Host n8n on AWS EC2: Step-by-Step Guide to Avoid Bans ~ The Automaters

Q: What is the minimum EC2 instance size for production n8n?

t3.small (2 vCPU, 2 GB RAM) is the minimum for production with PostgreSQL and Nginx on the same instance. t3.micro works for dev but will OOM under load. For queue mode with Redis, use t3.medium (2 vCPU, 4 GB) or separate worker instances. Monitor FreeableMemory CloudWatch metric; keep > 500 MB headroom.

Over 16,000 developers used n8n by April 2021, and the platform now connects 350+ applications as of December 2025, making it a top choice for workflow automation. Yet many self-hosters lose their AWS accounts because they ignore the AWS Acceptable Use Policy — running crypto miners, open relays, or vulnerable instances that get compromised. This guide shows you exactly how to deploy n8n on EC2 securely, harden the server against abuse complaints, and stay compliant so your automation runs uninterrupted for years.

Quick Answer: Launch a t3.micro Amazon Linux 2023 instance, install Docker and Docker Compose, configure n8n with PostgreSQL behind Nginx reverse proxy, enable HTTPS via Let's Encrypt, lock down security groups to ports 80/443/22 (your IP only), install Fail2Ban, set up automated backups to S3, and monitor CPU/credit usage to prevent crypto-mining flags.

Why Self-Host n8n on AWS EC2 Instead of n8n Cloud

Data Sovereignty and Cost Control

n8n Cloud starts at €20/month for 2,500 executions, while a t3.micro EC2 instance costs ~$7.50/month on-demand (less with Savings Plans). Self-hosting keeps sensitive workflow data — API keys, customer PII, financial records — inside your VPC, satisfying GDPR Article 28 and HIPAA Business Associate Agreement requirements without third-party processors.

Unlimited Custom Nodes and Python Support

n8n Cloud restricts custom node installation and Python code nodes. On EC2 you can install any npm package, write Python 3.11 scripts in Code nodes, and compile native binaries like ffmpeg for video processing workflows. The n8n GitHub repository shows 400+ community nodes unavailable on cloud plans.

Full Control Over Scaling and Integrations

You decide when to scale vertically (resize instance) or horizontally (add queue workers with Redis). Direct VPC peering to RDS, ElastiCache, or on-prem databases eliminates NAT gateway costs and latency. A 2024 benchmark by n8n GmbH showed self-hosted instances handling 50,000 executions/hour on a c6i.large with proper queue configuration.

Prerequisites: AWS Account Setup and Security Baseline

Enable AWS Security Hub and GuardDuty

Before launching anything, activate AWS Security Hub (free tier) and GuardDuty ($4.00/million events) in your target region. GuardDuty detects cryptocurrency mining, unusual API calls, and communication with known malicious IPs — the top three triggers for AWS account suspension. In 2023, AWS reported GuardDuty reduced false-positive abuse reports by 78%.

Create a Dedicated IAM User with Least Privilege

Do not use root credentials. Create an IAM user "n8n-deploy" with these inline policies: AmazonEC2FullAccess, AmazonS3FullAccess (for backups), AmazonRDSFullAccess (if using managed PostgreSQL), and IAMReadOnlyAccess. Attach a permissions boundary denying iam:CreateAccessKey for root and ec2:RunInstances with InstanceType not in t3.*,t4g.*,c6i.* to prevent accidental expensive launches.

Configure Billing Alarms at $5, $25, $100

In CloudWatch, create billing alarms at $5 (dev), $25 (staging), $100 (prod). Unexpected spikes often indicate compromised instances mining Monero. AWS Abuse Team cites "unusual billing activity" as the #1 reason for automated account flags. Link alarms to SNS topic emailing you and a Slack webhook via Lambda.

Step-by-Step: Deploy n8n on EC2 with Docker Compose

Launch the Right Instance Type and AMI

Open EC2 console → Launch Instance → Name: n8n-prod.
Select Amazon Linux 2023 AMI (ARM64 for Graviton3 savings, or x86_64).
Choose t3.micro (2 vCPU, 1 GB RAM) for dev; t3.small (2 vCPU, 2 GB) for production. Enable Unlimited CPU credits.
Key pair: Create new ED25519 key n8n-ec2-key, download .pem, chmod 400.
Network: Select your VPC, public subnet, auto-assign public IP. Security group: sg-n8n-web allowing TCP 22 (your IP/32), 80, 443 (0.0.0.0/0).
Storage: 30 GB gp3, encrypted, delete on termination. Add tag Environment=production, Application=n8n.
Launch. Wait for status checks 2/2.

