Getting started¶
Launch Whisper CPU transcription in your AWS account, connect privately and verify the result of your first task.
1. Launch and wait for startup¶
Use the Software Sushi Marketplace version 0.1.10 described here, Ubuntu 24.04 x86_64, and at least t3.medium / 4 GiB RAM with 24 GiB encrypted gp3 root storage. Keep IMDSv2 enabled. These are minimum starting sizes, not throughput benchmarks. Inbound application ports must remain closed.
For Session Manager, attach a customer-owned instance role with the required Systems Manager permissions and provide outbound HTTPS/DNS connectivity to the relevant endpoints. Your workstation needs AWS CLI, the Session Manager Plugin and permission to start sessions. SSH is an alternative when TCP 22 is restricted to your administrative CIDR. The application itself does not need a model-provider key.
Connect to your instance, then run the following. The second command starts a login shell as ubuntu; run the remaining commands inside that shell.
sudo cloud-init status --wait
sudo -iu ubuntu
umask 077
sudo systemctl is-active sushi-whisper-cpu-api.service
bash /opt/sushi/docs/demo.sh
Wait for cloud-init to finish and every listed service to report active. The demo checks the installed service; it does not validate your own data or workload. A failed service needs diagnosis before you submit work. Do not recreate the instance identity or run a second server to bypass a startup failure.
2. Use the private connection¶
First boot creates a unique TLS identity and ~/.config/sushi/whisper-cpu/access.json for the ubuntu account, with mode 0600. The matching server.crt sits beside it. The installed sushi-whisper-cpu-api helper reads these files and verifies TLS without printing credentials. Run it on the instance as ubuntu.
To reach port 8443 from your own workstation, open a separate terminal and replace the placeholders below with your customer profile, Region and instance ID:
aws --profile <customer-profile> --region <region> ssm start-session \
--target <instance-id> \
--document-name AWS-StartPortForwardingSession \
--parameters '{"portNumber":["8443"],"localPortNumber":["8443"]}'
Keep that terminal open. Forwarding a port does not install the API helper on your workstation or copy its identity files. For a workstation client, transfer only the required certificate and private client file through an authenticated channel, retain private permissions and configure the client to read credentials from that file. Do not put credentials in URLs, command arguments, user data or support logs. Do not disable certificate verification.
3. Transcribe a recording¶
Transfer a recording you own or have permission to process into this session as recording.wav. Select en or es, or omit language for automatic detection. Keep an independent transcript so you can check numbers, names and timestamps against the original audio.
Run in a new private working directory as ubuntu. The commands write requests and responses there; retain or securely remove them according to your data policy.
python3 - recording.wav > request.json <<'PYAUDIO'
import base64, json, pathlib, sys
print(json.dumps({"format": "wav", "language": "en",
"data": base64.b64encode(pathlib.Path(sys.argv[1]).read_bytes()).decode()}))
PYAUDIO
sushi-whisper-cpu-api POST /process --input request.json > transcript.json
python3 - <<'PYAUDIO'
import json
from pathlib import Path
result = json.loads(Path('transcript.json').read_text())
assert result['text'].strip() and result['segments']
Path('transcript.txt').write_text(result['text'])
print('Transcript saved; listen to the original and review transcript.json timestamps.')
PYAUDIO
Package limits. WAV, FLAC and MP3 with a known duration, up to 10 MiB and five minutes per clip. One request at a time; int8 CPU inference. No diarization, translation, live streaming or voice generation. Accuracy and processing time depend on the recording and instance.
The fuller walkthrough and installed operating notes are in /opt/sushi/docs/DEMO.md and /opt/sushi/docs/README.md. These describe this package’s API and defaults. General upstream examples may use different endpoints or include features outside this package.
Local batch transcription¶
For a file beyond the HTTPS endpoint's five-minute or 10 MiB limit, run the installed Python SDK locally as ubuntu. This is a separate local process: the HTTP limits stay in place. Finish active API work first, and run one batch at a time. Version 0.1.10 supports passing a WAV, FLAC or MP3 filename directly to the installed SDK. It uses the bundled model offline; it does not install packages or change the service.
Older Marketplace versions
Versions 0.1.8 and 0.1.9 have a filename-overload compatibility limitation with their installed PyAV version. They require an already decoded NumPy audio array for local SDK calls. The direct-filename example below requires version 0.1.10. The HTTPS endpoint in the older versions decodes audio itself and does not use that failing overload.
Save this as transcribe-local.py in your private working directory:
import json
import sys
from pathlib import Path
from faster_whisper import WhisperModel
source = Path(sys.argv[1])
model = WhisperModel(
"/opt/whisper-cpu/models", device="cpu", compute_type="int8",
cpu_threads=2, num_workers=1, local_files_only=True,
)
segments, info = model.transcribe(
str(source), language="en", beam_size=1, condition_on_previous_text=False,
word_timestamps=False, vad_filter=False,
)
items = [{"start": item.start, "end": item.end, "text": item.text}
for item in segments]
Path("batch-transcript.json").write_text(json.dumps({
"language": info.language, "duration": info.duration, "segments": items,
"text": "".join(item["text"] for item in items).strip(),
}, ensure_ascii=False) + "\n")
Use language="es" for Spanish, or None for automatic detection. Run the script with the installed runtime and private output permissions:
umask 077
LD_LIBRARY_PATH=/opt/sushi/whisper-media/lib \
HF_HUB_OFFLINE=1 TRANSFORMERS_OFFLINE=1 \
TOKENIZERS_PARALLELISM=false OMP_NUM_THREADS=2 \
PYTHONDONTWRITEBYTECODE=1 \
/opt/whisper-cpu/venv/bin/python transcribe-local.py recording.wav
In version 0.1.10, this filename path was tested on a fresh t3.medium instance with a 5 minute 31 second English WAV recording larger than 10 MiB. The test compared the complete transcript with an independent reference and measured a 2.12% word error rate. That is one test result, not an accuracy or throughput guarantee. The reference audio consists of 38 complete, ordered utterances from LibriSpeech test-clean, chapter 1320/122617, by Vassil Panayotov, Guoguo Chen, Daniel Povey and Sanjeev Khudanpur, licensed under CC BY 4.0.
The batch decoder holds decoded audio in memory. Start with a bounded recording, monitor memory and disk usage, and split larger inputs before they exhaust the instance. The bundled small model, CPU settings and accuracy limitations still apply. Inspect the original audio before acting on names, numbers or decisions in a transcript.
Last updated October 17, 2026 · Suggest an improvement