Valkey

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Valkey. Select the SecureAnyCloud listing and choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, then create or select a security group that allows inbound port 22 from your management network.

Optionally, allow inbound port 80 from your monitoring network so the Valkey identification page is reachable. Do not open port 6379 to the public internet. Restrict it to the address ranges of your application servers.

Select Launch instance. First-boot initialisation generates the requirepass and applies it to Valkey. It takes about a minute after the instance state becomes Running and the status checks pass.

The following command launches an instance from the SecureAnyCloud Valkey Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens inbound port 22 and, optionally, port 80.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options HttpTokens=required \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":20,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=valkey-01}]'

On success, the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant you launched:

AMI variant SSH login user

Valkey 8 on Ubuntu 24.04 ubuntu

ssh <login-user>@<public-ip>

Wait until the instance has passed both EC2 status checks before you connect. The first-boot service runs at boot, so Valkey is initialised and ready by the time you can log in.

The first-boot service generates a fresh requirepass for this instance and writes it, with the connection details, to /root/valkey-credentials.txt. Only the root user can read the file. Display it from your SSH session:

sudo cat /root/valkey-credentials.txt

The file looks like the following, with a unique password on your instance:

# Valkey — Per-Instance Credentials
# Generated on first boot by valkey-firstboot.service. requirepass=<your generated password> VALKEY_PASSWORD=<your generated password> VALKEY_HOST=<your instance public IP> LISTEN_ADDRESS=127.0.0.1 LISTEN_PORT=6379

The image ships with no default Valkey password, so the only way into the data port is the per-instance value above.

Valkey runs under systemd as the valkey-server service and starts automatically on boot. Confirm that the service is active:

systemctl is-active valkey-server

The command prints active. Next, confirm that the RESP listener is up. Valkey binds to 127.0.0.1 on port 6379 by default, so it is reachable from the instance itself:

ss -tln | grep 6379

The output shows a listening socket on 127.0.0.1:6379.

The nginx identification page runs on port 80. Confirm that it is reachable from the instance:

curl -s http://127.0.0.1/ | head -5

The page identifies the instance as a SecureAnyCloud Valkey AMI. It also serves as a small, cloud network friendly health endpoint.

The valkey-cli shell ships in the image. Open an interactive session with the generated password, replacing <password> with the value from /root/valkey-credentials.txt:

valkey-cli -a '<password>' --no-auth-warning

The shell opens an interactive prompt:

127.0.0.1:6379>

Run a few commands to confirm that the database is working:

PING SET sac:hello "Valkey on AWS" GET sac:hello DEL sac:hello INFO server

PING returns PONG. SET returns OK. GET returns the value you just set. INFO server reports the running Valkey version and the operating system it is running on.

Exit the shell with quit.

You do not need an interactive session for every command. Pass -e to send a single command and exit, replacing <password> with the value from /root/valkey-credentials.txt:

valkey-cli -a '<password>' --no-auth-warning ping valkey-cli -a '<password>' --no-auth-warning info server | head -20 valkey-cli -a '<password>' --no-auth-warning client list

ping returns PONG. info server returns version, build, mode, OS and uptime fields. client list shows the connections currently attached to Valkey.

By default, Valkey accepts connections only from the instance itself. To accept connections from other hosts on your private network, edit /etc/valkey/valkey.conf and replace bind 127.0.0.1 -::1 with the address you want Valkey to listen on, for example bind 0.0.0.0 -::*. Then restart the service:

sudo systemctl restart valkey-server

In your security group, allow inbound TCP port 6379 only from the address ranges of your application servers. Never open 6379 to the public internet, even with requirepass set. Rate limit and audit on the network instead.

By default, Valkey writes periodic RDB snapshots to /var/lib/valkey/dump.rdb. RDB is the right choice for caches and ephemeral data. For write-through durability, also enable the append-only file (AOF). Edit /etc/valkey/valkey.conf, set appendonly yes, and restart:

sudo systemctl restart valkey-server

The AOF lives under /var/lib/valkey/appendonlydir/. Valkey writes both RDB and AOF files into /var/lib/valkey/, so back up that directory with your normal backup tooling.

By default, Valkey has no memory cap and grows until the operating system runs out of RAM. For cache workloads, set an explicit memory cap and an eviction policy. Edit /etc/valkey/valkey.conf and add:

maxmemory 2gb maxmemory-policy allkeys-lru

Restart the service. When the cap is reached, allkeys-lru evicts the least recently used key across the entire keyspace. It is the right policy for a general-purpose cache.

Valkey implements the Redis API, so any Redis client library can talk to it without modification. The endpoint is the address and port you configured in Step 8, and the password is the per-instance value from /root/valkey-credentials.txt.

To run a smoke test from your laptop, add the host to the security group. Then run redis-cli or valkey-cli against the public IP with -h <public-ip> -a '<password>' --no-auth-warning ping.