Harden the OS and Install Docker Engine

SSH: ssh -i n8n-ec2-key.pem ec2-user@<public-ip>.
Update and install extras: sudo dnf update -y && sudo dnf install -y docker git fail2ban htop ncdu.
Enable Docker: sudo systemctl enable --now docker && sudo usermod -aG docker ec2-user. Log out/in.
Install Docker Compose v2: sudo curl -SL https://github.com/docker/compose/releases/download/v2.27.0/docker-compose-linux-x86_64 -o /usr/local/bin/docker-compose && sudo chmod +x /usr/local/bin/docker-compose.
Verify: docker compose version → Docker Compose version v2.27.0.

Configure n8n with PostgreSQL and Nginx Reverse Proxy

Create project directory: mkdir -p ~/n8n && cd ~/n8n.
Generate strong passwords: openssl rand -base64 32 for POSTGRES_PASSWORD, N8N_ENCRYPTION_KEY (must be 32 chars). Save in .env.
Create docker-compose.yml with services: postgres:16-alpine, n8n:latest, nginx:alpine. Use n8n official docs for environment variables: DB_TYPE=postgresdb, DB_POSTGRESDB_HOST=postgres, N8N_HOST=your.domain.com, N8N_PROTOCOL=https, WEBHOOK_URL=https://your.domain.com/.
Create nginx.conf with rate limiting (limit_req_zone 10r/s), proxy headers, and Let's Encrypt challenge location.
Start stack: docker compose up -d. Verify logs: docker compose logs -f n8n.

SSL, Hardening, and Compliance: Stay Off AWS Abuse Radar

Automate Let's Encrypt Certificates with Certbot

Install Certbot in a separate container or on host: sudo dnf install -y certbot python3-certbot-nginx. Run sudo certbot --nginx -d your.domain.com --non-interactive --agree-tos -m admin@your.domain.com --redirect. Certificates auto-renew via systemd timer (check systemctl list-timers). Let's Encrypt issues 90-day certs; renewal starts at 60 days. In 2024, Let's Encrypt secured 700M+ sites — using it signals legitimate traffic to AWS abuse reviewers.

Lock Down SSH and Install Fail2Ban

Edit /etc/ssh/sshd_config: PermitRootLogin no, PasswordAuthentication no, Port 2222 (non-standard), AllowUsers ec2-user. Restart: sudo systemctl reload sshd. Update security group: remove 22, add 2222 (your IP/32).
Create /etc/fail2ban/jail.local with [sshd] enabled = true, port = 2222, maxretry = 3, bantime = 3600, findtime = 600. Enable: sudo systemctl enable --now fail2ban.
Add n8n jail: monitor /home/ec2-user/n8n/logs/n8n.log for 401 Unauthorized or 403 Forbidden patterns, ban after 5 failures.

Implement Resource Limits and Monitoring

In docker-compose.yml, add deploy: resources: limits: cpus: '1.5' memory: 1.5G to n8n service. Prevents runaway workflows from triggering GuardDuty "CPU utilization anomaly" alerts.
Install CloudWatch agent: sudo dnf install -y amazon-cloudwatch-agent. Configure /opt/aws/amazon-cloudwatch-agent/bin/config.json to ship mem_used_percent, cpu_usage_idle, disk_used_percent to CloudWatch. Create alarm: CPU > 85% for 15 min → SNS.
Enable VPC Flow Logs to CloudWatch Logs (cost: $0.50/GB). Filter for traffic to ports 22, 3389, 4444 (common miner ports) from unknown IPs.

Backup, Disaster Recovery, and Cost Optimization

Automated Daily Backups to S3 with Lifecycle Policy

Create S3 bucket n8n-backups-<account-id>-<region> with versioning, AES-256 encryption, and block public access. Write a backup script (~/backup.sh) that runs docker exec postgres pg_dump -U n8n n8n | gzip > /tmp/n8n-$(date +%F).sql.gz, copies to S3 via aws s3 cp, and prunes local files older than 3 days. Schedule via crontab -e: 0 3 * * * /home/ec2-user/backup.sh >> /var/log/n8n-backup.log 2>&1. Set S3 lifecycle: transition to Glacier Instant Retrieval after 30 days, delete after 365 days. Cost: ~$0.02/GB/month.

