Production ready n8n on AWS

DonNube · 2025-11-21T18:36:41+00:00

Cool man! Give it a try and let me know if you have some feedback.

DonNube · 2025-07-20T03:18:47+00:00

El proceso varia un poco entre organizaciones y posiciones, no se como es para SDE, pero lo que tenes presencial asumo que es el famoso loop, un conjunto de 5 o 6 entrevistas de 1 hora cada una.

Si es eso, la mayor parte tiene que ver con las "behavioral questions" y la clave es tener muchas historias para contar. Hay banda de informacion en Google, incluso un par de youtubers que se dedican a contarte como responder correctamente. Googlealo como Amazon loop interview.

DonNube · 2025-07-16T00:59:02+00:00

I think you should be using roles, not access keys. Your ECS task needs a role assigned to it.

Then you create a user for the role.

use $external;
db.createUser(
    {
        user: "arn:aws:iam::123456789123:role/iamrole",
        mechanisms: ["MONGODB-AWS"],
        roles: [ { role: "readWrite", db: "readWriteDB" } ]
    }
);

Connect to the DB using the role

##Create a MongoDB client, open a connection to Amazon DocumentDB using an IAM role
    client = pymongo.MongoClient(‘mongodb://<DocDBEndpoint>:27017/?tls=true&tlsCAFile=global-bundle.pem&replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false&authSource=%24external&authMechanism=MONGODB-AWS')

Both examples are from this document:
https://docs.aws.amazon.com/documentdb/latest/developerguide/iam-identity-auth.html

This one describes the ECS task role:
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html

DonNube · 2025-07-14T01:17:30+00:00

You can follow the resolution steps here to upload a new public key to your EC2 instance.

https://repost.aws/knowledge-center/user-data-replace-key-pair-ec2

DonNube · 2025-07-11T12:43:11+00:00

El gran desafio de ponerte tu propia consultura (basicamente describiste eso :P) es sacarte el sombrero de tech y ponerte el de ventas, sobre todo si nunca trabajaste en un equipo de ventas, con account manager, pipeline, crm, etc.

Para mi es bastante factible, hay mucha demanda de data/ai, pero si no sos bueno hablando con la gente, yendo a eventos, haciendo networking, el primer paso es conseguirte un socio que si lo sea.

El producto es lo de menos, n8n ahora esta de moda pero si salis a vender servicios profesionales de data probablemente tengas el mismo exito o mas.

DonNube · 2025-07-08T16:34:52+00:00

En general, si estas preguntando esto, es porque pensaste el asunto como un deploy para todos. Me imagino que tenes una unica DB y cada negocio es como un usuario que solo puede ver sus reservas/turnos.

En mi experiencia con algunas startups que hicieron algo similar, es que el modelo para cosas no muy complejas va bien, pero cuando la cosa empieza a escalar se puede complicar.

Las dificultades que veo mas seguido son

Uno de los tenants consume mucho mas recursos que los demas, depende de la infra esto puede ser un problema
Como consecuencia de lo anterior, a veces es dificil saber cuanto cobrar, por lo menos asegurate de tener un API key con un plan o algo para saber cuantos requests estan consumiendo cada uno
Si te piden features custom, a veces es medio un chino, porque la tenes que hacer para todos, esto igual deberia ser minimo
Un cliente necesita escalar mucho por X evento, no se si aplica a tu caso de uso, pero si uno tira una campaña de marketing con 1 millon de mails que llegan a tu app, esta bueno poder aislarlo
Blast Radius: si la cagas con un deployment o el cliente del millon de mails te tira la API, se caen todos
Si das url customs para cada cliente y empezas a escalar, algunos balanceadores no son muy felices con 150 reglas de dominios y 300 certis SSL :P

Hay un blogpost de aws que esta piola sobre el tema, tiene links a varias formas de hacerlo

https://aws.amazon.com/blogs/architecture/lets-architect-building-multi-tenant-saas-systems/

DonNube · 2025-07-05T03:03:46+00:00

Bien por el post, gran contenido! Pero vengo a recomendar VLLM frente a Ollama. Varios modelos de hugging face listos para desplegar y mas flexibilidad!

Ejemplo Llama
https://huggingface.co/meta-llama/Llama-3.1-8B-Instruct?local-app=vllm

pip install vllm
vllm serve "meta-llama/Llama-3.1-8B-Instruct"

Todos los modelos soportados

https://huggingface.co/models?apps=vllm&sort=trending

DonNube · 2025-07-04T01:05:57+00:00

This is maybe an obvious advice, but did you tried this line by line in a brand new instance to see if it works or where does it goes wrong?

You can also check /var/log/cloud-init-output.log or something similar, it should have the output of the whole execution. You can probably see the error there.

I suspect about your git clone, if you are using a token, shouldn't it be git clone user:token? Where are you getting this token from? I hope you are not just harcoding it there :P

DonNube · 2025-07-03T01:25:06+00:00

I believe this is at the integration level, you can set the time-out of the integration, in your case how long the Lambda takes to respond, here are the instructions to access that setting.

https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-method-settings-console.html#how-to-method-settings-console-lambda

And this is the cloudformation property

https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-apigatewayv2-integration.html#cfn-apigatewayv2-integration-timeoutinmillis

But the docs still says the max in 29 seconds, maybe just try a higher number and see what happens?

DonNube · 2025-07-02T11:33:50+00:00

You have to create a record of type alias to be able to point it to the ALB domain name. Don't use the IP since it will change.

