-signed and unique to this instance, so your browser warns once. For production, serve the instance under your own DNS name with a trusted certificate (Step 8).

The image ships with no repositories. The List of Repositories page shows each repository you create with its id, description and location:

Select New repository to create a repository. Choose the store type (memory, native or LMDB, optionally with RDFS inferencing, SHACL or Lucene search, a SPARQL endpoint proxy or a federation), an id and a title:

Load data with Add by uploading a file, pasting RDF or giving an http(s) URL. Then run SPARQL in Query. The result table below is a SPARQL SELECT over a small example catalogue of books:

Summary reports the repository's server, store type and statement count:

Everything the Workbench does is also available over the RDF4J REST API at https://<public-dns>/rdf4j-server/. Create a native (on-disk) repository named books:

PW=$(sudo sed -n 's/^RDF4J_ADMIN_PASSWORD=//p' /root/rdf4j-credentials.txt)
cat > /tmp/books-config.ttl <<'EOF' @prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#>. @prefix config: <tag:rdf4j.org,2023:config/>. [] a config:Repository ; config:rep.id "books" ; rdfs:label "Example books repository" ; config:rep.impl [ config:rep.type "openrdf:SailRepository" ; config:sail.impl [ config:sail.type "openrdf:NativeStore" ] ]. EOF curl -s --cacert /etc/ssl/rdf4j/rdf4j.crt -u "admin:$PW" -o /dev/null -w 'create repository: HTTP %{http_code}\n' \
  -X PUT -H 'Content-Type: text/turtle' --data-binary @/tmp/books-config.ttl \
  https://localhost/rdf4j-server/repositories/books rm -f /tmp/books-config.ttl

The server answers HTTP 204. Insert a triple with SPARQL Update and read it back with a SPARQL query:

PW=$(sudo sed -n 's/^RDF4J_ADMIN_PASSWORD=//p' /root/rdf4j-credentials.txt)
curl -s --cacert /etc/ssl/rdf4j/rdf4j.crt -u "admin:$PW" -o /dev/null -w 'update: HTTP %{http_code}\n' \
  --data-urlencode 'update=INSERT DATA { <http://example.org/book1> <http://purl.org/dc/elements/1.1/title> "SPARQL Tutorial" }' \
  https://localhost/rdf4j-server/repositories/books/statements
curl -s --cacert /etc/ssl/rdf4j/rdf4j.crt -u "admin:$PW" -H 'Accept: text/csv' --get \
  --data-urlencode 'query=SELECT ?title WHERE { ?b <http://purl.org/dc/elements/1.1/title> ?title }' \
  https://localhost/rdf4j-server/repositories/books

The update returns HTTP 204, and the query prints title followed by SPARQL Tutorial. Any SPARQL 1.1 client can use https://<public-dns>/rdf4j-server/repositories/books as its query endpoint and .../books/statements as its update endpoint, with HTTP Basic authentication.

Point a DNS record at the instance, then regenerate the certificate and pin the served hostname:

sudo rdf4j-set-hostname rdf4j.example.com

This command issues a new self-signed certificate for that name and makes nginx answer only for it. For production, replace the certificate with your own CA-issued certificate. For a public, browser-trusted certificate, terminate TLS at an Application Load Balancer or CloudFront in front of the instance, and keep the security group's port 443 open only to that front end.

To give Tomcat a fixed heap instead of 50% of memory, run sudo systemctl edit tomcat.service and add an [Service] section with Environment="CATALINA_OPTS=-Xmx6g -XX:MaxMetaspaceSize=256m -Dorg.eclipse.rdf4j.appdata.basedir=/var/lib/rdf4j -Djava.awt.headless=true". Then run sudo systemctl restart tomcat.service.