Test Restore Quarterly

Every quarter, launch a t3.micro in a separate VPC, restore latest backup, verify n8n starts and workflows execute. Document RTO (Recovery Time Objective) — target < 2 hours. AWS Well-Architected Framework Reliability Pillar recommends quarterly DR tests for production workloads.

Right-Size with Compute Savings Plans

After 30 days of stable metrics, purchase a 1-year No-Upfront Compute Savings Plan for the average vCPU-hours used. A t3.small (2 vCPU) at $0.0208/hour on-demand drops to $0.0135/hour — 35% savings. Avoid Reserved Instances; Savings Plans apply across instance families (t3, t4g, c6i) if you later resize.

Comparison: n8n Deployment Options on AWS

Choosing the right deployment model balances operational overhead, cost, and compliance. The table below compares five common approaches using real pricing (us-east-1, April 2025) and effort estimates from n8n community surveys.

All options assume 10,000 executions/month, PostgreSQL backend, and HTTPS termination.

Deployment Model	Monthly Cost (USD)	Ops Effort (hrs/mo)	Best For
EC2 t3.small + Docker Compose (this guide)	$18.50	4	Teams wanting full control, custom nodes, VPC isolation
ECS Fargate (1 task, 0.5 vCPU, 1 GB) + RDS db.t3.micro	$42.00	2	Zero server management, auto-scaling, CI/CD pipelines
EKS Managed Node Group (t3.small) + Helm chart	$65.00	8	Kubernetes-native orgs, multi-tenant, GitOps
n8n Cloud Starter (€20/mo ≈ $21.50)	$21.50	0.5	No DevOps capacity, <2,500 exec/mo, standard nodes only
Lambda + SQS + DynamoDB (serverless)	$12.00	6	Sporadic bursts, event-driven, cold-start tolerant

Common Mistakes That Get AWS Accounts Banned

Mistake: Exposing n8n on Port 5678 Directly to Internet

Why It Hurts: Shodan indexes 12,000+ exposed n8n instances. Attackers brute-force weak credentials, then install crypto miners via Execute Command node. AWS Abuse receives automated reports from Shadowserver Foundation — your account gets flagged within hours.

Fix: Always use Nginx reverse proxy on 80/443 with rate limiting. Block port 5678 in security group. Enable n8n N8N_BASIC_AUTH_ACTIVE=true and N8N_BASIC_AUTH_USER/N8N_BASIC_AUTH_PASSWORD for double protection.

Mistake: Using Default PostgreSQL Password or No Encryption Key

Why It Hurts: n8n stores workflow credentials encrypted with N8N_ENCRYPTION_KEY. If unset, n8n generates one on first start — but if you lose the container, you lose all credentials. Weak DB passwords allow lateral movement.

Fix: Set N8N_ENCRYPTION_KEY to 32-char base64 string in .env before first launch. Use POSTGRES_PASSWORD from openssl rand -base64 32. Rotate annually via Secrets Manager.

Mistake: No Outbound Traffic Restrictions

Why It Hurts: Compromised n8n can phone home to C2 servers, download miners, or participate in DDoS. AWS GuardDuty flags "EC2 instance communicating with known malicious IP" — automatic finding severity High.

Fix: Create security group sg-n8n-egress allowing only: TCP 443 to amazonaws.com (S3, CloudWatch), TCP 5432 to RDS SG, TCP 443 to your API endpoints (use VPC endpoints for AWS services). Deny all other outbound.

Mistake: Ignoring CPU Credit Balance on Burstable Instances

Why It Hurts: t3 instances earn credits at baseline (20% for t3.micro). Sustained 100% CPU burns credits in ~2 hours, then throttles to baseline. GuardDuty interprets sudden credit exhaustion + sustained high CPU as potential mining.

Fix: Enable Unlimited credits (costs $0.05/vCPU-hour over baseline). Monitor CPUCreditBalance metric; alarm at < 50 credits. For production, use fixed-performance instances (c6i.large) or Savings Plans.

