Install ClickHouse (Hardened)

Prerequisites

• An account on the target cloud with permission to launch VM instances (no special IAM roles are required by this product unless stated below — IAM required: none).
• An SSH key pair registered in the target cloud (all access is key-only; password SSH is disabled).
• Instance size ≥ 4 vCPU (pricing floor; 8 vCPU recommended).
• No internet access or external dependency is required at deploy time — the image is self-contained.

AWS

1. Subscribe and launch (memory-optimized instances shine; 4 vCPU floor).
   Expected result clickhouse-client -q 'SELECT version()' returns.
2. For network use: add a users.d/ user with a password, set listen_host in config.d, restart, and open 8123/9000 to your subnet only.
   Expected result Remote clickhouse-client authenticates; the default user remains local-only.

Google Cloud

1. Deploy from the listing (IAP-only SSH; 8123/9000 closed by the package by default).
   Expected result On the VM: clickhouse-client -q 'SELECT version()' returns.
2. For in-VPC clients: add a users.d/ user with a password, set listen_host in config.d/, `sudo systemctl restart clickhouse-server`, then add firewall rules for 8123/9000 from your subnet only.
   Expected result Remote clickhouse-client authenticates; the default user remains local-only.

Validate

clickhouse-client -q 'SELECT 1'

First boot: Service enabled at build (the build already proved SELECT 1 answers); ready in seconds. No credential is generated — the default user is passwordless and loopback-only.

First login / credentials

1. SSH in with the key pair you chose at launch (AWS: ssh ec2-user@<public-ip>; GCP: gcloud compute ssh <vm> --tunnel-through-iap).
2. Run `clickhouse-client` — the default user has no password and can only connect from the instance itself.
3. Before exposing 8123/9000: create a user with a password in /etc/clickhouse-server/users.d/ (or `CREATE USER ... IDENTIFIED BY ...`), set listen_host in /etc/clickhouse-server/config.d/, restart, then open the firewall to your subnet only.

Secure it

• Restrict SSH (22) to your own IP range in the cloud firewall/security group.
• Open application ports only per the ports table — closed-by-default is deliberate.
• Volume encryption: use your cloud's native volume encryption (enabled by default on most accounts); the image adds no proprietary encryption layer.

Costs & quotas

Software is billed by the marketplace at the listed rate; infrastructure (VM, storage, egress) is billed by your cloud at its standard rates. The recommended size fits default service quotas in most accounts — if you scale out, review your cloud's quota console before launch.

Next: configuration · troubleshooting · security notes