> Source: https://meetrix.io/blogs/netbox-aws-marketplace/ > Markdown copy of that page. Cite the URL above, not this file. Development # NetBox on AWS: Self-Hosted IPAM and DCIM in Your Account [By Shalomi Umeshika](https://meetrix.io/blogs/authors/shalomi-umeshika/) • October 28, 2026 • 14 min read ## Your Network Map Shouldn't Live in a Spreadsheet Most network teams already have a source of truth. It's just scattered across an IP spreadsheet, a rack diagram from two years ago, and whatever one senior engineer happens to remember. It works, until someone assigns an address that's already in use, or a technician walks into the data centre looking for a switch that moved six months ago. **NetBox on AWS** puts all of that in one database with an API in front of it: every site, rack, device, cable, prefix, and IP address, in your own AWS account. Meetrix's AMI sets it up in one CloudFormation stack: NetBox on Ubuntu 26.04, with PostgreSQL, Valkey, Nginx, a Let's Encrypt certificate, and a backup script that writes to your S3 bucket. Below are the install steps, how to record your first site and hand out an API token, and an honest look at when [NetBox Cloud](https://netboxlabs.com/products/netbox-cloud/) is the better call. You can [launch the Meetrix NetBox AMI on AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-m47brkiticifc). The Quick Verdict Self-host fits More than 100 devices No device, IP address, or API request caps. The thousandth switch costs the same as the first. Self-host fits Your network map is sensitive Every address, circuit, and device sits in a PostgreSQL database in your AWS account, in the region you pick. Use NetBox Cloud A small network, no server to run The free plan covers 100 devices and 500 IP addresses, and NetBox Labs runs it for you. Try Docker first Just evaluating Run netbox-docker on a laptop for an afternoon. Move to the AMI when real inventory goes in. ## What Is NetBox? [NetBox](https://netboxlabs.com/docs/netbox/) is an open-source tool for documenting and modeling network infrastructure, released under the Apache 2.0 licence. It started at DigitalOcean, is now maintained by NetBox Labs, and has become the default answer when network engineers ask where their inventory should live. The source and release notes are on [GitHub](https://github.com/netbox-community/netbox). The important phrase is "source of truth." NetBox records what your network is supposed to look like. It doesn't scan or monitor anything. Your automation reads from it, so a playbook configures a switch with the VLANs NetBox says it should have, instead of whatever was on someone's clipboard. ### What it does IPAM - Prefixes, IP addresses, IP ranges, and aggregates, with utilisation shown per prefix - VRFs, route targets, VLANs, and VLAN groups - Find the next free address in a subnet instead of guessing DCIM - Sites, locations, racks with elevation views, and every device in them - Interfaces, cables, power feeds, and now cooling - Device types and module types, so a switch model is defined once and reused Circuits and more - Providers, circuits, and terminations - Virtual machines and clusters, VPN tunnels, tenants, and contacts Automation - A full REST API and a GraphQL API - Webhooks and event rules, custom scripts, custom fields, tags, and a plugin system - Config contexts that hand per-device data to your automation ## What's New in NetBox 4.7 NetBox 4.7.0 landed on September 2, 2026. The 4.7 line has since moved through several patch releases, with 4.7.4 arriving on October 27, 2026. The Meetrix AMI ships a 4.7.x release; check the listing for the exact patch version, because the project ships patches roughly every one to two weeks. ### The features that matter **Background processing for bulk API writes.** Add `?background=true` to a bulk create or update, and NetBox queues it as a job and immediately returns HTTP 202 Accepted with the job's ID and URL. If you've ever had a large import time out halfway through, this is the fix. Validation is deferred to the worker, so you poll the job to confirm the outcome. **Per-object errors for bulk operations.** When a bulk request fails validation, NetBox now returns a structured response that identifies each offending object by its index in the submitted list, with field-level errors. Previously you got the first failure and little else. Now you can correct and resubmit only the objects that actually failed. **Cooling infrastructure.** Cooling plants, feeds, and device coolant connections are modeled the same way power already was. Mostly a data centre feature, but it closes a gap people used to fill with custom fields. **Module bay types and relocating modules.** A new ModuleBayType model says which modules a bay can accept, and installed modules can now be moved to another bay, including on a different device, rather than deleted and recreated. **Channelized subinterfaces.