Version-specific AWS Marketplace customer deployment instructions. Documentation is not activation or external fulfillment.
Use the Ubuntu administrator account ubuntu and an approved c6i.xlarge/m6i.xlarge or sufficient listed capacity. Prefer Systems Manager access using a customer-owned SSM instance role and working SSM endpoints. Alternatively restrict SSH22 to your administrator /32. For application clients allow TLS8443 only from approved private/client CIDRs in both the security group and host firewall; never open the monitoring ports publicly.
sudo systemctl show hydra-audit-bootstrap.service -p Result -p ExecMainStatus sudo systemctl is-active hydra-audit-redis hydra-audit-server nginx prometheus grafana-server
The bootstrap oneshot can be inactive after success. First boot generates a unique API token in /etc/hydra/hydra.env, Grafana admin password in /etc/hydra-audit/grafana.env, and bootstrap TLS certificate/key under /etc/hydra-audit/tls. Retrieve credentials only through an authorized private administrative session; do not print them into diagnostics. Rotate the Grafana administrator password on first use. Pin the certificate through that trusted channel or replace it with your certificate before external client use.
sudo curl --fail --cacert /etc/hydra-audit/tls/tls.crt --resolve hydra-audit.local:8443:127.0.0.1 https://hydra-audit.local:8443/health curl --fail http://127.0.0.1:9090/-/healthy curl --fail http://127.0.0.1:3000/api/health
The health route itself is not client authentication. The API routes that require it use the generated Bearer token. Prometheus scrapes the local application at127.0.0.1:8082; inspect its target health and configured metrics. Remote /metrics at the TLS proxy returns404 by design.
Use AWS Systems Manager StartSession with AWS-StartPortForwardingSession, instance target, portNumber3000 and a local port such as13000; browse http://127.0.0.1:13000. Prometheus UI on9090 can be forwarded separately. Neither UI should be exposed through a public ingress rule. The dashboard shows configured application metrics, not a universal proof of all audit events or a billing meter.
Application state is under /var/lib/hydra-audit, local Redis under /var/lib/hydra-audit-redis, and monitoring state under the configured Prometheus/Grafana paths. Inspect the installed systemd units and Redis dir before selecting a backup volume. The registered image has launch/reboot health and Redis test-key persistence evidence. This does not prove every application audit event survives a Redis outage, or provide immutable external retention. Configure and test buyer backup/restore and retention for the intended workload.
Subscribe to this AMI through its AWS Marketplace offer and launch the selected version in your account. No seller-operated verification account, seller activation approval, second software purchase or proof upload is needed for the included workflow. EC2, EBS and any buyer-enabled AWS services have their normal AWS charges. Use an instance IAM role for AWS access; do not enter long-lived AWS access keys into this product. These instructions neither subscribe you to another Kenosian product nor send telemetry to a seller service.
Email info@kenosian.com for business-hours installation and troubleshooting support. Send version IDs and redacted service status; never send API tokens, private keys or customer payloads. This is a single-instance deployment. Customer backup/restore, patching, capacity limits and upstream/private-network configuration require buyer operations. No high-availability, fixed-latency, total-data-loss prevention or regulatory-certification guarantee is made.