Pro Tips from Production Deployments

Use n8n Queue Mode: Separate webhook/main processes from workers. Add Redis (ElastiCache serverless) and set EXECUTIONS_MODE=queue. Handles 10x throughput, prevents webhook timeouts during heavy jobs.
Enable n8n Telemetry Opt-Out: Set N8N_DIAGNOSTICS_ENABLED=false. Reduces outbound connections, satisfies strict data residency policies.
Automate n8n Updates with Watchtower: Add containrrr/watchtower container with --schedule "0 4 * * 0" (weekly Sunday 4 AM). Labels: com.centurylinklabs.watchtower.enable=true. Keeps you patched for CVEs like CVE-2026-59208 (cross-issuer account takeover).
Store .env in AWS Systems Manager Parameter Store: Use SecureString parameters, grant EC2 instance role ssm:GetParameters. Startup script pulls secrets at boot — no plaintext files on disk.
Run Chaos Engineering Quarterly: Use AWS Fault Injection Simulator to terminate instance, corrupt DB, simulate AZ outage. Verify RTO < 2 hrs, RPO < 24 hrs. Document results for compliance audits.

FAQ

What is the minimum EC2 instance size for production n8n?

t3.small (2 vCPU, 2 GB RAM) is the minimum for production with PostgreSQL and Nginx on the same instance. t3.micro works for dev but will OOM under load. For queue mode with Redis, use t3.medium (2 vCPU, 4 GB) or separate worker instances. Monitor FreeableMemory CloudWatch metric; keep > 500 MB headroom.

How does self-hosted n8n on EC2 compare to n8n Cloud for compliance?

Self-hosted gives full data control — no third-party subprocessors, data never leaves your VPC. n8n Cloud is SOC 2 Type II, ISO 27001, GDPR-ready but processes data in EU (Frankfurt) or US (Virginia). If you need data residency in specific AWS regions (e.g., GovCloud, China), self-hosted is the only option. Both support HIPAA BAAs; self-hosted requires you to sign AWS BAA.

Can I run n8n on AWS Graviton (ARM) instances to save money?

Yes. n8n Docker images are multi-arch (linux/amd64, linux/arm64). Graviton3-based t4g.small costs $0.0168/hour vs t3.small $0.0208/hour — 19% cheaper with 20% better price/performance. Test custom nodes for ARM compatibility; most npm packages work, but native binaries (sharp, canvas) may need rebuild.

What do I do if AWS sends an abuse notice for my n8n instance?

Reply within 24 hours with: 1) Root cause analysis (e.g., "compromised via weak webhook secret"), 2) Remediation steps taken (rotated keys, patched, added WAF), 3) Prevention measures (GuardDuty, Fail2Ban, egress filtering). Attach CloudWatch logs showing normal CPU before/after. Do not ignore — second notice risks account suspension. AWS Abuse Team email: abuse@amazonaws.com.

Will n8n's upcoming versions require changes to this deployment?

n8n v1.0 (released 2024) stabilized the API. Future versions follow semantic versioning; minor updates are backward compatible. The Docker Compose stack handles rolling updates via Watchtower. Breaking changes (major version) are announced 6+ months ahead in n8n GitHub discussions. Subscribe to n8n-io/n8n releases RSS for notifications.

Conclusion

Hosting n8n on AWS EC2 gives you enterprise-grade automation at a fraction of SaaS costs — but only if you treat security as a first-class requirement, not an afterthought. The 16,000+ developers who adopted n8n by 2021 learned that exposed instances get compromised in hours, not days. By following this guide — hardening SSH, restricting egress, automating Let's Encrypt, monitoring CPU credits, and testing backups quarterly — you build a deployment that survives AWS abuse scans, scales to 50,000 executions/hour, and costs under $20/month. Your workflows stay yours, your data stays private, and your AWS account stays active.

Lock down network: Security groups allow only 80/443 inbound, restricted egress outbound.
Automate everything: Certbot renewals, Watchtower updates, S3 backups, CloudWatch alarms.
Monitor for abuse signals: GuardDuty, CPU credits, VPC Flow Logs, billing spikes.
Test disaster recovery: Quarterly restore drills prove your RTO/RPO targets.

Friday, August 7, 2026