** Breakout ports can be modeled with a cable path per channel. **Snapshot-aware event rules.** Rules can compare the before and after of a change, so a webhook fires only when, say, a device's status changes to active. There's also a new regex operator. **Pre-rendered config context data.** Config context is now rendered and cached per device and VM, with automatic invalidation and a non-blocking background refresh. ### The breaking changes you need to know - **PostgreSQL 15 or later is required.** PostgreSQL 14 is no longer supported, and the upgrade script will abort if you're on an earlier release. - **Redis 6.0 or later is required.** Redis 5.x support was dropped. - **Selection custom fields now return objects.** Values come back as `{"value": "datacenter", "label": "Data Center"}` in both the REST and GraphQL APIs, instead of a plain string. Writes still accept the raw value, but scripts that read these fields need checking. - **The `protocol` and `ports` fields on services have been replaced by `port_mappings`.** Legacy fields are retained as deprecated in the REST and GraphQL APIs, but at the ORM level they're read-only. Passing `protocol` or `ports` to the model raises a `TypeError`. - **Config context is always included in REST API representations.** The `?exclude=config_context` query parameter is now silently ignored, and the `DeviceWithConfigContextSerializer` classes have been removed. - **Executing a custom script via the REST API now requires a token with write ability enabled.** Scripts that worked with a read-only token will get a 403. - **API token plaintext can no longer be specified by the client** when creating a token via the REST API. The `token` field is read-only. **One security note worth knowing.** 4.7.0 and 4.7.1 recorded the plaintext of API tokens created via background bulk requests in the job results, readable by any user permitted to view jobs. This was fixed in 4.7.2 (September 29, 2026). If you're running 4.7.0 or 4.7.1, upgrade. ## Who Self-Hosted NetBox Suits The clearest fit is a team that has outgrown the spreadsheet and doesn't want its network map on someone else's servers. That covers managed service providers, internal IT teams running a few sites, and anyone automating their network who needs an inventory their tools can trust. A good fit if you are - A network or infrastructure team past about 100 devices, where Cloud's free plan stops - Under rules about where infrastructure data can live. A full map of your network, with every internal address, is exactly what an attacker would want, so keeping it in your own account and region is a reasonable call - Automating with Ansible, Terraform, or Python and wanting an API you control - An MSP keeping separate tenants for each customer Look elsewhere if you need - Network discovery or monitoring. NetBox documents; it doesn't scan - Someone else to run upgrades and backups for you - Vendor SLAs and the NetBox Labs commercial features, which come with their paid plans ## Why Run NetBox on AWS You could install NetBox on any Linux box. It's a Django app with PostgreSQL, a cache, a background worker, and a web server, and getting all of those talking, secured, and backed up is the afternoon most people underestimate. The AMI exists for that part. One stack, everything wired up CloudFormation creates the VPC, a public subnet, a security group, an Elastic IP, and an IAM role, plus the server with the NetBox containers in Docker Compose: the NetBox app and API, a background worker for jobs and webhooks, PostgreSQL, and two Valkey instances, one for the task queue and one for the cache. SSL without the fiddling On a Route 53 domain, the Let's Encrypt certificate is issued through DNS validation while the stack builds. Anywhere else, one script on the server does it. Backups to your own S3 A backup script dumps the database and uploads it to the S3 bucket you name. Run it by hand or put it on a cron schedule. Secrets that are yours The AMI ships an empty, pre-migrated database, and each instance generates its own database, cache, and application secrets on first boot. The admin password is the one you set in the stack. Billing goes through your AWS account, like the rest of our [self-hosted software on AWS](https://meetrix.io/blogs/self-hosted-software-aws/). The software fee is hourly and depends on the instance type, and new subscriptions get a 5-day free trial. Check the [listing](https://aws.amazon.com/marketplace/pp/prodview-m47brkiticifc) for current pricing. ## Install NetBox on AWS in Six Steps 1. Create an S3 bucketThe stack asks for a backup bucket, and it has to exist already, in the region you deploy to. It's the one thing people forget before they hit Launch. 