Deployment guide

WSO2 Micro Integrator

Overview

WSO2 Micro Integrator is a lightweight, cloud-native integration runtime in the enterprise service bus and enterprise application integration tradition. It runs integration artifacts such as REST APIs, proxy services, message mediation sequences and scheduled tasks. These connect applications, APIs, databases and messaging systems, routing and transforming messages through a fast Synapse passthrough engine.

This SecureAnyCloud image runs a single node from the official Apache 2.0 licensed WSO2 Micro Integrator 4.6.0 distribution in /opt/wso2mi, on OpenJDK 21, as a dedicated wso2 system user. On first boot, it rotates a unique Management API administrator password into the runtime.

What you get:

WSO2 Micro Integrator 4.6.0 from the official OSS distribution, on OpenJDK 21
The Synapse data plane: HTTP passthrough on 8290 and HTTPS passthrough on 8253
A sample REST API (context /health) deployed on the data plane, so the runtime answers on first boot
The Management API on HTTPS 9164, restricted to the loopback interface by a host firewall and fronted by nginx on port 80
A unique per-VM Management API admin password generated on first boot, with no shared default credential
24/7 SecureAnyCloud support

Only the Apache 2.0 open-source runtime is shipped. There is no commercial WSO2 subscription component, and the separate WSO2 Micro Integrator Dashboard is not bundled. The Management API and the internal API (9164 and 9201) are reachable only from the loopback interface. Administrators reach the Management API through the nginx front on port 80 or over an SSH tunnel.

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting point for a Java integration runtime.

For inbound NSG rules, allow 22/tcp from your management network and 80/tcp for the Management API front. Also allow 8290/tcp (and 8253/tcp) if you want clients to reach your deployed integration endpoints. Restrict every port to trusted networks.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, and search the Marketplace for WSO2 Micro Integrator by SecureAnyCloud. Select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then choose Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:wso2-micro-integrator-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name wso2mi \
  --image sac1647283583153:wso2-micro-integrator-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the runtime is installed and running

Check the release on disk, the Java runtime, and that the services are active:

echo "WSO2 Micro Integrator $(basename $(readlink -f /opt/wso2mi) | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')" java -version 2>&1 | head -1 systemctl is-active wso2mi nginx wso2mi-loopback-guard

The output shows the 4.6.0 release, OpenJDK 21 and three active services:

WSO2 Micro Integrator 4.6.0 openjdk version "21.0.11" 2026-04-21 active active active

Step 5 - Confirm the data plane and the listening ports

The Synapse data plane listens on 8290 (HTTP) and 8253 (HTTPS). The Management API listens on 9164, the internal API on 9201, and nginx on 80. Confirm the ports and call the deployed sample API on the data plane:

ss -tln | grep -E ':8290 |:8253 |:9164 |:9201 |:80 ' curl -s http://127.0.0.1:8290/health

The sample API answers with a JSON payload, which proves that a request flows end to end through the passthrough transport:

{"status":"healthy","runtime":"wso2-micro-integrator","sac":true}

Step 6 - Retrieve your per-VM admin password

Each VM generates its own unique Management API administrator password on first boot. It writes the password, along with the resolved URLs, to a root-only credentials file:

sudo cat /root/wso2mi-credentials.txt

The file contains WSO2MI_ADMIN_USERNAME (admin), WSO2MI_ADMIN_PASSWORD, the Management API front URL and the data plane URL. Store the password in your secrets manager. In the steps below, <WSO2MI_ADMIN_PASSWORD> stands for the value of WSO2MI_ADMIN_PASSWORD.

Step 7 - Log in to the Management API for a token

The WSO2 command line tool and dashboard drive the Management API, which authenticates against the per-VM administrator password. Request a token with HTTP Basic authentication. This block reads the password straight from the credentials file, so it runs as is:

PW=$(sudo grep '^WSO2MI_ADMIN_PASSWORD=' /root/wso2mi-credentials.txt | cut -d= -f2-)
curl -sk -u "admin:$PW" https://127.0.0.1:9164/management/login

A successful login returns a JSON AccessToken. Present it as a bearer token to the other Management API resources:

{"AccessToken":"eyJraWQiOiJlOWVmMGU4Mi0wY2Y1..."}

You can also reach the Management API through the nginx front on port 80, which reverse-proxies to the loopback-bound listener. Substitute the real password for <WSO2MI_ADMIN_PASSWORD>:

curl -s -u admin:<WSO2MI_ADMIN_PASSWORD> http://<vm-public-ip>/management/login

Step 8 - The authentication wall

First boot replaces the default admin/admin credential with a unique per-VM password before the runtime ever starts. Neither the default password nor any wrong password authenticates. Confirm the rejection: both return HTTP 401, while your per-VM password returns 200 with a token.

