Secure Self-Hosted n8n on AWS: The 2026 Hardening Checklist

Description and use

The script hardens a self‑hosted n8n instance on AWS by closing port 5678, upgrading to a patched version, storing secrets in Secrets Manager, applying a least‑privilege IAM role, and securing the UI with TLS via Caddy.

Problem

A self‑hosted n8n instance exposed port 5678 to the internet, ran an unpatched version, and stored encryption keys and database passwords in plaintext, making all connected service credentials vulnerable to compromise.

Outcome

After applying the checklist, the n8n instance is no longer reachable from the public internet, runs a patched version, stores credentials securely, and operates with minimal IAM permissions, significantly reducing attack surface.

Workflow

• 1. Update Docker Compose to use image n8nio/n8n:1.123.64 and expose 5678 instead of publishing it.
• 2. Create an encryption‑key secret in AWS Secrets Manager and a DB‑password secret.
• 3. Assign an IAM role to the EC2 instance that allows GetSecretValue and DescribeSecret only for those two secrets.
• 4. At startup, export N8N_ENCRYPTION_KEY and database credentials from Secrets Manager into the environment and run docker compose up.
• 5. Configure Caddy to provide TLS and IP‑based access control for the n8n editor UI.

Evidence

Port 5678 to the internet
OPEN (HTTP 200 from public IP)
closed (connection refused)

Source

n8n version
1.100.0 (CVE-affected)
1.123.64 patched

Source

Encryption key
none (derived default)
AWS Secrets Manager

Source

CVE-2026-65589, in plain English
... writes the plaintext API key straight into the workflow execution records

Source