MongoDB

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for MongoDB Community Server.

Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger as a balanced default. Size the instance to the working set your collections require. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network. If your application servers run in the same VPC and need to reach the database, also open inbound TCP port 27017 from those servers' security group.

Select Launch instance. First-boot initialization takes about a minute after the instance state becomes Running and the status checks pass. During that window, mongodb-firstboot.service rotates the admin and application passwords.

The following command launches an instance from the SecureAnyCloud MongoDB Community Server Marketplace AMI into an existing subnet and security group.

Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens port 22 from your management network and, optionally, port 27017 from your application tier.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}' \
  --metadata-options 'HttpTokens=required,HttpEndpoint=enabled' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=mongodb-server}]'

The image attaches a dedicated 30 GiB database storage volume automatically, mounted at the MongoDB data directory. To start with more database storage, enlarge that volume on the Storage step in the console, or add a second block device mapping on the CLI.

Connect to the instance with SSH as the default login user for the operating system variant you launched. The login user differs by variant:

Operating system variant SSH login user

Ubuntu 24.04 ubuntu

Replace <key-file> with the path to your private key file and <instance-public-ip> with the public IP address or DNS name of the instance.

ssh -i <key-file> ubuntu@<instance-public-ip>

On first boot, the mongodb-firstboot.service one-shot generates two passwords unique to your instance. It writes them to /root/mongodb-credentials.txt, which only the root user can read. Display the file with sudo:

sudo cat /root/mongodb-credentials.txt

The file lists two accounts:

• MONGO_ADMIN_USER=admin with role root in the admin database, for full cluster administration
• MONGO_APP_USER=sac with roles readWrite and dbAdmin in the appdb database, for the application tier

Both passwords are unique to this instance. They were created by openssl rand -hex 16 on first boot. Keep them in a secrets manager, and treat the credentials file as read-only on the instance.

Check the installed server and shell versions, then the dedicated data volume.

mongod --version | head -1

mongosh --version

Confirm that the database service and the healthcheck shim are running:

systemctl is-active mongod.service nginx.service

Confirm that mongod is bound to all interfaces on port 27017, and that the database data directory is on its own filesystem:

sudo ss -tln | grep ':27017' findmnt /var/lib/mongodb df -h /var/lib/mongodb

Use the admin password from /root/mongodb-credentials.txt to open mongosh against the local node, authenticating against the admin database.

The command below reads the password from the credentials file, so you never type the plaintext on the command line.

ADMIN_PASS=$(sudo grep '^MONGO_ADMIN_PASSWORD=' /root/mongodb-credentials.txt | cut -d= -f2-) mongosh --host 127.0.0.1 --port 27017 -u admin -p "$ADMIN_PASS" --authenticationDatabase admin --eval 'db.adminCommand({ping:1}).ok'

The command prints 1 if the admin user authenticated and the deployment responded to ping.

To start an interactive shell session as the admin user, drop the --eval argument:

ADMIN_PASS=$(sudo grep '^MONGO_ADMIN_PASSWORD=' /root/mongodb-credentials.txt | cut -d= -f2-) mongosh --host 127.0.0.1 --port 27017 -u admin -p "$ADMIN_PASS" --authenticationDatabase admin

Inside the interactive shell, list the databases with show dbs. Leave the shell with exit.

The application user (SecureAnyCloud) has the readWrite and dbAdmin roles on the appdb database.

The command below reads the application password from the credentials file and runs an end-to-end probe. It inserts a document, finds it again, then drops the test collection.

APP_PASS=$(sudo grep '^MONGO_APP_PASSWORD=' /root/mongodb-credentials.txt | cut -d= -f2-) mongosh --quiet --host 127.0.0.1 --port 27017 -u sac -p "$APP_PASS" --authenticationDatabase appdb appdb --eval ' db.demo.insertOne({hello: "world", ts: new Date()}); printjson(db.demo.findOne({hello: "world"})); db.demo.drop(); '

SecureAnyCloud's build pipeline uses this same round trip to prove that the rotated application password works on every image before the AMI ships.

To connect from another EC2 instance in the same VPC, give that instance a security group that allows outbound TCP 27017 to the MongoDB instance. Then add an inbound rule on the MongoDB instance's security group that allows TCP 27017 from the application server's security group.

A standard MongoDB connection string for the application user looks like this. Replace <MONGO_APP_PASSWORD> with the password shown in /root/mongodb-credentials.txt, and <mongodb-private-ip> with the MongoDB instance's private IP address.

mongodb://sac:<MONGO_APP_PASSWORD>@<mongodb-private-ip>:27017/appdb?authSource=appdb

Most MongoDB drivers accept this connection string directly. The equivalent mongosh command is:

mongosh "mongodb://sac:<MONGO_APP_PASSWORD>@<mongodb-private-ip>:27017/appdb?authSource=appdb"

Database files and the WiredTiger journal are stored under /var/lib/mongodb, a separate filesystem on its own EBS volume. Confirm the dedicated mount and review free space with:

findmnt /var/lib/mongodb df -h /var/lib/mongodb

Because the data directory is on its own volume, you can grow it independently of the operating system disk. Modify the EBS volume in the AWS console or with the CLI. Then extend the filesystem on the instance with sudo resize2fs against the volume's device.

Keep the operating system patched with the standard package manager. The official MongoDB APT repository is already configured on the image, so MongoDB Community Server upgrades arrive through the normal package update process.

Review the database log files under /var/log/mongodb/ for slow operations and connection events. Use the mongotop and mongostat tools from the mongodb-database-tools package to monitor server activity. Alternatively, connect a metrics collector to the diagnostic data under /var/lib/mongodb/diagnostic.data.

To take a logical backup of the appdb database, run mongodump authenticated as the application user. Restore with mongorestore. Run mongodump --help and mongorestore --help on the instance for the full set of options.

For a multi-node replica set, add further nodes, each running this same image or any compatible MongoDB build. Reconfigure replication.replSetName in /etc/mongod.conf on every node and restart mongod.service. Then run rs.initiate() followed by rs.add() from the primary's mongosh session.