2. Subscribe on AWS MarketplaceSubscribe to [NetBox on AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-m47brkiticifc), then choose the CloudFormation fulfilment option and Launch CloudFormation. 3. Fill in the stack parametersUse the table below. Leave the VPC and subnet ranges at their defaults. 4. Create the stackTick the box acknowledging IAM resources, then wait 5-10 minutes for `CREATE_COMPLETE`. If it fails on vCPUs, follow our guide to [increase your AWS vCPU quota](https://meetrix.io/blogs/increase-aws-vcpu-quota/). 5. Point your domainCopy `PublicIp` from the Outputs tab and create a DNS A record for your `DomainName` pointing at it. 6. Sign inOpen `DashboardUrl`, or `DashboardUrlIp` over plain HTTP until DNS and SSL are ready. The username is `admin` and the password is your `AdminPassword`. ### Stack parameters | Parameter | What to enter | Default | | --- | --- | --- | | `DomainName` | The domain for NetBox, e.g. `netbox.yourcompany.com`. SSL is automatic when it's hosted on Route 53. | None | | `AdminEmail` | Your email, used for the SSL certificate | None | | `AdminPassword` | The password for the NetBox `admin` superuser. Make it a strong one. | None | | `InstanceType` | Server size. `t3a.medium` is recommended. | Your choice | | `KeyName` | An existing EC2 key pair, for SSH access | None | | `S3Bucket` | The existing bucket for database backups | None | | `SSHLocation` | Which IPs may SSH in. Use your own IP with `/32`. | None | | `DeploymentName` | A label, useful if you run more than one stack | None | | `VpcCidrBlock` / `SubnetCidrBlock` | Network ranges. Keep the defaults, unless they clash with networks you plan to peer with. | `10.0.0.0/16` / `10.0.0.0/24` | That last row matters more for NetBox than for most apps. If you'll connect this VPC to your corporate network over a VPN or peering, pick ranges that don't overlap with anything NetBox is about to document. The [NetBox developer guide](https://meetrix.io/blogs/netbox-developer-guide/) walks through each step with screenshots, plus logs, shutdown, and troubleshooting. ### If SSL doesn't set itself up This happens when the domain isn't on Route 53, or DNS wasn't pointing at the server when the stack finished. Point the record, wait until it resolves, then SSH in and run the certificate script: ```bash ssh -i your-key.pem ubuntu@ sudo /root/certificate_generate_standalone.sh ``` ### Seeing a 502 Bad Gateway? NetBox takes a few minutes to start after the instance boots. Wait about five minutes and refresh before you start debugging anything. ## Your First Site, Prefix, and Token Most objects in NetBox hang off a site, so start there. Then record the address space it uses, and give your automation a way in. 1. Add a siteUnder _Organization_, open _Sites_ and click _Add_. Name it after the data centre or office it represents. NetBox fills in the slug. 2. Add a prefixUnder _IPAM_, open _Prefixes_, add the network in CIDR notation (say `10.10.0.0/16`) and assign it to the site. NetBox now shows how much of it is used. 3. Create usersGive each person their own account with only the permissions they need. The admin account can change or delete anything, so keep it to one or two people. 4. Create an API tokenClick your username, open _API Tokens_, and add one. Leave write access off unless the tool changes data, and copy the token straight away: NetBox doesn't show it again. Check the token works by asking NetBox for its status: ```bash curl -H "Authorization: Bearer " \ -H "Accept: application/json" \ https://netbox.yourcompany.com/api/status/ ``` A JSON reply with the NetBox version means you're in. The interactive API reference lives at `/api/schema/swagger-ui/` on your domain, and the official [REST API guide](https://netboxlabs.com/docs/netbox/integrations/rest-api/) covers filtering and pagination. Got a spreadsheet to migrate? Every list view in NetBox has a bulk import that takes CSV, JSON, or YAML. Import in dependency order (sites, then racks, then device types, then devices, then interfaces and IPs), because NetBox won't accept a device for a site that doesn't exist yet. ## Running NetBox Safely Server - The security group opens HTTP and HTTPS, and limits SSH to the range you set in `SSHLocation`. Don't leave that at `0.0.0.0/0` for longer than a test. - NetBox sits behind Nginx with a Let's Encrypt certificate once your domain points at it. - The Elastic IP stays the same across reboots, so your DNS record doesn't break. Accounts and tokens - The `admin` account is a superuser. Keep it to one or two people. - One API token per tool, read-only unless the tool writes, with an expiry date on anything temporary. - In 4.7, running a custom script through the API needs a token with write access, so scripts that used to work with a read-only token will now get a 