Getting started¶
This page takes you from the AWS Marketplace listing to a signed-in Flowise builder with your model provider connected.
You need: an AWS account with permission to subscribe to AWS Marketplace products, launch EC2 instances and use AWS Systems Manager, and, on your workstation, the AWS CLI with the Session Manager plugin.
1. Subscribe¶
Open the Flowise listing in AWS Marketplace, choose View purchase options, review the terms and subscribe. When the subscription is confirmed, choose Launch your software.
2. Launch the instance¶
On the EC2 launch page:
- Keep the instance type at t3.medium, or choose one with at least 4 GiB of memory.
- Under Configure storage, use an encrypted gp3 root volume of at least 32 GiB.
- Under Network settings, allow no inbound traffic. Flowise listens only on the instance itself, and Session Manager does not need an open port. If you also want SSH, allow port 22 from your administrative address range only. Keep outbound HTTPS open so Flowise can reach your model providers.
- Under Advanced details, choose an IAM instance profile that includes
the AWS managed policy
AmazonSSMManagedInstanceCore, and require IMDSv2. - Choose Launch instance.
Do not open port 8443 or 3000 to the internet
Both listen on loopback only. You reach the builder through Session Manager port forwarding, so there is nothing to open.
3. Connect and run the walkthrough¶
In the EC2 console, select the instance, choose Connect, then Session Manager, then Connect. Or, from your workstation:
Switch to the ubuntu user and run the walkthrough:
It waits for first boot to finish, checks that Flowise and nginx are running
and bound to loopback, that the UI answers over HTTPS, and that ubuntu
cannot read the private key or the password. It then signs in as the owner and
creates and deletes a test tool. It ends with SUSHI_CUSTOMER_DEMO_PASSED.
The first start takes a few minutes
Flowise loads all of its components before it answers, which can take around five minutes on first boot. The owner account is created as soon as Flowise answers. The walkthrough waits for both.
To check first boot yourself:
cloud-init status --wait
systemctl is-active sushi-flowise-firstboot flowise nginx sushi-flowise-admin
All four units report active when setup is complete.
4. Get the owner password¶
The password is stored only on the instance, readable by root:
The sign-in email is admin@localhost.local. Keep the password out of
tickets, chat and screen recordings.
5. Open the builder¶
On your workstation, start a port-forwarding session. Replace
<instance-id> and use the instance's region:
aws ssm start-session \
--target <instance-id> \
--document-name AWS-StartPortForwardingSession \
--parameters '{"portNumber":["8443"],"localPortNumber":["8443"]}'
Leave it running and open https://localhost:8443/ in your browser. Sign in
as admin@localhost.local with the password from step 4.
Certificate warning
The certificate is self-signed and created for this instance, for
localhost, 127.0.0.1 and ::1, so your browser does not trust it by
default. To check it, compare the fingerprint your browser shows with the
one on the instance:
6. Connect a model and build a flow¶
- In Flowise, open Credentials and add the API key of your model provider. Flowise stores it encrypted in its database on the instance.
- Create a chatflow or agent flow, add a chat model node and select your credential.
- Save the flow and test it in the chat panel.
For Amazon Bedrock, attach an IAM role to the instance that allows
bedrock:InvokeModel on the models you use, then use the ChatBedrock chat
model node. Scope the role to those models.
Next: Configuration.
Last updated October 13, 2026 · Suggest an improvement