Covered in this guide:
The Metabase team runs a number of production installations on AWS using Elastic Beanstalk and currently recommend it as the preferred choice for production deployments. Below is a detailed guide to installing Metabase on Elastic Beanstalk.
Metabase provides an Elastic Beanstalk pre-configured launch url to help new installations getting started. If you are starting fresh we recommend you follow this link to begin creating the Elastic Beanstalk deployment with a few choices pre-filled.
Launch Metabase on Elastic Beanstalk
The rest of this guide will follow each phase of the Elastic Beanstalk setup step-by-step.
You should now see a screen that looks like
NOTE: If this screenshot does not match what you see in the Elastic Beanstalk console, it is likely that you are on an old version of the Elastic Beanstalk UI. At the time of writing this documentation, both versions of the UI are being reported in the wild. You can view our older documentation here
Elastic Beanstalk is organized into Applications and Environments, so to get started we must create a new Application. Enter the application name Metabase and continue by clicking Next.
Here you are given a chance to pick a name and url that you want to use for running Metabase instance. Feel free to get creative, just remember that the URL for your Metabase instance must be unique across all AWS Elastic Beanstalk deployments, so you’ll have to pick something nobody else is already using.
We often recommend something like mycompanyname-metabase
And of course if you don’t care about the URL you can simply leave it to whatever Amazon inputs by default.
Elastic Beanstalk provides two choices for environments within an Application, but you should leave the setting to Web Server on that landing page.
For the base configuration settings we want to make the following selections:
Preconfigured Platform > DockerUpload Your Code
This will run our Metabase application using Docker under the hood.
If you reached this screen from the Metabase start page at www.metabase.com/start/aws.html the application code settings will have already been set and you don’t need to do anything. This will use the official Metabase Docker image which is published on Dockerhub.
When your environment type settings look like the above then go ahead and click Review and launch.
You will need to enable enhanced health checks for your Beanstalk Monitoring.
Click on the modify link under the Monitoring section as below.
Then make sure enhanced health checks are enabled. This is a free option, unless you later add specific metrics to CloudWatch.
To run Metabase in a cloud environment of any kind we highly recommend using an independent database server with high availability such as Amazon RDS. So for standard deployments we will choose to create an RDS instance with our Elastic Beanstalk application.
NOTE: it’s possible to skip this step if you wish, however this will force Metabase to use a local H2 database file on your application server and there will be no way to backup and maintain that database, so when your instance is restarted for any reason you’ll lose all your Metabase data. If you are just doing a quick trial of Metabase that may be okay, but otherwise we recommend against this.
To set the database password from the Beanstalk template, hit “Review and Launch”, and then look for the Database configuration pane as below. It should have a red outline when you first see this page.
Once there, enter a database username and password. We suggest you hold onto this in a password manager, as it can be useful for things like backups or troubleshooting.
Regarding individual settings, we recommend:
Snapshot should be left as None.DB engine should be set to postgres. Metabase also supports MySQL/Maria DB as backing databases, but this guide currently only covers running Metabase on Postgres.DB engine version can simply be left on the default, which should be the latest version.Instance class you can choose any size, we recommend db.t2.small or bigger for production installs. Metabase is pretty efficient so there is no need to make this a big instance.Allocated storage to the default size.Username and Password for your database. This is just for reference if you need to connect to your db directly for some reason, but generally this should not be necessary. These settings will be automatically made available to your Metabase instance, so you will not need to put them in anywhere manually.Retention setting as Create snapshotAvailability we recommend the default value of Single Availability Zone for most circumstances.Once you’ve entered a password and clicked Save, the red outline should have gone away, indicating that the application is valid and ready to be launched.
Newer AWS accounts are encouraging the use of VPC for deployments and in general we think it’s simplest to follow that best practice.
If you prefer not to use a VPC that is fine, however one thing to note is that some EC2 instance types (t2.* in specific) are not available outside of a VPC, so if you choose to not use a VPC then make sure and pick appropriate instance types.
If you are launching your Metabase inside of a VPC you’ll now need to check a few boxes to enable your application to work inside your VPC subnets.
Unless you have a custom VPC setup that you know how to configure it’s easiest to just check all the boxes and allow your infrastructure to exist on all subnets. Note that the Load Balancer cannot be in more than one subnet per availability zone, and the database requires subnets in at least two availability zones.
Once you’ve finished your VPC config click Save
There are many ways to customize your Beanstalk deployment, but commonly modified settings include:
Instance type is for picking the size of AWS instance you want to run. Any size is fine but we recommend t2.small for most uses.
EC2 key pair is only needed if you want to ssh into your instance directly. We recommend leaving this out.Email address to get notifications about your deployments and changes to your application. This is a very simple way to keep tabs on your Metabase environment, so we recommend putting a valid email in here.Application health check URL is how Elastic Beanstalk knows when the application is ready to run. You must set this to /api/healthIf this is your first time creating an application for Elastic Beanstalk then you will be prompted to create a new IAM role for your launched application. We recommend simply leaving these choices to their defaults.