echo "admin/admin -> $(curl -sk -o /dev/null -w '%{http_code}' -u admin:admin https://127.0.0.1:9164/management/login)"
echo "wrong pw -> $(curl -sk -o /dev/null -w '%{http_code}' -u admin:wrong-pw https://127.0.0.1:9164/management/login)"

admin/admin -> 401 wrong pw -> 401

Step 9 - Deploy your own integration artifacts

The runtime hot-deploys integration artifacts (REST APIs, proxy services, sequences, scheduled tasks) from the Synapse configuration directory. Drop a Carbon Application (.car) into the carbonapps directory, or a raw Synapse configuration into the synapse-configs tree, and the runtime picks it up. For example, list the deployed APIs directory that holds the shipped sample:

sudo ls /opt/wso2mi/repository/deployment/server/synapse-configs/default/api/

Build Carbon Applications with WSO2 Integration Studio or the MI for VS Code extension. Copy them to /opt/wso2mi/repository/deployment/server/carbonapps/, then confirm deployment through the Management API or the runtime logs at /opt/wso2mi/repository/logs/.

Step 10 - Reach the Management API remotely over an SSH tunnel

A host firewall (nftables) drops off-box traffic to the Management API (9164) and internal API (9201), so they are reachable only from the loopback interface. Use the nginx front on port 80, or open an SSH tunnel and point a local client at the loopback listener:

# On your workstation:
ssh -L 9164:127.0.0.1:9164 azureuser@<vm-public-ip>
# Then log in through the tunnel (self signed certificate, so -k):
# curl -sk -u admin:<WSO2MI_ADMIN_PASSWORD> https://127.0.0.1:9164/management/login

For production remote administration, front the Management API with a trusted TLS certificate on nginx and restrict access with your NSG. Never expose 9164 directly to the internet.

Maintenance

Configuration: edit /opt/wso2mi/conf/deployment.toml (transports, users, mediation settings), then run sudo systemctl restart wso2mi.
Password: first boot writes the per-VM password into deployment.toml. To rotate it later, update the [[internal_apis.users]] password in deployment.toml, restart the runtime, and update your credentials store.
Logs: runtime and access logs are under /opt/wso2mi/repository/logs/.
Loopback guard: the nftables table sac_wso2_guard (service wso2mi-loopback-guard) restricts 9164 and 9201 to loopback. Adjust it only if you deliberately want the Management API reachable off box behind TLS.
Security patches: unattended-upgrades stays enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

WSO2 and WSO2 Micro Integrator are trademarks of WSO2 LLC. This image is provided by SecureAnyCloud and is not affiliated with or endorsed by WSO2 LLC. Only the Apache 2.0 licensed open-source Micro Integrator runtime is included.

Deploy on Azure

Launch WSO2 Micro Integrator on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

WSO2 Micro Integrator is a lightweight, cloud-native, configuration-driven integration runtime from the WSO2 project. It implements enterprise integration patterns and lets you expose REST and SOAP APIs, proxy services, message mediation and routing as hot-deployable integration artifacts.

This image ships only the Apache 2.0 licensed open-source runtime, running on a headless OpenJDK 21 Java runtime. It is installed under /opt/wso2mi and runs as a dedicated unprivileged wso2 system account under a systemd service that starts it on boot and restarts it on failure.

What you get:

Integration / data plane: the Synapse passthrough transport on HTTP port 8290 and HTTPS port 8253, bound to all interfaces so the APIs and proxy services you deploy receive traffic. A sample health check API is baked into the image, so a GET to /health on port 8290 returns a 200 JSON body immediately after launch.
Management API: HTTPS port 9164, used by the WSO2 MI command line tool. The runtime binds this to all interfaces with no configuration key to change that. A scoped nftables loopback guard therefore drops external traffic to the management ports (9164 and the internal API 9201), and an nginx reverse proxy on port 80 provides a controlled front. The management API is never directly reachable off the instance.
Per-instance credentials: the management API administrator password is generated on the first boot of every deployed instance, so two instances launched from the same Amazon Machine Image never share a password.

The password is written to /root/wso2mi-credentials.txt with mode 0600, so only the root user can read it. The image carries no working default credential, and the WSO2 default admin/admin is rejected.

