Deployment guide

Trino

Overview

Trino (formerly PrestoSQL) is a fast, distributed SQL query engine for big-data analytics. It federates queries across data sources where the data lives. You can run interactive SQL over object storage, relational databases, NoSQL stores and streaming systems without first copying everything into a warehouse.

This SecureAnyCloud image installs Trino 476 at /opt/trino as a single-node deployment, with the coordinator and worker on one node. Trino runs as a dedicated trino system user, and its HTTP server is bound to loopback behind an nginx reverse proxy on TCP 80 with HTTP Basic auth. Trino's data directory is on a dedicated Azure data disk, and a unique web password is generated on the first boot of every VM. A built-in tpch catalog ships with the image, so you can query real sample data out of the box.

What you get:

Trino 476 (single-node coordinator and worker) at /opt/trino, running on a Temurin 24 JRE
The Trino Web UI and REST API, fronted by nginx on :80
nginx HTTP Basic auth, because Trino's Web UI and API are otherwise open by default, with a per-VM password in a root-only file
The Trino CLI at /opt/trino/bin/trino
A built-in tpch catalog (connector.name=tpch) with sample data, so you can query immediately
A dedicated Azure data disk at /var/lib/trino that holds Trino's data directory and spill, separate from the OS disk and re-provisioned with every VM
trino.service and nginx.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet and subnet in the target region
Standard_B4ms (4 vCPU / 16 GiB RAM) as a starting size. Trino is a JVM query engine and benefits from RAM, so scale up for higher concurrency and larger datasets.
NSG inbound rules that allow 22/tcp from your management network and 80/tcp for the Web UI and API. Front the Web UI and API with TLS for public exposure (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Trino by SecureAnyCloud, and select Create. On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). On the Disks tab, check the dedicated data disk. Then choose Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:trino-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name trino \
  --image sac1647283583153:trino-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name trino --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active trino.service nginx.service

Both services report active. Trino is a JVM query engine, so it takes around 30-60 seconds after boot to finish starting. Once started, it accepts SQL immediately.

Step 5 - Retrieve your web password

The admin password is generated uniquely on the first boot of your VM and written to a root-only file. Print the file with the following command.

sudo cat /root/trino-credentials.txt

The file contains trino.user (admin), trino.password and the URLs for the Web UI and API. Store the password somewhere safe.

Step 6 - Check the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes. Request it with the following command.

curl -s http://localhost/health

The endpoint returns ok.

Step 7 - Open the Trino Web UI

Go to http://<vm-public-ip>/ui/ in a browser and sign in as admin with the password from Step 5. The Web UI shows the cluster overview, including running, queued and finished queries, plus worker and resource status. Submit a query (see Step 8 or Step 9), and it appears in the query list. Click any query to inspect its stages, splits and timeline.

Click a finished query to drill into its detail, which shows the execution stages, operator pipeline and timing.

The cluster view reports the active worker, its node status and the running build.

A completed tpch query appears in the query list with its state, elapsed time and rows processed.

Step 8 - Query with the REST API

The REST API is available behind the same Basic auth. Confirm that Trino is serving, and report its version and readiness.

curl -s -u admin:<TRINO_ADMIN_PASSWORD> http://localhost/v1/info; echo

The response is JSON. Once the engine is fully up, nodeVersion.version is 476 and starting is false.

Step 9 - Run a SQL query with the Trino CLI

The Trino CLI ships at /opt/trino/bin/trino. The built-in tpch catalog exposes the standard TPC-H schemas (tiny, sf1, sf100 and larger), so you can query real sample data with no external data source. Run a query against tpch.tiny.

/opt/trino/bin/trino --server http://127.0.0.1:8080 --catalog tpch --schema tiny --execute 'SELECT count(*) FROM nation'

The query returns 25. Next, try a richer query that totals order value by market segment.

/opt/trino/bin/trino --server http://127.0.0.1:8080 --catalog tpch --schema tiny --execute "SELECT c.mktsegment, round(sum(o.totalprice), 2) AS revenue FROM orders o JOIN customer c ON o.custkey = c.custkey GROUP BY c.mktsegment ORDER BY revenue DESC"

You can also start an interactive session by omitting --execute.

/opt/trino/bin/trino --server http://127.0.0.1:8080 --catalog tpch --schema tiny trino:tiny> SHOW SCHEMAS; trino:tiny> SELECT name FROM region ORDER BY regionkey; trino:tiny> quit;

Step 10 - Connect BI tools and applications

Trino speaks the standard Trino/Presto protocol over HTTP, so most BI and analytics tools connect through the official JDBC/ODBC drivers or a native Trino connector. Point the client at the VM on port 80, authenticate with user admin and the password from Step 5, and select the tpch catalog (or any catalog you add). For example, the JDBC URL is the following.

jdbc:trino://<vm-public-ip>:80/tpch/tiny

Use username admin and the per-VM password. Tools such as DBeaver, Superset, Tableau, Power BI and Metabase all connect this way. For production use, terminate TLS in front of nginx (see Enabling HTTPS) and use jdbc:trino://<host>:443/... with SSL enabled. To query your own data, add a catalog file under /opt/trino/etc/catalog/, for example a PostgreSQL, MySQL, Hive or Iceberg connector, and restart Trino.

