Thursday, July 16, 2026

Best Way to Host n8n on AWS EC2 Step by Step

Written by   on   in   with No comments

n8n, the open-source workflow automation platform launched in October 2019 by Jan Oberhauser, has grown to over 16,000 community members by April 2021 and now integrates with 400+ services. But running it on a shared cloud server can cost you data privacy, latency, and control. Self-hosting n8n on AWS EC2 gives you full ownership of your automation data, predictable monthly costs starting under $10/month on a t2.micro instance, and the ability to scale vertically as your workflows grow. This guide walks you through the exact AWS setup, Docker deployment, and security hardening steps used by production n8n users.

Quick Answer: The best way to host n8n on AWS EC2 is to launch a t2.medium or t3a.medium Ubuntu 22.04 instance, install Docker and Docker Compose, deploy n8n via the official Docker image (n8nio/n8n), map ports 5678, mount a persistent volume, and secure it behind an Nginx reverse proxy with SSL via Let's Encrypt. Total time: 30–45 minutes.

Why Host n8n on AWS EC2 Instead of n8n Cloud or Zapier

n8n's managed cloud service charges per workflow execution. As of 2025, their unlimited plan runs at scale but can cost hundreds per month for heavy usage. Hosting n8n on EC2 flips the economics entirely. AWS introduced EC2 in August 2006 and launched it to full production on October 23, 2008. The t2.micro instance is eligible for AWS Free Tier (750 hours/month for 12 months), meaning you can run n8n at zero compute cost for your first year.

Cost Comparison: Self-Hosted vs. Managed

n8n Cloud's Pro plan starts at roughly $50/month for 50,000 workflow executions. A t3a.medium EC2 instance costs approximately $0.0376/hour ($27/month on-demand). With a 1-year reserved instance, that drops to roughly $15/month. You effectively pay 30–70% less while gaining unlimited executions limited only by your server's CPU and RAM.

Data Privacy and Compliance

When you self-host n8n on EC2, all data — including credentials, webhook payloads, and workflow logs — stays on your instance within your AWS account. For businesses handling GDPR-sensitive data or HIPAA-adjacent workflows, this eliminates third-party data processing concerns. AWS data centers provide SOC 2, ISO 27001, and PCI DSS certifications.

Full Control Over Updates and Nodes

n8n releases new versions roughly every 2–4 weeks. On EC2, you control exactly when to pull the latest Docker image and restart the container. You also decide which community nodes to install and can pin versions to avoid breaking changes.

Prerequisites and AWS Setup

Before deploying n8n, you need an AWS account (created at aws.amazon.com), basic familiarity with the AWS Management Console, and an SSH client. Node.js was originally created by Ryan Dahl in 2009, and n8n is built on Node.js and TypeScript — but you don't need to install Node.js on the EC2 instance because the Docker image bundles it.

Step 1: Launch an EC2 Instance

  1. Log into the AWS Management Console and navigate to EC2 Dashboard.
  2. Click Launch Instance.
  3. Name: n8n-server.
  4. Choose an Amazon Machine Image: Ubuntu Server 22.04 LTS (HVM), SSD Volume Type.
  5. Instance type: t3a.medium (2 vCPU, 4 GiB RAM) — the minimum recommended for production n8n. Use t2.micro only for testing.
  6. Key pair: Create a new RSA key pair and download the .pem file. Store it in ~/.ssh/.
  7. Network settings: Create a security group with these inbound rules:
    • SSH — TCP 22 — Your IP only (0.0.0.0/0 is dangerous)
    • HTTP — TCP 80 — 0.0.0.0/0
    • HTTPS — TCP 443 — 0.0.0.0/0
  8. Configure storage: 20 GB gp3 root volume (default is fine).
  9. Click Launch Instance.

Step 2: Assign an Elastic IP

  1. In the EC2 Dashboard, click Elastic IPs → Allocate Elastic IP address.
  2. Select the Amazon pool, click Allocate.
  3. Select the newly created IP, click Actions → Associate Elastic IP address.
  4. Choose your n8n-server instance and associate. This gives you a static IP that won't change on reboot.

Real-world example: A user-hosted n8n instance processing 10,000+ Slack-to-Google Sheets automations monthly on a t3a.medium used less than 60% CPU and 3.2 GiB of RAM, proving this instance type handles moderate production loads comfortably.

Install Docker and Deploy n8n

Docker was first released in 2013 and uses operating-system-level virtualization to deliver software in lightweight containers. Docker Engine runs n8n consistently across any Linux environment, eliminating dependency conflicts.