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network, port 80 for the management front, and the data plane ports (8290, 8253) from the networks your integration clients use
The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for WSO2 Micro Integrator. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger, because the runtime is a JVM workload. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and either create or select a security group. It must open port 22 from your management network, port 80 for the management front, and the data plane ports (8290, 8253) your clients use. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization takes approximately one minute after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

The following block launches an instance from the SecureAnyCloud WSO2 Micro Integrator Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens ports 22, 80, 8290 and 8253 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=wso2-micro-integrator}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can find it in the EC2 console or with aws ec2 describe-instances.

Connect to Your Instance

Connect over SSH using your key pair and the login user for your operating system variant:

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i /path/to/your-key.pem ubuntu@<public-ip>

Confirm the Runtime Is Healthy

WSO2 Micro Integrator and its nginx management front start automatically on boot. Confirm both services are active:

systemctl is-active wso2mi.service nginx.service

Both report active. Then check the runtime version and Java runtime:

basename $(readlink -f /opt/wso2mi); java -version

Exercise the Integration Data Plane

A sample health check API is deployed on the Synapse passthrough transport. It answers without authentication, which proves the data plane is routing requests:

curl -s http://127.0.0.1:8290/health

The response is {"status":"healthy","runtime":"wso2-micro-integrator","SecureAnyCloud":true}. From outside the instance, the same API is reachable at http://<public-ip>:8290/health once your security group opens port 8290.

The data plane also listens for HTTPS on port 8253. Point your own API and proxy clients at the instance on 8290 (HTTP) or 8253 (HTTPS).

Retrieve the Management API Password

First boot writes the per-instance management API administrator password to a root-only file. Confirm the file exists with mode 0600:

sudo ls -l /root/wso2mi-credentials.txt

Read the full file when you need the password. It holds the management username, the password and the resolved URLs:

sudo cat /root/wso2mi-credentials.txt

Sign In to the Management API

The management API is bound to loopback and fronted by nginx on port 80. From the instance, read the password into a shell variable and request an access token. The per-instance password authenticates, while both the WSO2 default admin/admin and any wrong password are rejected with 401:

PW=$(sudo awk -F= '/ADMIN_PASSWORD/{print $2}' /root/wso2mi-credentials.txt)
curl -sk -o /dev/null -w 'per-instance login: HTTP %{http_code}\n' -u "admin:$PW" https://127.0.0.1:9164/management/login
curl -sk -o /dev/null -w 'default admin/admin: HTTP %{http_code}\n' -u admin:admin https://127.0.0.1:9164/management/login

The output shows per-instance login: HTTP 200 and default admin/admin: HTTP 401. The nginx front exposes the same management API off the instance at http://<public-ip>/management/login (HTTP Basic auth). Terminate TLS at nginx or a load balancer before exposing it beyond a trusted network.

Understand the Loopback Guard

The runtime binds the management API (9164) and internal API (9201) to all interfaces and offers no configuration key to restrict them to loopback. SecureAnyCloud installs a scoped nftables table that drops inbound non-loopback traffic to those two ports. The management plane is therefore reachable only via loopback and the nginx front. Inspect the rule:

sudo nft list table inet sac_wso2_guard

The table drops tcp dport { 9164, 9201 } for any non-loopback source. The data plane (8290, 8253), SSH (22) and the management front (80) are untouched, and your own security group rules are not affected.

Deploy Your Own Integration Artifacts

WSO2 Micro Integrator hot-deploys artifacts from its deployment directory. Copy a Composite Application archive (a .car file built with the WSO2 Integration tooling) or raw Synapse configurations into the server deployment tree, and the runtime picks them up without a restart:

Composite Application archives: /opt/wso2mi/repository/deployment/server/carbonapps/
Raw Synapse APIs, proxy services and sequences: /opt/wso2mi/repository/deployment/server/synapse-configs/default/

Deployed REST APIs are served on the data plane transport (8290/8253) at the context you define, exactly like the baked sample /health API.

Security

Secure first boot: a one-shot service generates a unique management API administrator password per instance and writes it into the runtime configuration before the runtime starts. No shared or default credential ships in the image, and admin/admin is rejected.
Loopback-guarded management plane: the management and internal APIs are reachable only via loopback and the nginx front on port 80. Restrict that front, plus the data plane ports, to trusted networks with your security groups.
Encryption: enable AWS EBS encryption on the root volume to protect configuration and artifacts at rest. Terminate TLS at nginx or a load balancer for encrypted management access.
Least privilege: the runtime runs as the unprivileged wso2 system account, never as root.

Support

SecureAnyCloud provides 24/7 technical support for this AMI via email and live chat, covering deployment, integration artifact packaging and hot deployment, management API and credential administration, TLS termination and JVM tuning. Email sales@secureanycloud.com or reach us through live chat. For any issues, including refund requests, contact sales@secureanycloud.com.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch WSO2 Micro Integrator on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS