Keycloak (Hardened) on Amazon Linux 2023

Keycloak identity and access management on Amazon Linux 2023 with Amazon Corretto 21, security-hardened for production: minimal package set, SSH key-only access, IMDSv2-only, no default admin password (per-instance bootstrap credential), and continuously patched images. This product has charges associated with it for image hardening, maintenance, and support.

View on AWS Marketplace

Why this image

• Production-ready: Keycloak 26.7 on Amazon Corretto 21, systemd-managed, health endpoints enabled; swap the embedded database for PostgreSQL when you scale.
• Security-hardened at build time: minimal packages, key-only SSH, IMDSv2-only, no default admin password - bootstrap credential is per-instance (the EC2 instance ID).
• Continuously patched: rebuilt, vulnerability-scanned, and republished on a regular cadence.

About

Keycloak (Hardened) on Amazon Linux 2023 is a production-ready, security-hardened image of the Keycloak identity and access management server (OpenID Connect, OAuth 2.0, SAML 2.0), maintained and supported by Derek Coleman & Associates Inc.

This is repackaged open-source software. Keycloak is a Cloud Native Computing Foundation project distributed under the Apache License 2.0. Keycloak is a trademark of Red Hat, Inc.; this listing is not endorsed by or affiliated with Red Hat or the CNCF. This product bundles unmodified upstream Keycloak on a hardened Amazon Linux 2023 base; the charges associated with this listing are for image hardening, continuous patching, vulnerability scanning, and business-day support - not for the underlying open-source software, which remains free.

Hardening baseline: minimal package footprint, SSH key-only access (password authentication disabled), IMDSv2 enforced, and no default admin credentials - the temporary bootstrap admin password is generated per instance on first boot (set to the EC2 instance ID); Keycloak requires you to create a permanent admin account on first login. Images are rebuilt, scanned for HIGH and CRITICAL vulnerabilities, and republished on a regular cadence so that new launches start current. Ships with the embedded dev-file database for evaluation and small deployments; point it at PostgreSQL for production clusters (documented in the usage instructions).

Pricing (hourly usage, AWS Marketplace)

Recommended: c7i.2xlarge. AWS infrastructure charges are separate and billed by AWS. Charges stop when instances are terminated. No subscription, no minimum.

Getting started

1. Launch from AWS Marketplace (1-Click or EC2 console).
2. Use a web browser to access the application at http://<public-ip>:8080. Sign in with username admin and the temporary password equal to the EC2 instance ID (e.g. i-0abc123...); Keycloak then requires you to create a permanent admin account. The bootstrap values are written on first boot by keycloak-firstboot.service to /etc/keycloak/keycloak.env (readable by root and the keycloak user).
3. For production, terminate TLS on 8443 or a load balancer, set a hostname, and configure an external PostgreSQL database in /opt/keycloak/conf/keycloak.conf, then: sudo systemctl restart keycloak.
4. SSH access: ssh -i <key> ec2-user@<public-ip>. Root login is disabled; use sudo.
5. Verify: sudo systemctl status keycloak (health endpoints are on the management port: curl http://127.0.0.1:9000/health/ready).
6. Sensitive data: the only credential is the temporary admin password (the EC2 instance ID), which you replace at first login. Logs under /var/log may contain client IPs - treat as personal data.
7. Backup: snapshot the EBS volume (it contains all configuration and data).
8. Resources: a single instance uses 1 EC2 instance and 1 gp3 EBS volume; no other AWS resources are created.
9. Support: support@dcassociatesgroup.com.

Support

Email support@dcassociatesgroup.com — business-day response. Covers image operation, the hardening baseline, and launch issues. See support.

Migrating from Bitnami?

This image is a marketplace-native alternative for teams leaving the retired free Bitnami Keycloak image. It is not a drop-in copy of Bitnami's layout: Bitnami installs under /opt/bitnami and is controlled with ctlscript.sh, while this image uses the standard Amazon Linux 2023 paths and systemctl shown in the getting-started steps above.

• Bitnami Keycloak alternative — migration notes for Keycloak
• Bitnami migration hub — deprecation timeline, Lightsail blueprint dates, and the same image on Azure and Google Cloud

Bitnami is a trademark of Broadcom, Inc. Used for identification only; no affiliation or endorsement implied.