Step 11 - Confirm data lives on the dedicated disk

Trino's data directory is stored on the dedicated Azure data disk, so it survives OS changes and can be resized independently. Confirm the mount with the following command.

findmnt /var/lib/trino

The mount is backed by a separate Azure data disk that is captured into the image and re-provisioned on every VM.

Enabling HTTPS

The nginx reverse proxy terminates plain HTTP on port 80. For public exposure, put a certificate in front of it. The simplest approach is to add a DNS name for the VM, then do one of the following. Use the companion SecureAnyCloud nginx-ssl-certbot image as a TLS reverse proxy. Alternatively, install certbot and extend the existing nginx site with a listen 443 ssl; server block and your certificate paths. Keep Trino itself bound to loopback, so the only public surface is the authenticated, TLS-terminated proxy.

Maintenance

Configuration: Trino's configuration lives under /opt/trino/etc/ (config.properties, node.properties, jvm.config), and catalogs live under /opt/trino/etc/catalog/. Edit a file, then run sudo systemctl restart trino to apply the change.
Adding data sources: Drop a <name>.properties catalog file in /opt/trino/etc/catalog/, for example connector.name=postgresql with the JDBC URL and credentials, and restart Trino. The catalog then appears immediately to clients.
Backups: Snapshot the /var/lib/trino data disk. Trino itself is stateless for query results, and the persisted state is the catalog configuration under /opt/trino/etc.
Upgrades: Replace the contents of /opt/trino with a newer release that matches the required JDK, and restart the service.
Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Trino is a trademark of the Trino Software Foundation. This image is produced by SecureAnyCloud and is not affiliated with or endorsed by the Trino project. Trino is distributed under the Apache License 2.0.

Deploy on Azure

Launch Trino on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Trino, formerly known as PrestoSQL, is a fast, distributed SQL query engine for big-data analytics. It lets you run interactive ANSI SQL over data sources of any size and join across many systems in a single query.

This SecureAnyCloud image is configured as a single-node deployment, where one JVM acts as both the coordinator and the worker, so it runs SQL out of the box on a single instance.

What you get:

The Trino server installed under /opt/trino, running as a dedicated unprivileged trino system account under a systemd service that starts it on boot and restarts it on failure
Trino 481, which requires Java 25, so the image bundles an Eclipse Temurin 25 runtime under /opt/trino/jre and pins it to the engine
The engine configuration, the connector catalogs and the node data directory under /opt/trino-data, which is a dedicated, independently resizable EBS data volume
An engine that binds to the loopback interface only and is never exposed directly, because Trino's Web UI, REST API and JDBC endpoint have no usable authentication over plain HTTP
An nginx reverse proxy that publishes the Web UI, the query REST API and the JDBC and CLI endpoint on port 80 behind HTTP Basic authentication
An admin password generated on the first boot of every deployed instance, so two instances launched from the same Amazon Machine Image never share a password. The password is written to /root/trino-credentials.txt with mode 0600, so only the root user can read it.

Prerequisites

Before you deploy this image, you need the following.

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and port 80 for the Web UI, the REST API and JDBC
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Trino. Select the SecureAnyCloud listing and choose Select, then choose Continue on the subscription summary.

Pick an instance type of t3.large or larger. Trino is memory-hungry, so choose a larger instance for production query workloads. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and either create or select a security group that opens port 22 from your management network and port 80 for the Web UI and the APIs. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization takes a few seconds after the instance state becomes Running and the status checks pass. The JVM needs a little longer to finish starting the coordinator.

Launch the Instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud Trino Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=trino}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can find it in the EC2 console or with aws ec2 describe-instances.

Connect to Your Instance

Connect over SSH using your key pair and the login user for your operating system variant.

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i <key-name>.pem ubuntu@<public-ip>

Retrieve the Admin Password

The Trino admin password is unique to your instance and was generated on first boot. Read it as root.

sudo cat /root/trino-credentials.txt

The file lists the Trino URL, the admin user (admin), the generated password and an example CLI command. Keep the password somewhere safe.

Sign In to the Trino Web UI

nginx serves the Trino Web UI on port 80 behind HTTP Basic authentication. In a browser, go to the following address.

http://<instance-public-ip>/

The browser first prompts you for HTTP Basic credentials. Sign in as admin with the password from the credentials file. The Trino Web UI then shows its own login form. Enter the username admin and leave the password field blank, because nginx has already authenticated you. The cluster overview opens and shows the running worker, query throughput and the cluster state.

