Getting Started with Nexus Repository on AWS

The CloudSOE Nexus Repository image gives you Sonatype Nexus Repository 3 — proxying and hosting Maven, npm, Docker, PyPI and more — on a hardened Ubuntu base with OpenJDK 17. The image contains no baked-in secrets: on first boot your instance generates its own secrets-encryption key, and Nexus writes a one-time admin password that you replace in the setup wizard.

What you’ll need

• An AWS account subscribed to the CloudSOE Nexus Repository listing on AWS Marketplace
• An EC2 key pair in your target region (SSH is key-based only)
• About ten minutes

Step 1 — Launch the instance

1. Open the Nexus Repository listing on AWS Marketplace and click Continue to Subscribe, then Continue to Configuration.
2. Pick your region and click Continue to Launch → Launch through EC2.
3. Choose an instance type. t3.large (2 vCPU, 8 GB RAM) is a good starting point — Nexus is a JVM application that appreciates memory.
4. Select your key pair, and give the root volume at least 30 GB — more if you’ll host large artifact repositories, since blob stores live on this disk.

Prefer the CLI? Once subscribed:

aws ec2 run-instances \
  --image-id <ami-id-from-the-listing> \
  --instance-type t3.large \
  --key-name my-key \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=nexus-01}]'

Step 2 — Open the firewall ports

Your security group needs exactly two inbound rules:

Restrict both to your own IP range (or your build infrastructure’s range) where possible.

Step 3 — Let first boot finish

On the very first boot the nexus-firstboot service:

• generates a unique per-instance secrets-encryption key at /opt/nexus/nexus.secrets.json (never baked into the image),
• fills your public IP into the login banner,
• restarts Nexus so the key takes effect.

Nexus itself takes two to three minutes to start. You can watch:

ssh ubuntu@<public-ip>
systemctl status nexus-firstboot nexus

Step 4 — Retrieve the first-admin password

Nexus writes a one-time password for the admin user on its first start:

sudo cat /opt/sonatype-work/nexus3/admin.password

This file is deleted automatically once you complete the setup wizard — it’s a bootstrap secret, not a permanent credential.

Step 5 — Complete the setup wizard

Browse to http://<public-ip>:8081, click Sign in (top right) and log in as admin with the one-time password. The wizard walks you through:

1. Setting a new admin password of your own.
2. Choosing whether anonymous users may browse and download — for an internet-facing instance, disable anonymous access unless you specifically want a public repository.

You now have a working repository manager with the default Maven repositories in place.

Next steps

• Configure Nexus — file locations, ports, memory, the encryption key and HTTPS
• Tips & tricks — the nexus-upgrade helper, backups, disk management and troubleshooting