Step 3: SSH Into Your Instance

chmod 400 ~/Downloads/n8n-server-key.pem
ssh -i ~/Downloads/n8n-server-key.pem ubuntu@<YOUR_ELASTIC_IP>

Step 4: Install Docker and Docker Compose

  1. Update packages: sudo apt update && sudo apt upgrade -y
  2. Install Docker: sudo apt install docker.io -y
  3. Start Docker: sudo systemctl enable --now docker
  4. Add your user to the docker group: sudo usermod -aG docker $USER
  5. Log out and back in: exit then SSH again.
  6. Install Docker Compose (v2): sudo apt install docker-compose-v2 -y
  7. Verify: docker --version && docker compose version

Step 5: Create docker-compose.yml for n8n

mkdir ~/n8n && cd ~/n8n
nano docker-compose.yml

Paste the following configuration:

version: '3.8'
services:
  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    ports:
      - "127.0.0.1:5678:5678"
    environment:
      - N8N_HOST=<YOUR_DOMAIN_OR_IP>
      - N8N_PROTOCOL=https
      - N8N_PORT=5678
      - WEBHOOK_URL=https://<YOUR_DOMAIN>/
      - GENERIC_TIMEZONE=America/New_York
    volumes:
      - ~/n8n/data:/home/node/.n8n

Replace <YOUR_DOMAIN> with your actual domain or Elastic IP. Save (Ctrl+O) and exit (Ctrl+X).

Step 6: Launch n8n

mkdir -p ~/n8n/data
docker compose up -d
docker compose logs -f

Wait 10–15 seconds. When you see n8n ready on port 5678, press Ctrl+C. Your n8n container is now running and listening on localhost:5678.

Real-world example: A freelance developer migrated 47 workflows from Zapier to self-hosted n8n on a t3a.medium EC2 instance and reduced monthly automation costs from $99 to ~$18, including the Elastic IP and 20 GB EBS volume.

Secure n8n with Nginx Reverse Proxy and SSL

Exposing port 5678 directly to the internet is insecure. n8n's webhook nodes require HTTPS, and Google Chrome blocks many features on non-secure origins. AWS provides no built-in SSL termination for single EC2 instances, so you configure Nginx as a reverse proxy with Let's Encrypt via Certbot.

Step 7: Install Nginx

sudo apt install nginx -y
sudo systemctl enable --now nginx

Step 8: Configure Nginx Reverse Proxy

sudo nano /etc/nginx/sites-available/n8n

Paste:

server {
    listen 80;
    server_name <YOUR_DOMAIN>;

    location / {
        proxy_pass http://127.0.0.1:5678;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
}

Enable the site:

sudo ln -s /etc/nginx/sites-available/n8n /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Step 9: Install SSL with Certbot

sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d <YOUR_DOMAIN>

Follow the prompts. Certbot auto-configures HTTPS and sets up automatic renewal via a systemd timer. Verify with sudo certbot renew --dry-run.

Step 10: Set Up Automatic Backups

crontab -e

Add this line to back up your n8n data daily at 3 AM:

0 3 * * * tar -czf /home/ubuntu/n8n-backup-$(date +\%Y\%m\%d).tar.gz -C /home/ubuntu/n8n data

Real-world example: A team running n8n for a SaaS startup set up health checks via AWS CloudWatch and restored a corrupted database in 4 minutes from a daily tarball backup.

Comparison: n8n Hosting Options

Choosing the right hosting model depends on your budget, technical skill, and scale requirements. The table below compares the four most common n8n deployment approaches as of 2025.

Hosting Method Monthly Cost (Est.) Setup Time
n8n Cloud (Pro) $50/month 5 minutes
AWS EC2 (t3a.medium, on-demand) $27/month 35 minutes
AWS EC2 (t3a.medium, 1-yr reserved) $15/month 35 minutes
AWS ECS Fargate $35–80/month 90 minutes
DigitalOcean Droplet (2 GB RAM, 1 vCPU) $12/month 30 minutes
Railway or Render $5–20/month 15 minutes

Common Mistakes When Hosting n8n on EC2

Mistake 1: Running on t2.micro for Production

Why It Hurts: The t2.micro has 1 vCPU and 1 GiB RAM. n8n's Node.js runtime and Docker container consume 500–700 MB at idle. Running 5–10 active workflows causes out-of-memory kills and webhook timeouts.

Fix: Use t3a.medium (2 vCPU, 4 GiB RAM) as the minimum for production. Burstable T3 instances cost only $0.012/hour more than T2 equivalents and offer better baseline performance.

Mistake 2: Exposing Port 5678 Without a Firewall

Why It Hurts: Anyone scanning your Elastic IP can access the n8n login page. Script kiddies and botnets will attempt brute-force attacks within hours of launch.

Fix: Bind n8n to 127.0.0.1:5678 as shown in the docker-compose.yml above. Place Nginx in front, and configure AWS Security Groups to allow only ports 22, 80, and 443.