When you click Next a new tab will open in your browser and you will be prompted to create a new IAM role for use with Elastic Beanstalk. Again, just accept the defaults and click Allow at the bottom of the page.
This can take a little while depending on Amazon. It’s not strange to see this take 20-30 minutes, so feel free to do something else and come back to check on it. The time taken here is to provision each part of the environment.
When all is well you should see something like this:
To see your new Metabase instance simply click on the link in parentheses next to your environment name. In this example it’s metabase-env-tttt.elasticbeanstalk.com
Now that you’ve installed Metabase, it’s time to set it up and connect it to your database.
Upgrading to the next version of Metabase is a very simple process where you will grab the latest published Elastic Beanstalk deployment file from Metabase and upload it to your Application Versions listing. From there it’s a couple clicks and you’re upgraded.
Here’s each step:
Metabase application
Application Versions on the left nav (you can also choose Application Versions from the dropdown at the top of the page)Upload button on the upper right side of the listing
Choose File and navigate to the file you just downloadedUpload button to upload the fileDeploy button in the upper right side of the page
Deploy button to begin the deploymentOnce a new version is deployed you can safely delete the old Application Version if desired. we recommend keeping at least one previous version available for a while in case you desire to revert for any reason.
If you want to retain the Metabase application logs you can do so by publishing then to an S3 bucket of your choice. Here’s how:
Configuration link in the navigation bar on the left side. You will be taken to a page with a number of boxes containing different configuration options for your environment.
Software Configuration under the heading Web TierEnable log file rotation to Amazon S3Save in the bottom right cornerAfter you click save your Environment will begin updating with your new change. you will have to wait a minute for this to complete and then you’re good to go. Elastic Beanstalk will now periodically publish the application log files to S3 for you and you can download them and analyze them at your leisure.
This is only relevant if you plan to use HTTPS (recommended) for your Metabase instance on AWS. There is no requirement to do this, but we are sticklers for security and believe you should always be careful with your data.
Sadly there is no option to do this via the AWS Console, so this step must be performed using the AWS CLI client
aws iam upload-server-certificate \
--server-certificate-name <your-cert-name> \
--certificate-body file:///path/to/certificate.crt \
--private-key file:///path/to/private-key.pem
This will create a new certificate inside your AWS environment which can be reused for a variety of things. Remember the name you chose for your certificate because we’ll use that later in the setup process when we enable SSL.
Before trying to enable Https support you must upload a server certificate to your AWS account. Instructions above.
Metabase application
Configuration on the left hand sidebarLoad Balancing under the Network Tier section and click the gear icon to edit those settings.Secure listener port to 443SSL certificate ID, choose the name of the certificate that you uploaded to your account.
Save in the lower right
Once your application is working properly over HTTPS we recommend setting an additional property to force non-https clients to use the HTTPS endpoint
Configuration on the left hand sidebar
Software Configuration under the Web Tier section and click the gear icon to edit those settings.Environment Properties add an entry for NGINX_FORCE_SSL with a value of 1Apply in the lower right, then wait for your application to update.It’s best to set your JVM timezone to match the timezone you’d like all your reports to come in. You can do this by adding the JAVA_TIMEZONE environment variable.
Configuration on the left hand sidebar
Software Configuration under the Web Tier section and click the gear icon to edit those settings.Environment Properties add the followingJAVA_TIMEZONE with a value such as US/Pacific
* Scroll to the bottom of the page and click Apply in the lower right, then wait for your application to update.This provides a simple way to use the Papertrail logging service for collecting the logs for you Metabase instance in an easy to read location.
Configuration on the left hand sidebar
Software Configuration under the Web Tier section and click the gear icon to edit those settings.Environment Properties add the following entriesPAPERTRAIL_HOST - provided by PapertrailPAPERTRAIL_PORT - provided by PapertrailPAPERTRAIL_HOSTNAME - the name you want to see showing up in Papertrail for this server
* Scroll to the bottom of the page and click Apply in the lower right, then wait for your application to update.NOTE: sometimes these settings will not apply until you restart your application server, which you can do by either choosing Restart App Server(s) from the Actions dropdown or by deploying the same version again.
For the truly paranoid, we provide a setting in the AWS EB deployment which enforces an nginx check of the hostname of the incoming request and terminates the request if the client is not requesting the exact hostname that we expect. This is nice for preventing random internet traffic from stumbling upon your Metabase instance.
Configuration on the left hand sidebar
Software Configuration under the Web Tier section and click the gear icon to edit those settings.Environment Properties add an entry for NGINX_SERVER_NAME with a value corresponding to the exact domain name you are using for your Metabase instance.Apply in the lower right, then wait for your application to update.