Secure Self-Hosted n8n on AWS: The 2026 Hardening Checklist

说明与用途

该脚本通过关闭 5678 端口、升级到已修补版本、将密钥和数据库密码存储在 Secrets Manager、使用最小权限 IAM 角色以及通过 Caddy TLS 保护 UI，来加强在 AWS 上自托管的 n8n 实例的安全性。

问题

A self‑hosted n8n instance exposed port 5678 to the internet, ran an unpatched version, and stored encryption keys and database passwords in plaintext, making all connected service credentials vulnerable to compromise.

结果

After applying the checklist, the n8n instance is no longer reachable from the public internet, runs a patched version, stores credentials securely, and operates with minimal IAM permissions, significantly reducing attack surface.

工作流

• 1. Update Docker Compose to use image n8nio/n8n:1.123.64 and expose 5678 instead of publishing it.
• 2. Create an encryption‑key secret in AWS Secrets Manager and a DB‑password secret.
• 3. Assign an IAM role to the EC2 instance that allows GetSecretValue and DescribeSecret only for those two secrets.
• 4. At startup, export N8N_ENCRYPTION_KEY and database credentials from Secrets Manager into the environment and run docker compose up.
• 5. Configure Caddy to provide TLS and IP‑based access control for the n8n editor UI.

证据

Port 5678 to the internet
OPEN (HTTP 200 from public IP)
closed (connection refused)

来源

n8n version
1.100.0 (CVE-affected)
1.123.64 patched

来源

Encryption key
none (derived default)
AWS Secrets Manager

来源

CVE-2026-65589, in plain English
... writes the plaintext API key straight into the workflow execution records

来源