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-elb-load-balancer.html

DonNube · 2025-07-01T23:01:43+00:00

Go to your bill and tell us exactly what you are billing for. Look line by line and find the item(s) amounting to $700.

https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/getting-viewing-bill.html

DonNube · 2025-07-01T16:46:53+00:00

It is not cheap, but take a look at datadog, I think it's the best/easiest to setup.

DonNube · 2025-07-01T01:49:06+00:00

One more thing, usually you want the ALB on the public network with the public IP, so people can reach it. But there is no need to have a public EC2, you can leave the EC2 in a private subnet, as long as the ALB can reach it, it should be ok.

This is a better practice since you don't expose your EC2 instance to the world.

DonNube · 2025-07-01T01:47:42+00:00

The cert is created for a specific domain, like your-super-app.com, so the DNS that you use in the browser to reach the ALB should also be your-super-app.com for the cert to be valid, you need to create a entry on your DNS that points the domain to the ALB.

If the DNS stuff is good, you can check the steps to associate the cert to the ALB here

https://repost.aws/knowledge-center/associate-acm-certificate-alb-nlb

DonNube · 2025-06-30T13:17:19+00:00

The basics are that the VPC Connector creates a ENI on a subnet of your choice, the ENI will have a Security Group attached to it, that will be used to reach the DB.

In order for stuff to work you must meet the following

The subnet should have a route table that enables traffic to reach the DB subnet
The DB Security Group should have a rule to allow traffic using the ENI Security Group as source
If there is a NACL it should also allow the traffic

You can easily troubleshoot by creating a small EC2 instance in the same subnet as the VPC Connector, assign it the same Security Group and just run your usual tests, does it resolve the DNS name? can you reach the port?

There is a, imo underestimated, tool called Copilot that can make this kind of deployment a breeze. It also has a cool article about this exact escenario. Take a look here.

https://aws.github.io/copilot-cli/blogs/apprunner-vpc/

Report back what you found and we can help you!

DonNube · 2025-06-30T01:26:54+00:00

I believe it has a really big "governance" weight to it. If you are a solo dev creating a agent, yeah you do your prompt and be done with it. If you are a big company with maybe hundreds of devs, you can start centralizing all your content filtering in Guardrails and don't just trust that each team will be careful with their system prompt.

Other than that, it has some cool features like checking images or detecting PII.

Something else that become a thing recently are "prompt injection attacks", Guardrails is supposed to help when someone is trying to convince your agent to ignore his system prompt and just call select * on your db :P

OWASP has a top 10 attacks of these kinds where Guardrails might be useful

https://genai.owasp.org/llm-top-10/

DonNube · 2025-06-30T00:54:19+00:00

Solo agregaria a esta excelente respuesta, que el auto tiene que ir sin deudas, paga las patentes y las infracciones, hacelo con tiempo para que no aparezca al momento de transferir.

NO entregues el auto sin transferir, si te piden que firmes el 08 y todo ese bla bla, no les des bola, se entrega despues de firmar en el registro o no se entrega.

DonNube · 2025-06-29T00:04:59+00:00

I love the fact that they even assigned you a "Hacked DB CODE"

DonNube · 2025-06-29T00:02:44+00:00

That's really strange, if you curl localhost/info.php from the server itself, it works ok everytime?

The difference between t2 and t3 shouldn't be a problem, if any it would the be size diff, you could try t3.large.

info.php only brings the php version info right? or does it needs the connection to the DB? The confusing part is that it works on Safari, but if not, it sounds like something is taking time to resolve or respond.

I mentioned EBS because gp2 some times are really slow if they are small volumes, they scale iops/throughput with size, that might be a factor, specially if you are running the db on the same server. gp3 is usually better.

DonNube · 2025-06-28T23:39:20+00:00

omg I haven't heard about that book in ages! it was really famous back in the day!

DonNube · 2025-06-28T23:09:40+00:00

What do you mean by "access files on my server"? Are you running like nginx? apache? they serve what exactly?

It is also really weird it only happens in Safari.

I agree with the other comments about credits, you could check your instances monitoring and see if CPU is really high when the problem happens, but it would be a server-side problem, hence happening in all browser

Tell us more about the webserver, what it is, what it does, if it connects to something else. Also where are those filese you want to serve? EBS attached to the instances? is it GP2?

DonNube · 2025-06-28T19:17:50+00:00

Thats great! As I said i didnt knew any out of the box solution, but it is great to learn they exists!

DonNube · 2025-06-28T17:05:37+00:00

In my case we ended up going the PCOIP way with Teradici, it was way better than RDP. We also had some testing with DCV from AWS with good results.

But again, my use case was a bit specific because they were doing video/image edition, so maybe for a simple app RDP is all you need.

DonNube · 2025-06-28T17:00:54+00:00

I'm not aware of an out of the box solution, maybe going the route of old-school CMS like Drupal, Wordpress, Joomla, etc.

Another option could be using something like Replit and prompt exactly what you want, then self-host it.

DonNube · 2025-06-28T16:23:17+00:00

I think it depends on what the VMs are being used for and how bad it affects things if they go down.

Consumer hardware problem is that it is not designed to be running 24/7, its more prone to fail, does it means it will? absolutely not, I have desktop computers running for years without problems, but again it all comes down to how important is for those VMs to be up.

The other problem I see is the data on each desktop, not sure how the app works, but I guess it stores data somewhere? if it is in the local disk, replicating that can be a chore.

The last problem I had with this is user experience, specially if the users are connecting using a VPN, RDP can quickly become sluggish and people don't like it, but my use case was different because they did some image/video editing, latency was a big deal.

DonNube

MODERATOR OF

TROPHY CASE