Run a query from the Web UI, the CLI or a SQL tool, and it appears in the query list. Select a query to open its detail view, which shows the execution stages, the query plan and live statistics.

The query list shows recently executed queries with their state, the submitting user and the elapsed time, so you can monitor activity across the cluster.

Confirm Trino Is Running

Over SSH, confirm that the engine and the nginx proxy are active and that the ports are listening.

sudo systemctl is-active trino nginx
sudo ss -tlnp | grep -E ':(80|8080) '

Both services report active, the engine listens on 127.0.0.1:8080 (loopback only), and nginx listens on port 80. You can check that the coordinator has finished starting with the unauthenticated health endpoint.

curl -s http://127.0.0.1:8080/v1/info

A response with "starting":false means the coordinator is ready to accept queries.

Run SQL with the Trino CLI

The image installs the Trino command-line client at /usr/local/bin/trino. On the instance, query the built-in tpch connector, which serves industry-standard sample data, so SELECT works immediately with no external database.

trino --server http://127.0.0.1:8080 --user admin --catalog tpch --schema tiny \
  --execute 'SELECT count(*) FROM nation'

The tpch connector exposes several scale-factor schemas (tiny, sf1, sf100 and larger). Run an aggregate query over the orders table.

trino --server http://127.0.0.1:8080 --user admin --catalog tpch --schema sf1 \
  --execute 'SELECT orderpriority, count(*) AS n FROM orders GROUP BY orderpriority ORDER BY orderpriority'

List the catalogs that are configured on the engine.

trino --server http://127.0.0.1:8080 --user admin --execute 'SHOW CATALOGS'

Create Tables with the Memory Connector

The bundled memory connector provides writable, in-memory tables that are useful for demos and intermediate results. Create a table, insert into it and read it back.

trino --server http://127.0.0.1:8080 --user admin --catalog memory --schema default \
  --execute "CREATE TABLE IF NOT EXISTS example AS SELECT 1 AS id, 'hello' AS label" trino --server http://127.0.0.1:8080 --user admin --catalog memory --schema default \
  --execute "SELECT * FROM example"

Memory connector data lives only in the JVM and is cleared when the engine restarts.

Connect over JDBC

Trino speaks the standard Trino JDBC protocol over the same port 80 proxy. From a SQL tool or application, use the Trino JDBC driver with a URL of the form jdbc:trino://<instance-public-ip>:80. Set the user to admin, and supply the generated password as the HTTP Basic credential. In many tools, this is the connection password field, with the SSL option turned off because the bundled proxy serves plain HTTP. You can then browse the tpch and memory catalogs and run SQL from your existing tooling, including BI dashboards and dbt.

Add a Connector Catalog

Trino reaches external systems through connector catalogs. Each catalog is a small properties file under /opt/trino-data/etc/catalog. For example, to add a PostgreSQL catalog, create /opt/trino-data/etc/catalog/postgresql.properties with the connector name and your connection details, then restart the engine.

sudo systemctl restart trino

The new catalog appears in SHOW CATALOGS once the engine has restarted. Trino ships connectors for PostgreSQL, MySQL, Apache Iceberg, Delta Lake, Hive, ClickHouse, MongoDB, Kafka, object storage and dozens more. See the Trino documentation for the properties each connector expects.

The Data Volume

The engine configuration, the connector catalogs and the node data directory live on a dedicated EBS volume mounted at /opt/trino-data. This keeps the engine state off the operating system disk and lets you resize or snapshot it independently. Confirm the mount with the following command.

df -h /opt/trino-data

To grow the volume, expand the EBS volume in the AWS console, then grow the filesystem on the instance with sudo resize2fs on the underlying device.

The JVM heap is sized for a t3.large in /opt/trino-data/etc/jvm.config. When you move to a larger instance, increase the -Xmx value and the query.max-memory settings in config.properties.

Enable HTTPS

nginx serves the Web UI and APIs over plain HTTP on port 80. For production use, place them behind TLS. Obtain a certificate for your domain, for example a managed certificate on an Application Load Balancer in front of the instance, or Certbot installed on the instance. Then configure nginx to listen on 443 with your certificate and proxy to 127.0.0.1:8080, exactly as the bundled site does for port 80. Keep the HTTP Basic authentication in place. Restrict the security group so that ports 80 and 443 are reachable only from the networks that run queries.

Backup and Maintenance

The state that matters on a Trino node is its configuration and catalogs under /opt/trino-data/etc. Back them up by snapshotting the /opt/trino-data EBS volume. The tpch connector data is generated on demand, and the memory connector is transient. There is therefore no query data store to back up, unless you add a connector to a persistent system, in which case that external system holds the data.

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed. Trino and nginx start automatically on boot.

Support

This image is published and supported by SecureAnyCloud. Support covers deployment, connector and catalog configuration, query tuning, memory and JVM sizing, BI and JDBC integration, and TLS. Contact SecureAnyCloud through the support channel on the AWS Marketplace listing.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Trino on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS