Skip to content

Add an AWS EC2 Server

Appliku can launch EC2 instances in your AWS account. The instance is created under your AWS account, and you pay AWS directly for the infrastructure.

Step 1: Create AWS Access Keys

You need an AWS Access Key and Secret Key with permissions to manage EC2 instances.

  1. Sign in to the AWS Management Console
  2. Go to IAM (Identity and Access Management)
  3. Navigate to Users and select your user (or create a dedicated user for Appliku)
  4. Go to the Security credentials tab
  5. Click Create access key
  6. Copy both the Access Key ID and Secret Access Key -- the secret key is only shown once

The IAM user needs at minimum the AmazonEC2FullAccess policy attached, or a custom policy that allows creating, describing, and terminating EC2 instances.

Step 2: Add AWS Credentials to Appliku

  1. Open the Appliku dashboard
  2. Go to Team Settings (click on your team name in the sidebar, then Settings)
  3. Find the AWS section
  4. Enter your Access Key ID and Secret Access Key
  5. Save the settings

Step 3: Launch an EC2 Instance

  1. Navigate to the Servers tab in your team dashboard
  2. Click Add Server
  3. Select AWS as the provider
  4. Choose an AWS region
  5. Select an instance type (e.g., t3.small, t3.medium)

Instance sizing

A t3.small (2 GB RAM) is a good starting point for most applications. For projects with heavy build processes or multiple applications on one server, consider t3.medium (4 GB RAM) or larger.

  1. Set the disk size in GB (default is usually sufficient, increase if you expect large Docker images or many deployments)
  2. Click Create EC2 Instance

Step 4: Wait for Setup

Appliku will launch the instance and automatically begin the server setup process. This takes a few minutes. The instance uses the latest Canonical Ubuntu 26.04 AMI when available, otherwise Appliku falls back to the Ubuntu 24.04 AMI.

You can monitor the progress on the server detail page. Once setup is complete, the server status will change to Active and you can start deploying applications to it.

Firewall

Each EC2 server has a firewall mode. See Firewall for the Firewall tab.

  • Managed (new servers): the server has its own security group, appliku-<environment>-server-<id>, with these rules:
  • HTTP (80) and HTTPS (443) from all addresses;
  • SSH from the Appliku servers and from the IP addresses that you add on the Firewall tab;
  • the ports that Appliku publishes for your databases (external connections on) and apps (expose_web_port, ports in appliku.yml), from all addresses until you add a rule for that port;
  • your rules;
  • in a cluster, the Docker Swarm ports from the other nodes only.

All other ports are closed. - Legacy (EC2 servers created before the managed firewall): the shared group appliku_single_server_v2 opens all TCP and UDP ports to the internet. Nothing changes until you switch the server on the Firewall tab. You can switch back at any time.

A port that Appliku publishes for your database or app is open to all addresses. Add a rule for that port on the Firewall tab, and only your sources can connect. On a cluster, rules apply to all nodes. An expired rule stops access from its source some minutes after the expiry, but the port stays restricted until you delete the rule. Turn off external connections or expose_web_port, and the public permission is removed some seconds later (a redeploy is not necessary for the firewall); your own rules for that port stay. A container that you start by hand needs a rule.

Appliku owns all rules in its group. For other rules, attach your own security group to the instance. Appliku never changes groups that it does not own.

IAM permissions

AmazonEC2FullAccess includes all permissions. With a custom policy, the managed firewall needs these actions:

ec2:DescribeVpcs, ec2:DescribeInstances, ec2:DescribeNetworkInterfaces, ec2:DescribeSecurityGroups, ec2:CreateSecurityGroup, ec2:CreateTags, ec2:AuthorizeSecurityGroupIngress, ec2:RevokeSecurityGroupIngress, ec2:ModifyNetworkInterfaceAttribute, ec2:DeleteSecurityGroup.

Without them, the Firewall tab shows the status "failed" with the AWS error.

Managing the Instance

The EC2 instance is fully owned by your AWS account. You can see it in the AWS Console alongside your other resources. However, you should manage it through Appliku to keep configurations in sync.

If you terminate the instance directly in AWS, Appliku will detect this automatically via the API and mark the server as deleted. See Server Settings for more details.