Host n8n on AWS EC2: Complete Open-Source Guide

Automation platforms like Zapier and Make charge $20–$50 monthly for basic workflows. n8n offers a source-available alternative with 400+ integrations, but hosting it yourself requires technical setup. This guide shows how to deploy n8n on AWS EC2 using 100% open-source tools, cutting costs by 70% and keeping data private. Quick Answer: Self-host n8n on AWS EC2 by launching an Ubuntu instance, installing Docker, running n8n with PostgreSQL via Docker Compose, and securing it with SSL. Total setup takes 30–45 minutes, costs roughly $8–$15 monthly on t3.medium or t3.large instances, and provides full control over workflow data.

Why Self-Host n8n on AWS EC2?

Managed automation tools lock you into per-task pricing that scales unpredictably. n8n’s open-source core eliminates license fees, while AWS EC2 provides pay-as-you-go infrastructure. A December 2025 report noted n8n’s community grew from zero in 2019 to more than 16,000 developers and citizen developers within two years. By 2025, the platform connects 400–1,000 applications, making it a credible Zapier replacement for teams that value cost transparency.

Cost Control vs. Managed Services

Zapier’s “Professional” plan starts at $19.99 monthly plus $0.50–$5.00 per task beyond 750 runs. Make’s “Core” tier costs $9.00 monthly but limits operations to 1,000. A t3.medium EC2 instance runs n8n 24/7 for approximately $8.30 monthly (730 hours × $0.0114/hour on-demand Linux pricing in us-east-1). You also avoid overage penalties.

Data Privacy & Compliance

Healthcare, finance, and legal teams cannot export customer records to third-party SaaS without audits. Hosting n8n on EC2 inside a private VPC keeps PII and PHI inside your AWS account. You rotate keys, mask logs, and enforce encryption-at-rest via EBS volumes.

Custom Workloads & AI Integration

n8n’s Code node runs JavaScript and Python directly inside workflows. Teams use this to call OpenAI APIs, transform CSV payloads, or query internal PostgreSQL databases without middleware. On EC2, you attach Elastic IPs, place instances in private subnets, and hook into AWS Secrets Manager to store credentials.

Choosing the Right EC2 Instance for n8n

Instance selection determines throughput and monthly cost. n8n’s architecture is lightweight by default, but heavy ETL jobs or AI models demand CPU and RAM. Match instance size to expected workflow volume.

Instance Types for Workloads

AWS classifies instances by use case. General-purpose T-series instances burst CPU during spikes, making them ideal for light automation. Compute-optimized C-series handle constant AI inference. Memory-optimized R-series suit workflows queuing large datasets.

Minimum Recommended Specifications

For teams running under 500,000 tasks monthly, choose t3.medium (2 vCPU, 4 GiB RAM) or t3.large (2 vCPU, 8 GiB RAM). Both types include baseline CPU credits that replenish during idle periods. Storage matters equally: gp2 EBS volumes cost $0.10/GB-month. Allocate 20–50 GB to hold PostgreSQL data, n8n binary files, and Docker layers.

Network & High Availability

Place instances in at least two Availability Zones if uptime is critical. Assign Elastic IPs to avoid DNS changes when stopping/starting instances. Security groups should allow SSH (port 22) from your IP only, HTTP/HTTPS (80/443) publicly, and internal n8n traffic (5678) only from localhost or a load balancer.

Step-by-Step: Deploy n8n on AWS EC2

Follow this exact sequence to avoid common configuration errors. Total time: 30–45 minutes.

1. Launch an EC2 Instance: Log into AWS Console, choose “Launch Instance,” select Ubuntu Server 22.04 LTS AMI, pick t3.medium, and create a security group permitting ports 22, 80, 443, and 5678.
2. Connect via SSH: Download the .pem key, set permissions to 400, and connect using ssh -i "key.pem" ubuntu@[PUBLIC_IP].
3. Install Docker & Compose: Run sudo apt update && sudo apt install -y docker.io docker-compose. Add your user to the docker group with sudo usermod -aG docker $USER.
4. Create Docker Compose File: Save a docker-compose.yml that defines three containers: n8n, PostgreSQL, and Caddy (for reverse proxy and SSL). Use environment variables for database credentials.
5. Start Services: Execute docker-compose up -d. Verify health at http://localhost:5678.
6. Configure SSL & Domain: Point a Route 53 A record to the Elastic IP, then run docker-compose exec caddy caddy trust to provision Let’s Encrypt certificates automatically.

Docker Compose Configuration Example

Use this exact structure for docker-compose.yml:

version: '3.8'
services:
  postgres:
    image: postgres:15-alpine
    restart: always
    environment:
      - POSTGRES_USER=n8n
      - POSTGRES_PASSWORD=[SECURE_PASSWORD]
      - POSTGRES_DB=n8n
    volumes:
      - ./postgres_data:/var/lib/postgresql/data
  n8n:
    image: n8nio/n8n:latest
    restart: always
    ports:
      - "127.0.0.1:5678:5678"
    environment:
      - DB_TYPE=postgresdb
      - POSTGRESDB_HOST=postgres
      - POSTGRESDB_PORT=5432
      - POSTGRESDB_DATABASE=n8n
      - POSTGRESDB_USER=n8n
      - POSTGRESDB_PASSWORD=[SECURE_PASSWORD]
      - N8N_HOST=[YOUR_DOMAIN]
      - N8N_PROTOCOL=https
      - N8N_PORT=5678
      - NODE_ENV=production
      - WEBHOOK_URL=https://[YOUR_DOMAIN]/
    volumes:
      - ./n8n_data:/home/node/.n8n
    depends_on:
      - postgres
  caddy:
    image: caddy:2-alpine
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./caddy_data:/data
    environment:
      - CADDY_EMAIL=[YOUR_EMAIL]

Environment Variables & Secrets

Never hardcode passwords in version control. Use AWS Systems Manager Parameter Store or Secrets Manager to inject values at runtime. For example, retrieve the PostgreSQL password with $(aws ssm get-parameter --name "n8n_db_pass" --query "Value" --output text) inside the compose file.

Post-Deployment: Database & Storage Tuning

Proxies and containers run smoothly only with persistent, optimized storage. N8n stores execution data, credentials, and workflow definitions in its home directory. PostgreSQL keeps queued job states and user tables.

PostgreSQL Configuration on EC2

PostgreSQL defaults allocate modest shared buffers. Edit postgresql.conf to set shared_buffers = 256MB and work_mem = 16MB for t3.medium instances with 4 GiB RAM. Increase max_connections to 200 if you run many concurrent webhook triggers. Back up daily using pg_dump and upload the .sql file to S3 via a cron job.

EBS Volume Management

General Purpose SSD (gp2) suffices for most teams. Provision IOPS only if workflows exceed 100,000 executions daily. Monitor volume burst balance in CloudWatch. When balance drops below 20%, consider upgrading to gp3, which lowers cost and adds baseline performance.

Backup & Disaster Recovery

Automate EBS snapshots via AWS Backup. Schedule daily snapshots with a 30-day retention policy. Test restores monthly. Cross-region copy protects against regional outages. For n8n-specific data, zip ./n8n_data and push to S3 using rclone or AWS CLI inside a cron schedule.

Maintenance, Monitoring & Scaling

Containers drift if not refreshed. Use Watchtower to auto-update n8n when new releases publish. Monitor CPU and memory via CloudWatch alarms at 70% utilization. Add alarms for PostgreSQL replication lag if you enable streaming replication later.

Security Hardening Checklist

• Disable password authentication for SSH; use key pairs only.
• Restrict inbound 5678 to 127.0.0.1 inside the EC2 security group.
• Enable UFW firewall on Ubuntu: sudo ufw allow ssh && sudo ufw allow http && sudo ufw allow https && sudo ufw enable.
• Rotate database passwords quarterly via Parameter Store.
• Install fail2ban to block brute-force SSH attempts.

When to Scale Beyond a Single EC2 Instance

Single EC2 instances perform reliably up to 1 million monthly tasks. Beyond that, latency increases as PostgreSQL competes for CPU. Scale by adding an RDS Multi-AZ PostgreSQL cluster, offloading webhooks to Application Load Balancer + Auto Scaling Group, or switching to ECS/EKS with Fargate for container orchestration.

n8n Hosting Option Comparison: EC2 vs. Cloud vs. SaaS

Choosing between self-managed, managed n8n Cloud, and Zapier depends on technical expertise, compliance needs, and budget. Below is a feature-by-feature comparison based on Q1 2026 pricing and capabilities.

Feature	n8n Self-Hosted (AWS EC2)	n8n Cloud
Monthly cost (500k tasks)	$10–$20 EC2 + storage	$50–$100 (Pro tier)
Data residency	User-controlled AWS region	EU or US only
Custom node support	Full local install	Limited to approved nodes
Custom domain + SSL	Yes (via Caddy/Nginx)	Included
Compliance (HIPAA/BAA)	Requires own BAA	Available with add-on
Webhook latency	5–50 ms (same AZ)	20–150 ms
Backup management	Manual/automated	Point-in-time restore
Scaling limit	Instance-dependent	Automatic
Technical skill required	Medium (Linux/Docker/DNS)	Low
Uptime SLA	EC2 SLA only	99.9%

Common n8n EC2 Deployment Mistakes

Even experienced DevOps engineers overlook details that break workflows in production. Avoid these pitfalls.

