etcd (Hardened) on Amazon Linux 2023

etcd distributed key-value store on Amazon Linux 2023, security-hardened for production: minimal package set, SSH key-only access, IMDSv2-only, client API bound to loopback until you configure TLS, and continuously patched images. This product has charges associated with it for image hardening, maintenance, and support.

View on AWS Marketplace

Why this image

• Production-ready: systemd-managed etcd with etcdctl and etcdutl included; single-member out of the box, cluster-ready.
• Security-hardened at build time: minimal packages, key-only SSH, IMDSv2-only, client API on loopback until you configure TLS.
• Continuously patched: rebuilt, vulnerability-scanned, and republished on a regular cadence.

About

etcd (Hardened) on Amazon Linux 2023 is a production-ready, security-hardened image of the etcd distributed, consistent key-value store, maintained and supported by Derek Coleman & Associates Inc.

This is repackaged open-source software. etcd is a Cloud Native Computing Foundation graduated project distributed under the Apache License 2.0. This product bundles unmodified upstream etcd on a hardened Amazon Linux 2023 base; the charges associated with this listing are for image hardening, continuous patching, vulnerability scanning, and business-day support - not for the underlying open-source software, which remains free.

Hardening baseline: minimal package footprint, SSH key-only access (password authentication disabled), IMDSv2 enforced, and the etcd client API bound to 127.0.0.1:2379 (configuring TLS certificates, peer URLs, and cluster membership, then opening 2379/2380 to trusted CIDRs, is a deliberate customer step before any remote or cluster use). Images are rebuilt, scanned for HIGH and CRITICAL vulnerabilities, and republished on a regular cadence so that new launches start current. Manage the service with systemd: sudo systemctl restart etcd.

Pricing (hourly usage, AWS Marketplace)

Recommended: c7i.xlarge. AWS infrastructure charges are separate and billed by AWS. Charges stop when instances are terminated. No subscription, no minimum.

Getting started

1. Launch from AWS Marketplace (1-Click or EC2 console).
2. Connect via SSH with your EC2 key pair: ssh -i <key> ec2-user@<public-ip>. Root login is disabled; use sudo.
3. etcd serves http://127.0.0.1:2379; verify with: etcdctl endpoint health.
4. Clustering and remote access require configuring TLS and advertise URLs in the systemd unit, then opening 2379/2380 to trusted CIDRs only.
5. Health monitoring: etcdctl endpoint health, or: sudo systemctl status etcd.
6. Sensitive data: there are no passwords or secrets anywhere in this product.
7. Backup: etcdctl snapshot save /path/backup.db (copy it off-box; restore with etcdctl snapshot restore), or snapshot the EBS volume (it contains all configuration and data).
8. Resources: a single instance uses 1 EC2 instance and 1 gp3 EBS volume; no other AWS resources are created.
9. Support: support@dcassociatesgroup.com.

Support

Email support@dcassociatesgroup.com — business-day response. Covers image operation, the hardening baseline, and launch issues. See support.