ClickHouse (Hardened) on Amazon Linux 2023

ClickHouse columnar OLAP database on Amazon Linux 2023, security-hardened for production: minimal package set, SSH key-only access, IMDSv2-only, bound to loopback with no default remote access, and continuously patched images. This product has charges associated with it for image hardening, maintenance, and support.

View on AWS Marketplace

Why this image

• Production-ready: systemd-managed ClickHouse server + client from the official stable repository.
• Security-hardened at build time: minimal packages, key-only SSH, IMDSv2-only, loopback-only listeners, no remote-accessible default user.
• Continuously patched: rebuilt, vulnerability-scanned, and republished on a regular cadence.

About

ClickHouse (Hardened) on Amazon Linux 2023 is a production-ready, security-hardened image of the ClickHouse column-oriented OLAP database, maintained and supported by Derek Coleman & Associates Inc.

This is repackaged open-source software. ClickHouse is developed by ClickHouse, Inc. and the ClickHouse community and is distributed under the Apache License 2.0. ClickHouse is a trademark of ClickHouse, Inc.; this listing is not endorsed by or affiliated with ClickHouse, Inc. This product bundles unmodified upstream ClickHouse on a hardened Amazon Linux 2023 base; the charges associated with this listing are for image hardening, continuous patching, vulnerability scanning, and business-day support - not for the underlying open-source software, which remains free.

Hardening baseline: minimal package footprint, SSH key-only access (password authentication disabled), IMDSv2 enforced, and ClickHouse listening on loopback only (the default user is local-only with no password exposure; defining users in users.d and opening ports 8123/9000 to trusted CIDRs is a deliberate customer configuration step). Images are rebuilt, scanned for HIGH and CRITICAL vulnerabilities, and republished on a regular cadence so that new launches start current. Manage the service with systemd: sudo systemctl restart clickhouse-server.

Pricing (hourly usage, AWS Marketplace)

Recommended: c7i.4xlarge. AWS infrastructure charges are separate and billed by AWS. Charges stop when instances are terminated. No subscription, no minimum.

Getting started

1. Launch from AWS Marketplace (1-Click or EC2 console).
2. Connect via SSH with your EC2 key pair: ssh -i <key> ec2-user@<public-ip>. Root login is disabled; use sudo.
3. Query locally with: clickhouse-client.
4. Remote access (HTTP 8123, native 9000) and user definitions under /etc/clickhouse-server/users.d are a deliberate customer configuration step; open those ports to trusted CIDRs only.
5. Verify: clickhouse-client --query 'SELECT 1', or: sudo systemctl status clickhouse-server.
6. Sensitive data: there are no passwords or secrets anywhere in this product.
7. Backup: snapshot the EBS volume (it contains all configuration and data).
8. Resources: a single instance uses 1 EC2 instance and 1 gp3 EBS volume; no other AWS resources are created.
9. Support: support@dcassociatesgroup.com.

Support

Email support@dcassociatesgroup.com — business-day response. Covers image operation, the hardening baseline, and launch issues. See support.