Redis

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Redis. Select the SecureAnyCloud listing, choose Select, and then choose Continue on the subscription summary.

Choose an instance type of m5.large or larger, and choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and port 6379 from the CIDRs that need to reach Redis.

Open port 80 as well if you want to confirm from a web browser that the image is alive, using the static identification page. Keep the root volume at the default size or larger.

Select Launch instance. First-boot initialisation generates the requirepass and starts Redis. It takes a few seconds after the instance state becomes Running and the status checks pass.

Run the following command to launch an instance from the SecureAnyCloud Redis Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens inbound port 22.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options HttpTokens=required \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":20,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=redis-01}]'

On success, the command prints a JSON document. Note the instance ID, and then retrieve the public address once the instance is running with this command:aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

While the instance is starting, open http://<public-ip>/ in any web browser to confirm that the image is alive. The image serves a small static identification page on port 80. The page names the product and tells you which file holds the rotated Redis password, but it never embeds the password.

If you do not want to expose port 80 to the public internet, restrict the security group rule to your management network or remove the rule. The identification page is a convenience, and Redis itself does not need it.

Connect over SSH with the key pair that you selected and the public IP address from step 2. For the Redis 7.4 on Ubuntu 24.04 AMI variant, the SSH login user is ubuntu:

ssh <login-user>@<public-ip>

Wait until the instance has passed both EC2 status checks before you connect. The first-boot service runs before the SSH daemon is ready, so Redis is already initialised by the time you can log in.

The first-boot service generates a fresh requirepass for this instance and writes it, with the connection details, to /root/redis-credentials.txt. Only the root user can read the file. Display it from your SSH session:

sudo cat /root/redis-credentials.txt

The file looks like this, but your instance has its own unique password:

# Redis 7.4 -- Per-Instance Credentials
# Generated at first boot: Sun May 24 23:45:14 UTC 2026
#
# Connect locally on the instance:
# redis-cli -a '<REDIS_PASSWORD>' --no-auth-warning PING
# -> PONG
# redis-cli -a '<REDIS_PASSWORD>' --no-auth-warning SET hello world
# redis-cli -a '<REDIS_PASSWORD>' --no-auth-warning GET hello
#
# Connect from your VPC (the security group must allow 6379 from your CIDR):
# redis-cli -h <public-ip> -p 6379 -a '<REDIS_PASSWORD>' --no-auth-warning PING
# redis_user=default requirepass=<REDIS_PASSWORD> REDIS_USER=default REDIS_PASSWORD=<REDIS_PASSWORD> LISTEN_PORT=6379 LISTEN_ADDRESS_LOCAL=127.0.0.1 LISTEN_ADDRESS_VPC=0.0.0.0

Store the password somewhere safe. The first-boot service updates this file each time it runs, but it runs only once per instance, so later boots leave the file unchanged.

Redis and nginx both run as systemd services. Confirm that they are active:

sudo systemctl is-active redis-server.service
sudo systemctl is-active nginx.service

Expected output:

active active

Confirm the listening sockets. Redis listens on TCP 6379 and nginx on TCP 80:

sudo ss -tln | grep -E ":(6379|80) "

Expected output:

LISTEN 0 511 0.0.0.0:6379 0.0.0.0:* LISTEN 0 511 0.0.0.0:80 0.0.0.0:*

Check the installed Redis version with the bundled redis-cli client:

redis-cli --version

Expected output:

redis-cli 7.4.9

Read the requirepass from /root/redis-credentials.txt and use it with redis-cli. The simplest approach is a one-liner that reads the password and stores it in a shell variable for the rest of the session:

PASS=$(sudo grep '^REDIS_PASSWORD=' /root/redis-credentials.txt | cut -d= -f2-)
redis-cli -a "$PASS" --no-auth-warning PING

Expected output:

PONG

The --no-auth-warning flag suppresses a harmless warning about passing the password on the command line. To keep the password out of your shell history, you can also supply it through environment variables or ~/.bashrc style configuration.

Store a key and read it back. The commands below read the password again so that the snippet is self-contained. In an interactive session, the $PASS variable from the previous step is still in scope.

PASS=$(sudo grep '^REDIS_PASSWORD=' /root/redis-credentials.txt | cut -d= -f2-)
redis-cli -a "$PASS" --no-auth-warning SET mykey "hello sac"
redis-cli -a "$PASS" --no-auth-warning GET mykey

Expected output:

OK hello sac

You can also use Redis from any host that can reach port 6379 on the instance. From your workstation or application server, run:

redis-cli -h <public-ip> -p 6379 -a '<password>' --no-auth-warning PING

Make sure that the security group on the instance allows inbound TCP 6379 from the source CIDR. Redis refuses anonymous connections regardless of the security group, because authentication is enforced inside Redis itself.

The INFO command returns detailed operational information. Its server section shows the version, build identifier, mode and host kernel:

PASS=$(sudo grep '^REDIS_PASSWORD=' /root/redis-credentials.txt | cut -d= -f2-)
redis-cli -a "$PASS" --no-auth-warning INFO server | head -10

Expected output:

# Server redis_version:7.4.9 redis_git_sha1:00000000 redis_git_dirty:0 redis_build_id:74932331a9f87821 redis_mode:standalone os:Linux 6.8.0-1009-aws x86_64 arch_bits:64 monotonic_clock:POSIX clock_gettime multiplexing_api:epoll

Other useful sections are clients, memory, persistence, stats, replication and keyspace. Pass the section name as the argument to INFO, for example INFO memory.

The image enables RDB snapshot persistence with the upstream Redis defaults (save 3600 1, save 300 100, save 60 10000), and writes snapshots under /var/lib/redis. To enable append-only file persistence for write-heavy durability, set the following in /etc/redis/conf.d/sac-persistence.conf and restart Redis:

appendonly yes appendfsync everysec

sudo systemctl restart redis-server

No memory cap is set by default, so Redis uses all available RAM. For a cache workload, set maxmemory and an eviction policy in /etc/redis/conf.d/sac-memory.conf:

maxmemory 4gb maxmemory-policy allkeys-lru

sudo systemctl restart redis-server

For replication, run a second instance from this AMI in the same VPC and security group. Configure the replica to follow the primary by adding two settings to /etc/redis/conf.d/sac-replica.conf: a replicaof <primary-ip> 6379 line, and the primary's requirepass in masterauth.

The upstream Redis documentation at https://redis.io/docs/latest/operate/ covers replication and Sentinel in detail.

Redis and nginx are standard systemd units. Use these commands to manage them:

sudo systemctl status redis-server.service
sudo systemctl restart redis-server.service
sudo journalctl -u redis-server.service --since "1 hour ago"

The Redis configuration is at /etc/redis/redis.conf. SecureAnyCloud adds an include /etc/redis/conf.d/*.conf line, so per-instance overrides live in their own files and survive package upgrades. The first-boot service writes /etc/redis/conf.d/sac-auth.conf with the rotated requirepass.

If you change bind, port or any other listener setting, update the security group to match before you restart Redis.