Memcached

Sign in to the AWS Management Console, open the EC2 service and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Memcached. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger as a balanced default, sized to the working set you intend to cache. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound port 11211 from your application tier's CIDR. Do not open port 11211 to the public internet.

Select Launch instance. First-boot initialization takes only a few seconds after the instance state becomes Running and the status checks pass.

Run the following command to launch an instance from the SecureAnyCloud Memcached Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens port 22 from your management network and port 11211 from your application CIDR.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":20,"VolumeType":"gp3"}}' \
  --metadata-options 'HttpTokens=required,HttpEndpoint=enabled' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=memcached}]'

Connect over SSH as the default login user for the operating system variant you launched. The login user differs by variant:

Operating system variant SSH login user

Ubuntu 24.04 ubuntu

Replace <key-file> with the path to your private key file and <instance-public-ip> with the public IP address or DNS name of the instance.

ssh -i <key-file> ubuntu@<instance-public-ip>

Each instance stores its own SASL password in a root-only file. Read it with sudo:

sudo cat /root/memcached-credentials.txt

The file contains the SASL MEMCACHED_USER (always SecureAnyCloud), the rotated MEMCACHED_PASSWORD, the listening port and address, and the instance's public IP. Keep this file private. It is the only place on the instance where the rotated password is stored.

Memcached listens on TCP 11211 and the nginx health-check shim listens on TCP 80. Confirm both listeners with ss:

ss -tln | grep -E ':(11211|80) '

Confirm that the systemd units are active and check the Memcached version:

systemctl is-active memcached.service nginx.service memcached --version

Probe the nginx health-check shim. It returns OK with HTTP 200. AWS Marketplace and external load balancers use this endpoint, not Memcached's own protocol.

curl -s http://127.0.0.1/

The libmemcached-tools package provides a headless command-line interface for managing the cache. Every command needs the --binary flag, because SASL works only over the binary protocol. Every command also needs the per-instance username and password.

Run memcstat to print server statistics: uptime, version, current connections, hit and miss counters, and memory usage. Read the password from /root/memcached-credentials.txt and pass it on the same line:

PASS=$(sudo grep '^MEMCACHED_PASSWORD=' /root/memcached-credentials.txt | cut -d= -f2-) && memcstat --servers=127.0.0.1:11211 --binary --username='sac' --password="${PASS}" | head -10

Check whether a key exists with memcexist. The command exits 0 when the key is present and non-zero otherwise. The following example probes a key that does not exist, so it exits non-zero:

PASS=$(sudo grep '^MEMCACHED_PASSWORD=' /root/memcached-credentials.txt | cut -d= -f2-) && memcexist --servers=127.0.0.1:11211 --binary --username='sac' --password="${PASS}" some-key; echo "memcexit_exit=$?"

The image ships the python3-pylibmc client library, which supports SASL out of the box. Run a SET / GET / DELETE round trip with this one-liner:

PASS=$(sudo grep '^MEMCACHED_PASSWORD=' /root/memcached-credentials.txt | cut -d= -f2-) && python3 -c "import pylibmc; c=pylibmc.Client(['127.0.0.1:11211'], binary=True, username='sac', password='${PASS}'); c.set('greeting','hello sac'); print('SET ok'); print('GET:', c.get('greeting')); c.delete('greeting'); print('DELETE ok')"

The same pylibmc.Client constructor works from any client host that can reach the instance on port 11211. In application code, point ['<instance-private-ip>:11211'] at the instance's private address in your VPC.

The default cache size on this image is 64 MiB, and production workloads almost always need more. Edit /etc/memcached.conf and set the -m value to the number of megabytes of RAM you want Memcached to use:

sudo sed -i 's/^-m .*/-m 1024/' /etc/memcached.conf
sudo systemctl restart memcached.service

This setting gives Memcached 1 GiB. Memcached allocates slab pages on demand. Raise -m toward, but never above, the instance's free RAM minus headroom for the kernel and any companion services. Confirm the new size by re-running memcstat and reading the limit_maxbytes line.

If your security group allows port 11211 from 0.0.0.0/0, edit the instance's security group and replace that source with the CIDR of your application tier, for example the private subnet your web fleet runs in. Apply the same principle to SSH (22) and the nginx shim (80): restrict both to your management CIDR.

aws ec2 revoke-security-group-ingress \
  --group-id <security-group-id> \
  --protocol tcp --port 11211 --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress \
  --group-id <security-group-id> \
  --protocol tcp --port 11211 --cidr <your-app-cidr>

The per-instance password is generated on first boot and is not changed again. To rotate it, write a new password to the SASL database and update the credentials file. saslpasswd2 reads the new password from stdin when you pass -p:

NEW=$(openssl rand -hex 16)
echo -n "${NEW}" | sudo saslpasswd2 -p -c -a memcached -f /etc/sasl2/memcached-sasldb2 sac
sudo chown memcache:memcache /etc/sasl2/memcached-sasldb2
sudo chmod 0640 /etc/sasl2/memcached-sasldb2
sudo sed -i "s/^MEMCACHED_PASSWORD=.*/MEMCACHED_PASSWORD=${NEW}/" /root/memcached-credentials.txt
sudo systemctl restart memcached.service

The restart flushes the cache contents. This is normal for Memcached, and in most cache designs it is acceptable during rotation because cache misses are non-fatal.

Read the Memcached service journal to inspect live operations and authentication events:

sudo journalctl -u memcached.service --no-pager -n 30

Flush the entire cache. This drops every key and keeps the server running:

PASS=$(sudo grep '^MEMCACHED_PASSWORD=' /root/memcached-credentials.txt | cut -d= -f2-) && memcflush --servers=127.0.0.1:11211 --binary --username='sac' --password="${PASS}"

Restart Memcached. The restart wipes the cache contents, because Memcached is volatile:

sudo systemctl restart memcached.service

Memcached on this image is installed from the Ubuntu package repository, so the standard apt upgrade flow applies. New versions arrive through normal Ubuntu security and stable updates.

sudo apt-get update
sudo apt-get install -y memcached
sudo systemctl restart memcached.service memcached --version

The upgrade does not change the SASL configuration or the credentials file.