Strapi

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Strapi. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of t3.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet. Create or select a security group that opens port 22 from your management network and port 80 for the admin panel and the content API. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation generates the application secrets, creates the admin user and starts the services. This takes up to a minute after the instance state becomes Running and the status checks pass.

Run the following command to launch an instance from the SecureAnyCloud Strapi Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing. Replace <key-name> with your EC2 key pair name and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=strapi}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can read them from the EC2 console or with aws ec2 describe-instances.

Connect over SSH with your key pair and the login user for your operating system variant.

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i <key-name>.pem ubuntu@<public-ip>

Over SSH, confirm that Strapi and the nginx proxy are active and that Strapi answers its health check on loopback:

sudo systemctl is-active strapi nginx curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:1337/_health

Both services should report active, and the health check should return 204. Strapi listens on 127.0.0.1:1337 (loopback only), and nginx publishes it on port 80.

The Strapi administrator password is unique to your instance and was generated on first boot. Read the credentials file as root:

sudo cat /root/strapi-credentials.txt

The file lists the admin panel URL, the administrator email (admin@sac.local) and the generated password. Keep the password somewhere safe.

nginx serves the Strapi admin panel on port 80 at the /admin path. In a browser, go to:

http://<instance-public-ip>/admin

Sign in with the email admin@sac.local and the password from the credentials file. You land on the administration home, which summarises your last edited and last published entries and your profile.

Open the Content-Type Builder from the left navigation. Create collection types for repeatable content such as articles or products, single types for one-off content such as a homepage, and reusable components.

For each type, add fields such as text, rich text, media, relations, JSON and dates. Strapi writes the schema to disk.

After you save a content type, create and edit entries in the Content Manager. It lists the entries for each type and supports the draft and publish workflow. A fresh image ships with the built-in User collection type from the Users and Permissions plugin and no custom content.

Strapi automatically exposes a fully documented REST API for every content type you create. nginx serves it on port 80 alongside the admin panel. A collection type named article, for example, is available at http://<instance-public-ip>/api/articles.

By default the API is locked down. Grant public read access or issue API tokens before you consume it.

• Roles and permissions: in the admin panel, open Settings, then Users and Permissions plugin, then Roles. Enable the find and findOne actions for the relevant content type on the Public role to allow anonymous reads. Use the Authenticated role for signed-in users.
• API tokens: open Settings, then API Tokens, and create a token with read-only or full access. Send it as a bearer token on each request to http://<instance-public-ip>/api/..., for example Authorization: Bearer <token>.

Strapi also offers an official GraphQL plugin that publishes a single /graphql endpoint with a playground. It is an optional add-on and not part of the base image. Install it from the application directory and rebuild the admin panel:

cd /opt/strapi
sudo -u strapi npm install @strapi/plugin-graphql
sudo -u strapi env NODE_ENV=production npm run build
sudo systemctl restart strapi

After the restart the GraphQL endpoint is available at http://<instance-public-ip>/graphql.

The content store lives on a dedicated EBS volume mounted at /var/lib/strapi. This keeps the SQLite database (data.db) and your uploaded media off the operating system disk, and you can resize or snapshot the volume independently. The application's public/uploads directory is symlinked here, so all media is stored on the data volume. Confirm the mount:

df -h /var/lib/strapi

To grow the content store, expand the EBS volume in the AWS console. Then grow the filesystem on the instance by running sudo resize2fs on the underlying device.

The SQLite database suits development and small to medium production workloads. For larger deployments, point Strapi at an external PostgreSQL database by editing the DATABASE_ settings in /opt/strapi/.env.

nginx serves the admin panel and the content API over plain HTTP on port 80. In production, place them behind TLS.

Obtain a certificate for your domain, for example a managed certificate on an Application Load Balancer in front of the instance, or Certbot installed on the instance. Then configure nginx to listen on 443 with your certificate and proxy to 127.0.0.1:1337, exactly as the bundled site does for port 80. Keep the WebSocket upgrade headers in place.

When you serve the panel over HTTPS, set url and the public URL in /opt/strapi/config/server.js to your https://your-domain. This ensures admin and API links are generated correctly. Restrict the security group so ports 80 and 443 are reachable only from the networks that use the panel and the API.

Back up the content store by snapshotting the /var/lib/strapi EBS volume. The snapshot captures the SQLite database and all uploaded media in one consistent image. For an application-level backup, copy data.db and the uploads directory off the instance.

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade. Reboot when a new kernel is installed. Strapi and nginx start automatically on boot.

To update Strapi itself, follow the upgrade guidance in the Strapi documentation. Run it from the /opt/strapi application directory as the strapi user, then rebuild the admin panel and restart the service.