Trusted Images - Valkey 9.1 Cluster Mode on Rocky Linux 9 AMI

This AMI is maintained by Trusted Images and includes open source software packages for the target operating system.

Valkey 9.1 Cluster Mode on Rocky Linux 9 provides a maintained AMI for teams that want a hardened Valkey base image with cluster mode enabled and documented package, SBOM, scan, and hardening records. The image starts as a single localhost-bound Valkey node with cluster slots assigned locally. It is intended as a secure starting point for operators who will intentionally configure multi-node topology, authentication, TLS or private networking, persistence, backups, monitoring, and EC2 security groups for their deployment.

What's included:

• Valkey 9.1.0 built from the official upstream source tag with pinned SHA256 verification.
• Valkey cluster mode enabled and bootstrapped on localhost for local health checks.
• TCP listener configured on localhost by default so remote access requires deliberate operator configuration.
• Protected mode enabled.
• Systemd service hardening with a dedicated unprivileged user, restricted writable paths, private temporary directory, and no Linux capabilities.
• Monthly rebuild cadence applies Rocky Linux package updates and refreshes package, SBOM, scan, and hardening records.
• Package inventory, SBOM, root filesystem scan, and runtime hardening status available for supported AMI versions.

Security hardening: The image keeps Valkey network exposure conservative by default. Remote application access and production multi-node clustering require the operator to review /etc/valkey/valkey.conf, configure ACLs or password authentication, configure TLS or private networking where required, assign cluster topology across instances, and open only the necessary VPC security group paths. The image does not include prebuilt credentials, TLS certificates, external monitoring, backups, a separately attached data volume, or a managed high-availability service. The image makes no claim of complete vulnerability absence, formal benchmark certification, cryptographic module validation, or regulated compliance certification.

Patch and rebuild cadence: Trusted Images rebuilds supported AMIs monthly and when security updates require an out-of-band rebuild. Each supported AMI version includes package inventory, SBOM data, root filesystem scan results, runtime hardening checks, and release notes for the delivered image.

Launch and configuration basics: Launch the AMI in a private subnet or controlled VPC security group. Confirm the service with systemctl status valkey and test local health with valkey-cli -h 127.0.0.1 -p 6379 ping. Confirm cluster mode with valkey-cli -h 127.0.0.1 -p 6379 cluster info. Persistent files use the root volume under /var/lib/valkey unless the operator moves data to a separately managed volume.

Support: Trusted Images provides email support for launch guidance, image-specific package questions, patch notifications, and Valkey-on-Rocky-Linux configuration questions. Support does not include application code development, custom migrations, custom cluster operations, or continuous operations.

Trusted Images is not affiliated with, endorsed by, or sponsored by LF Projects, the Linux Foundation, or the Valkey project maintainers.