Wazuh on AWS EC2: Production Deployment Guide

Running Wazuh on AWS EC2 is a common path for teams who already live in AWS. This guide covers the choices we make when deploying Wazuh on EC2 for clients, instance type, storage, security group, swap and OS prep, before running the official installer.

1. Pick the right EC2 instance

• Lab / PoC: t3.large (2 vCPU, 8 GB), single-node, no agent fleet
• Small production all-in-one: m6i.xlarge (4 vCPU, 16 GB)
• Distributed indexer node: m6i.2xlarge or larger
• Manager node: c6i.xlarge handles a few hundred agents comfortably

2. Storage

The indexer is disk-IO heavy. Use gp3 EBS volumes with provisioned IOPS for production. A reasonable starting point:

• Root volume: 30 GB gp3
• Data volume: 200 GB gp3, 6000 IOPS, mounted at /var/lib/wazuh-indexer
• Encrypt every volume with KMS

3. Security group

Allow only what is required. Restrict admin ports to your bastion or office IP, never `0.0.0.0/0`:

• 22/tcp: SSH, restricted
• 443/tcp: dashboard, restricted to operators
• 1514/tcp: agent log shipping (open from agent subnets only)
• 1515/tcp: agent enrollment (open from agent subnets only)
• 55000/tcp: API, restricted

4. OS prep

SSH into the instance and run:

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl

# Indexer needs higher max_map_count
sudo sysctl -w vm.max_map_count=262144
echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf

# Optional: add a 4 GB swapfile on smaller instances
sudo fallocate -l 4G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile && sudo swapon /swapfile
echo "/swapfile none swap sw 0 0" | sudo tee -a /etc/fstab

5. Install Wazuh

curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh
sudo bash wazuh-install.sh -a

For a distributed deployment across multiple EC2 instances, use the multi-step install with a shared certificate bundle, see our distributed deployment guide.

6. First login

Retrieve the password and visit `https://<public-or-private-ip>` over the bastion. Confirm the indexer is green and the manager has zero agents reporting.

Post-install on AWS

• Move the dashboard behind an ALB with an ACM certificate
• Forward Wazuh alerts to CloudWatch or S3 for long-term archival
• Use AWS Backup or EBS snapshots on the indexer data volume
• Enable IMDSv2 and tag the instance for cost allocation
• Rotate the default admin password immediately

We design and run Wazuh on AWS for clients in production, if you need help wiring it into your AWS account, contact our team.