Secure Self-Hosted n8n on AWS: The 2026 Hardening Checklist

Описание и применение

Скрипт защищает самодеплоимую n8n‑инстанцию на AWS, закрывая порт 5678, обновляя версию, хранит ключи и пароль БД в Secrets Manager, применяет роль IAM с минимальными правами и защищает UI TLS‑прокси Caddy.

Задача

A self‑hosted n8n instance exposed port 5678 to the internet, ran an unpatched version, and stored encryption keys and database passwords in plaintext, making all connected service credentials vulnerable to compromise.

Результат

After applying the checklist, the n8n instance is no longer reachable from the public internet, runs a patched version, stores credentials securely, and operates with minimal IAM permissions, significantly reducing attack surface.

Рабочий процесс

• 1. Update Docker Compose to use image n8nio/n8n:1.123.64 and expose 5678 instead of publishing it.
• 2. Create an encryption‑key secret in AWS Secrets Manager and a DB‑password secret.
• 3. Assign an IAM role to the EC2 instance that allows GetSecretValue and DescribeSecret only for those two secrets.
• 4. At startup, export N8N_ENCRYPTION_KEY and database credentials from Secrets Manager into the environment and run docker compose up.
• 5. Configure Caddy to provide TLS and IP‑based access control for the n8n editor UI.

Доказательства

Port 5678 to the internet
OPEN (HTTP 200 from public IP)
closed (connection refused)

Источник

n8n version
1.100.0 (CVE-affected)
1.123.64 patched

Источник

Encryption key
none (derived default)
AWS Secrets Manager

Источник

CVE-2026-65589, in plain English
... writes the plaintext API key straight into the workflow execution records

Источник