Prerequisites
- An account on the target cloud with permission to launch VM instances (no special IAM roles are required by this product unless stated below — IAM required: none).
- An SSH key pair registered in the target cloud (all access is key-only; password SSH is disabled).
- Instance size ≥ 4 vCPU (pricing floor; 8 vCPU recommended).
- No internet access or external dependency is required at deploy time — the image is self-contained.
AWS
- Subscribe and launch; on-instance CLI works immediately (advertised listener = localhost).
Expected result kafka-topics.sh --list returns without error.
Google Cloud
- Deploy from the listing (IAP-only SSH; no broker exposure by the package).
Expected result On the VM: kafka-topics.sh --bootstrap-server localhost:9092 --create --topic demo succeeds. - For in-VPC clients: edit advertised.listeners in kraft-server.properties to the VM's internal DNS/IP, restart kafka, and open 9092 to your subnet only.
Expected result Clients in the subnet produce/consume; the internet cannot reach the broker.
Validate
/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server localhost:9092
First boot: kafka-format.service generates a fresh KRaft cluster id and formats /var/lib/kafka once (guarded by meta.properties), then kafka.service starts. Broker answers within ~1 minute.
Secure it
- Restrict SSH (22) to your own IP range in the cloud firewall/security group.
- Open application ports only per the ports table — closed-by-default is deliberate.
- Volume encryption: use your cloud's native volume encryption (enabled by default on most accounts); the image adds no proprietary encryption layer.
Costs & quotas
Software is billed by the marketplace at the listed rate; infrastructure (VM, storage, egress) is billed
by your cloud at its standard rates. The recommended size fits default service quotas in most accounts —
if you scale out, review your cloud's quota console before launch.
Next: configuration · troubleshooting · security notes
DC Associates Group