Mistake 3: No Persistent Volume Backup

Why It Hurts: If your Docker container crashes or you run docker compose down -v, n8n's SQLite database and credential keys are destroyed permanently. All workflows, credentials, and execution history vanish.

Fix: Always mount a host volume to /home/node/.n8n. Set up daily cron backups to an S3 bucket with aws s3 sync.

Mistake 4: Skipping Environment Variable Configuration

Why It Hurts: n8n may generate incorrect webhook URLs, break OAuth callbacks, or fail to send emails if N8N_HOST, WEBHOOK_URL, or N8N_PROTOCOL are missing.

Fix: Explicitly set N8N_HOST to your domain, N8N_PROTOCOL to https, and WEBHOOK_URL to https://yourdomain.com/ in docker-compose.yml.

Mistake 5: Using Default SQLite for High-Volume Workloads

Why It Hurts: SQLite cannot handle concurrent writes. With 50+ workflows executing simultaneously, you'll see SQLITE_BUSY errors and missed executions.

Fix: Migrate to PostgreSQL by adding a Postgres container to your docker-compose.yml and setting DB_TYPE=postgresdb, DB_POSTGRESDB_DATABASE, DB_POSTGRESDB_USER, and DB_POSTGRESDB_PASSWORD.

Pro Tips

  • Pin your n8n Docker image version (e.g., n8nio/n8n:1.73.0) instead of using latest to prevent unexpected breaking changes from auto-updates.
  • Use AWS Systems Manager Session Manager instead of SSH for zero-trust access — no open port 22 required.
  • Add N8N_METRICS=true and N8N_METRICS_INCLUDE_DEFAULT_METRICS=true to enable Prometheus metrics for monitoring with Grafana.
  • Set up an SNS topic via AWS CloudWatch Alarms to alert you if the EC2 CPU exceeds 80% for 5 consecutive minutes.

FAQ

What exactly is n8n and how does it work on AWS EC2?

n8n is an open-source workflow automation platform built on Node.js and TypeScript, founded by Jan Oberhauser in Berlin in 2019. On AWS EC2, n8n runs inside a Docker container that listens on port 5678, connects to databases and APIs via 400+ integrations, and executes trigger-based or scheduled automation workflows. The EC2 instance provides the compute, memory, and persistent storage that powers the n8n engine.

How does self-hosting n8n on EC2 compare to using n8n Cloud?

n8n Cloud costs $50/month (Pro) and requires zero server management but limits you to 50,000 executions monthly. Self-hosting on EC2 costs $15–27/month for a t3a.medium instance with unlimited executions, but you manage updates, backups, and security patches yourself. Self-hosting wins on cost and data control; n8n Cloud wins on convenience and support.

What is the step-by-step process to connect my domain to n8n on EC2?

First, point an A record for your domain (e.g., n8n.yourdomain.com) to your EC2 Elastic IP address. Second, install Nginx and configure a reverse proxy to forward traffic from port 80/443 to 127.0.0.1:5678. Third, run Certbot to obtain a free Let's Encrypt SSL certificate. Once complete, access your n8n instance at https://n8n.yourdomain.com.

Why is my n8n webhook returning a 502 Bad Gateway error?

A 502 error typically means Nginx cannot reach the n8n container. Check if the Docker container is running with docker ps and verify n8n is listening on 127.0.0.1:5678 with ss -tulpn | grep 5678. Also confirm that proxy_pass http://127.0.0.1:5678; in your Nginx config has no typos and that you reloaded Nginx after changes with sudo systemctl reload nginx.

Will self-hosting n8n on EC2 scale as my automation needs grow?

Yes. You can scale vertically by resizing to a larger EC2 instance like t3a.large or c6i.large without reconfiguring n8n. For horizontal scaling, place n8n behind an Application Load Balancer and use a managed PostgreSQL database on RDS. n8n's architecture supports queue mode with Redis for distributing executions across multiple workers.

Conclusion

Self-hosting n8n on AWS EC2 is the most cost-effective and privacy-respecting way to run workflow automation at scale. By following this guide — launching a t3a.medium Ubuntu instance, deploying n8n via Docker Compose, securing access with Nginx and Let's Encrypt, and implementing proper backups — you gain unlimited execution capacity with full data sovereignty for a fraction of the cost of managed alternatives. n8n's open-source model, backed by over $193 million in venture funding from Accel, Sequoia, and Felicis, ensures the platform stays actively maintained with hundreds of integrations.

  • The best n8n EC2 setup uses t3a.medium, Docker Compose, and Nginx reverse proxy with SSL.
  • Always bind n8n to localhost behind a proxy — never expose port 5678 directly.
  • Automate daily backups of the /home/node/.n8n volume to S3 or local tarballs.
  • Migrate from SQLite to PostgreSQL and pin your Docker version for production reliability.

Sources

Share:

0 comments:

Post a Comment