Most ops automation starts as a bash script, grows into a cron job, and eventually becomes a mystery that nobody wants to touch. n8n is a self-hosted workflow automation tool that gives you visual pipelines, built-in retry logic, execution history, and over 400 integrations — without sending your data to a third-party SaaS.
Why self-host n8n on AWS?
n8n Cloud works fine for many use cases, but cloud ops automation often touches sensitive infrastructure — AWS credentials, internal API keys, database connection strings. Running n8n on your own EC2 instance or ECS task means credentials never leave your VPC, and your automation history stays under your control.
Ops workflows that work well in n8n
- Daily cost report: pull Cost Explorer data → format → send to Slack
- Incident triage: CloudWatch alarm → PagerDuty → create Jira ticket → post runbook link in Slack
- Database backup verification: trigger Lambda → check S3 for last backup → alert if > 24h old
- Onboarding automation: new user in HubSpot → create AWS IAM user → send credentials → log to Notion
- Weekly infrastructure drift check: run Terraform plan → parse output → Slack alert if changes detected
Setting up n8n on AWS in 30 minutes
The fastest setup: EC2 t3.small, Docker Compose with n8n + PostgreSQL, nginx reverse proxy, Let's Encrypt SSL. Total infrastructure cost: ~$15/month. Use an EBS volume for persistent data and take a daily snapshot. This setup handles hundreds of workflow executions per day without strain.
Production hardening checklist
- Enable n8n's built-in authentication (BASIC_AUTH or SAML with your IdP)
- Store sensitive credentials in n8n Credentials store — never hardcode in workflow JSON
- Enable execution data pruning (N8N_EXECUTIONS_DATA_PRUNE=true) to prevent storage bloat
- Set up CloudWatch alerts on EC2 CPU and disk usage
- Export workflow JSON to a Git repository on a weekly schedule (n8n has a CLI export command)
Replacing cron jobs with n8n
Every cron job you replace with an n8n workflow gains: visual execution history, email/Slack alerts on failure, retry-on-error logic, and the ability to trigger manually for testing. The visibility alone is worth the migration — you can finally answer 'did that backup job run last night?' without SSH-ing into a server.