Mistake: Opening Port 5678 to 0.0.0.0

Why it hurts: Exposing n8n’s API externally invites brute-force login attempts and credential stuffing. N8n does not ship with account lockout policies on self-hosted installs.

Fix: Bind n8n to 127.0.0.1 inside the compose file and route external traffic through Caddy or Nginx. The application layer never touches the public interface.

Mistake: Using a Single gp2 Volume for Database + Application

Why it hurts: IOPS contention between PostgreSQL WAL writes and Docker image pulls slows webhooks. During backup windows, latency spikes triple response times.

Fix: Mount separate EBS volumes for n8n_data and postgres_data. Even two 20 GB volumes outperform one 40 GB volume under concurrent writes.

Mistake: Neglecting Automatic Security Updates

Why it hurts: Ubuntu security patches are released weekly. Without unattended-upgrades, your instance becomes vulnerable to Heartbleed-class exploits within days.

Fix: Install unattended-upgrades and enable automatic reboots during maintenance windows. Test updates on a staging instance first.

Mistake: Storing Credentials in Plaintext docker-compose.yml

Why it hurts: Pushing the file to GitHub exposes database passwords and OAuth tokens. Attackers scrape public repos for leaked secrets in minutes.

Fix: Use Docker secrets or AWS Secrets Manager. Reference secrets via secrets: blocks in Compose v3.1+. Never commit .env files.

Pro Tips from Production Operators

• Use t3.medium with “unlimited” CPU bursting enabled ($0.0208/hour burstable) rather than t3.small; the extra $3 prevents workflow timeouts during spikes.
• Enable n8n’s “Queue Mode” with Redis to distribute jobs across multiple workers when scaling beyond one instance.
• Configure CloudWatch Logs Insights to query n8n JSON logs for error patterns before users report failures.
• Place EC2 in a private subnet with a NAT gateway, then expose via ALB; this reduces attack surface compared to public-IP deployments.

FAQ

What is n8n workflow automation?

N8n is a node-based automation platform where users visually connect applications, APIs, and code to replace manual tasks. Released publicly in October 2019 by Berlin-based n8n GmbH, it supports 400–1,000 integrations and runs on Node.js. Unlike SaaS alternatives, n8n can be self-hosted or used as a managed cloud service.

How does n8n compare to Zapier and Make?

N8n charges no per-task fees on self-hosted instances, while Zapier and Make scale pricing with execution volume. N8n offers a Code node for JavaScript/Python; Make provides advanced scenario branching; Zapier focuses on ease-of-use. Self-hosted n8n gives full data ownership, making it preferred for regulated industries.

How do I install n8n on AWS EC2 exactly?

Launch an Ubuntu 22.04 t3.medium EC2 instance, open ports 22, 80, 443, and 5678, SSH in, install Docker and Docker Compose, create a docker-compose.yml with n8n and PostgreSQL services, then run docker-compose up -d. Point a domain to the Elastic IP, enable Caddy’s HTTPS, and finish configuration at https://your-domain.com.

Why is my self-hosted n8n instance slow?

Common causes include undersized EC2 instances, PostgreSQL shared_buffers too low, or EBS volumes without enough IOPS. Check CPU steal with top or CloudWatch. Switch to a larger instance family, tune PostgreSQL memory settings, or upgrade to gp3 EBS for sustained throughput.

What future trends affect self-hosted n8n on EC2?

AWS continues pushing Graviton4 instances (up to 30% better compute than C7gn) and fractional GPU instances (G6f) for AI workflows. N8n’s October 2025 Series C brought a $2.5 billion valuation, signaling continued investment in AI nodes. Expect tighter Docker image security scanning and native AWS Fargate support in coming releases.

Conclusion

Hosting n8n on AWS EC2 delivers the lowest monthly cost, maximum data control, and complete customization for engineering teams. With Docker Compose, PostgreSQL, and Caddy, the stack stays 100% open-source and vendor-neutral. A properly sized t3.medium instance handles most small-to-mid production loads for under $10 monthly.

• Always use separate EBS volumes for database and application data to avoid IOPS contention.
• Bind n8n to localhost and reverse-proxy through Caddy to eliminate direct API exposure.
• Back up both EBS snapshots and n8n working directories to S3 daily.
• Monitor with CloudWatch alarms and watch CPU credits on burstable instances.

Sources

• Wikipedia: N8n
• Wikipedia: Amazon Elastic Compute Cloud
• Wikipedia: Docker (software)
• Wikipedia: PostgreSQL
• n8n Official Documentation
• AWS EC2 User Guide