Deploy to Amazon EC2

Deploy Graph Explorer onto an Amazon EC2 instance and use it as a proxy server with SSH tunneling to connect to Amazon Neptune. Other ways to connect to Amazon Neptune from outside the VPC include a load balancer or VPC peering.

This guide is an example, not a recommended production configuration. Review its network, access control, and IAM choices against your own security requirements before you run it in production. For the hosting setups Graph Explorer supports, see Supported Hosting. For general guidance on securing a production workload, see the Security Pillar of the AWS Well-Architected Framework.

Important

The Graph Explorer server, not your browser, connects to the database for proxied connections, so it needs network access to the database endpoint. See System overview for details.

Important

Graph Explorer performs no authentication or authorization, so controlling who can reach a deployment is the deployer’s responsibility. Never expose it publicly without an access control layer in front of it. See Access Control.

Prerequisites

Provision an Amazon EC2 instance that will be used to host the application and connect to Neptune as a proxy server. For more details, see instructions here.
Inbound access to the Amazon EC2 instance limited to a known CIDR range, on port 443 (Graph Explorer) and port 22 (SSH). The instance needs no inbound rule on port 8182 (Neptune).
Neptune’s security group allows port 8182 from the instance, which reaches Neptune on that port inside the VPC.
If your Neptune cluster has IAM database authentication enabled, an instance profile attached to the instance, with a role that has a Neptune data-access policy. The proxy server signs requests with this role, and Neptune refuses them without the policy. Add one of the Sample IAM Policies to the role as an inline policy, and replace its placeholders as described in Sample IAM Policies. Graph Explorer runs in a Docker container, which is one network hop further from the instance metadata service than the instance itself. When the instance requires IMDSv2, set its metadata response hop limit to 2 so the container can get the role’s credentials.
Docker installed on the EC2 instance
AWS CLI installed on the EC2 instance

Steps

Open an SSH client and connect to the EC2 instance

Authenticate with the Amazon ECR Public Registry

aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws

Pull the Docker image
```
docker pull public.ecr.aws/neptune/graph-explorer
```
Tip
If you receive an error relating to the docker service not running, run service docker start.
Run the container substituting the {hostname-or-ip-address} with the hostname or IP address of the EC2 instance, and {NEPTUNE_ENDPOINT} with your Neptune endpoint
```
docker run -p 443:443 \
 --restart unless-stopped \
 --env HOST={hostname-or-ip-address} \
 --env PROXY_SERVER_ALLOWED_DB_ORIGINS=https://{NEPTUNE_ENDPOINT}:8182 \
 public.ecr.aws/neptune/graph-explorer
```
HOST does not limit which networks or clients can reach the container. See HOST.

PROXY_SERVER_ALLOWED_DB_ORIGINS limits the proxy server to your Neptune cluster. The origin must match the URL users enter in their Connection exactly, including the scheme and port. A “not in the Database Origin Allowlist” error means the two differ. To let users reach another database later, add its origin to the comma-separated list, such as https://{NEPTUNE_ENDPOINT}:8182,https://{OTHER_ENDPOINT}:8182. See Database Origin Allowlist.

Tip
The --restart unless-stopped flag ensures the container automatically restarts after a host reboot or if the container crashes. See Docker’s restart policy documentation for other options.
Navigate to the public URL of your EC2 instance accessing the /explorer endpoint. You will receive a warning as the SSL certificate used is self-signed. The URL will look like this:
```
https://ec2-1-2-3-4.us-east-1.compute.amazonaws.com/explorer
```
Important
Never expose this URL publicly without an access control layer in front of it. See Access Control.
Since the application is set to use HTTPS by default and contains a self-signed certificate, you will need to add the Graph Explorer certificates to the trusted certificates directory and manually trust them. See HTTPS Connections section.
After completing the trusted certification step and refreshing the browser, you should now see the Connections UI.