Overview
This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.
WHAT IS ODOO
Odoo Community Edition is an open-source, all-in-one ERP and CRM business suite. It runs as a Python application backed by a PostgreSQL database and is organised into integrated apps you install on demand: CRM, Sales, Invoicing, Inventory, Purchase, Accounting, Project, Manufacturing, Website and many more, all sharing one data model so a lead can flow through to a quotation, a delivery and an invoice without re-keying. Reports render to PDF via wkhtmltopdf. The web client and websocket bus bind to loopback and are fronted by nginx for TLS. The database and the file attachment store persist on the instance disk. LGPL-3.0 license, no vendor lock-in. Self-hosted on your own EC2 instance, your business data never leaves your AWS account.
WHAT THIS AMI ADDS
Security hardening:
- A master (database-management) password and an application admin password generated at first boot (written to /root/odoo-credentials.txt)
- An initial database created at first boot - log in and start, no web installer step exposed to the internet
- The database manager disabled (list_db off) so the database list and management screens are not reachable
- Odoo bound to 127.0.0.1 (web and websocket); PostgreSQL bound to 127.0.0.1 only; host nginx terminates TLS on port 443
- One-command HTTPS: certbot --nginx (Certbot and the nginx plugin are pre-installed)
- The PostgreSQL role uses a unique password generated at first boot
- UFW firewall pre-configured (ports 22 and 443 only)
- fail2ban, auditd, AppArmor pre-configured
- CVE scan - every image is scanned for vulnerabilities before release
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, SSH hardening, Kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Highlights
- Odoo security baked in: a master password and an admin password generated at first boot, an initial database created for you, the database manager disabled, Odoo and PostgreSQL bound to 127.0.0.1, and host nginx terminating TLS on port 443.
- CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
- A complete ERP and CRM out of the box: install CRM, Sales, Invoicing, Inventory, Accounting and Project as apps on one shared data model, with PDF reports and one-command HTTPS via Certbot. LGPL-3.0 license - fully auditable, no vendor lock-in.
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
Pricing
Free trial
Dimension | Cost/hour |
|---|---|
t3.large Recommended | $0.03 |
t3.medium | $0.02 |
m6i.xlarge | $0.05 |
m6i.large | $0.03 |
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
How can we make this page better?
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Odoo 18.0 - Initial release (June 2026)
- Odoo 18.0 Community Edition on Ubuntu 24.04 LTS
- CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
- CVE-scanned before every release
- Master password and admin password generated at first boot; initial database created
- PostgreSQL 16 backing store; database manager disabled (list_db off)
- Odoo bound to 127.0.0.1:8069/8072 (loopback); host nginx terminates TLS on port 443
- One-command HTTPS via Certbot (certbot --nginx)
- UFW firewall pre-configured (ports 22, 443 only)
- fail2ban, auditd, AppArmor pre-configured
- SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
- CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
- IMDSv2 enforced
Additional details
Usage instructions
- Launch instance (t3.large recommended; t3.medium minimum)
- Open Security Group - allow TCP 443 from your IP/CIDR (and TCP 22 for SSH)
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- Read credentials: sudo cat /root/odoo-credentials.txt
- Open https://<PUBLIC_IP>/ in your browser - accept the self-signed certificate warning. Odoo shows its login page; an initial database is already created.
- Log in as 'admin' with the generated password from step 4. The master (database management) password is in the same file - keep it private.
The admin and master passwords are generated at first boot and stored in /root/odoo-credentials.txt. Odoo binds 127.0.0.1:8069 (web) and 127.0.0.1:8072 (websocket); PostgreSQL binds 127.0.0.1 only; host nginx terminates TLS on port 443. Replace the self-signed TLS certificate with a CA-signed one for production use: sudo certbot --nginx -d yourdomain.com
Resources
Vendor resources
Support
Vendor support
Visit us online: https://lynxroute.com/#contact
For Odoo documentation:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.