Install Apache Kafka (KRaft, Hardened)

Prerequisites

• An account on the target cloud with permission to launch VM instances (no special IAM roles are required by this product unless stated below — IAM required: none).
• An SSH key pair registered in the target cloud (all access is key-only; password SSH is disabled).
• Instance size ≥ 4 vCPU (pricing floor; 8 vCPU recommended).
• No internet access or external dependency is required at deploy time — the image is self-contained.

AWS

1. Subscribe and launch; on-instance CLI works immediately (listeners and advertised listener = 127.0.0.1:9092).
   Expected result /opt/kafka/bin/kafka-topics.sh --bootstrap-server 127.0.0.1:9092 --list returns without error.
2. For in-VPC clients: set listeners and advertised.listeners in /opt/kafka/config/server.properties to the instance's private address, configure SASL/TLS, `sudo systemctl restart kafka`, then open 9092 in the security group to your subnet only.
   Expected result Clients in the VPC produce/consume; the internet cannot reach the broker.

Google Cloud

1. Deploy from the listing (IAP-only SSH; no broker exposure by the package).
   Expected result On the VM: kafka-topics.sh --bootstrap-server localhost:9092 --create --topic demo succeeds.
2. For in-VPC clients: edit advertised.listeners in kraft-server.properties to the VM's internal DNS/IP, `sudo systemctl restart kafka`, and add a firewall rule for 9092 from your subnet only.
   Expected result Clients in the subnet produce/consume; the internet cannot reach the broker.

Validate

/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server localhost:9092

First boot: A one-shot format unit — kafka-firstboot.service (AWS) / kafka-format.service (GCE) — generates a fresh KRaft cluster id and formats /var/lib/kafka once (guarded by meta.properties), then kafka.service starts. Broker answers within ~1 minute. No credential is generated (Kafka ships with no authentication).

First login / credentials

1. SSH in with the key pair you chose at launch (AWS: ssh ec2-user@<public-ip>; GCP: gcloud compute ssh <vm> --tunnel-through-iap).
2. There is no application credential: the broker has no authentication configured and answers only on localhost. Check it: /opt/kafka/bin/kafka-topics.sh --bootstrap-server localhost:9092 --list
3. Before any client outside the VM can connect, set listeners/advertised.listeners in the config file for your cloud (see Configuration) and add SASL/TLS — then open 9092.

Secure it

• Restrict SSH (22) to your own IP range in the cloud firewall/security group.
• Open application ports only per the ports table — closed-by-default is deliberate.
• Volume encryption: use your cloud's native volume encryption (enabled by default on most accounts); the image adds no proprietary encryption layer.

Costs & quotas

Software is billed by the marketplace at the listed rate; infrastructure (VM, storage, egress) is billed by your cloud at its standard rates. The recommended size fits default service quotas in most accounts — if you scale out, review your cloud's quota console before launch.

Next: configuration · troubleshooting · security notes