403. - If you're on 4.7.0 or 4.7.1, upgrade to at least 4.7.2 to close the API-token-in-job-results issue. One more thing. Because NetBox holds a full map of your network, think about who can reach it at all. Plenty of teams keep it off the public internet entirely and reach it over a private network, which is what our [Headscale developer guide](https://meetrix.io/blogs/headscale-developer-guide/) sets up. ### Backups: schedule the script Every site, device, and address you've recorded is in that one PostgreSQL database. The backup script copies it to your S3 bucket, but only when it runs, so put it on a cron schedule the day you launch. Then add an S3 lifecycle rule so old dumps don't pile up forever. Our [NetBox image on Google Cloud](https://meetrix.io/blogs/netbox-ipam-gcp/) ships with that schedule already in place. **If you only do one thing after launch, schedule the backup.** Your network documentation is the one thing you can't rebuild by redeploying, and it's usually needed most on the day something else has broken. Upgrades mean a new stack New NetBox versions ship as new AMI versions. To upgrade: take a backup, launch a new stack from the new version, and restore the backup into it. Read the [release notes](https://netboxlabs.com/docs/netbox/release-notes/) first, especially the breaking changes, if your scripts or plugins talk to the API. ## Self-Hosted vs NetBox Cloud NetBox Labs sells a hosted version too, and for some teams it's the right call. Here's how the two compare, using what's published on the [NetBox Cloud](https://netboxlabs.com/products/netbox-cloud/) and [pricing](https://netboxlabs.com/pricing/) pages. | | NetBox on AWS by Meetrix | NetBox Cloud | | --- | --- | --- | | Where data lives | Your own AWS account and region | NetBox Labs' cloud, in one of seven regions: US East, US West, Canada, UK, EU West, EU Central, and APAC (Sydney) | | Pricing | Hourly software fee by instance type, plus AWS charges. A 365-day contract saves up to 41%. | Free plan, then Starter, Professional, and Premium through sales. No public prices | | Devices and IP addresses | No cap, beyond what your instance handles | Free plan: 100 devices and 500 IP addresses | | API requests | No cap | Free plan: 10,000 a month | | Operational branches | No cap | Free plan: 2 | | Backups | Script to your S3 bucket, on your schedule | Free plan: once per day. Starter: daily. Professional: hourly. Premium: hourly and on-demand | | SSO | Configure it yourself | Common SSO (Okta, Google, Entra ID) on paid plans; group mapping on Professional; SAML or custom SSO on Premium | | Plugins, webhooks, custom scripts | Included | Paid plans only | | Upgrades | Launch the new AMI version and restore your backup | Free plan: automatic. Paid plans: automatic or on-demand | | Support | Meetrix, by email, replies within 12 hours | Email on Starter; 24x7 with SLAs on Premium | My view: a small network with under 100 devices belongs on the free Cloud plan. It costs nothing and you never touch a server, though it comes with 2 operational branches, daily backups, and no plugins, webhooks, or custom scripts. Past that, Cloud's paid plans go through a sales call, and the AMI is a single hourly line on your AWS bill with no limit on devices, addresses, or API calls. If you also need the data in an account you control, self-hosting stops being a cost question at all. ## AMI, Docker, or Cloud Recommended Meetrix AMI on AWS Marketplace Best for production use with the least effort PostgreSQL, Valkey, Nginx, SSL, S3 backups, and per-instance secrets set up for you. Supported by Meetrix. netbox-docker Best for your own server or a laptop The community [netbox-docker](https://github.com/netbox-community/netbox-docker) project runs the same containers. The proxy, SSL, secrets, and backups are yours to handle. NetBox Cloud Best for a small network Sign up and start documenting. Free up to 100 devices and 500 IP addresses, with no server at all. Docker is the quickest way to try it. For inventory you actually depend on, the AMI is less work, because secrets, SSL, and backups are the parts that get skipped on a test install and then quietly carried into production. ## Is Self-Hosting NetBox Worth It? For a team past 100 devices, or one that has to keep its network map in its own account, yes. You get no caps on devices, addresses, or API calls, a database you control, and an API your automation can lean on. The AMI handles the setup work that usually stalls a NetBox install: the database, the two caches, the worker, the proxy, and the certificate. It's a weaker deal for a small network. The free Cloud plan does the job and costs nothing. And whichever way you go, schedule the backup on day one. NetBox tells you what your network should look like. To watch what it's actually doing, our [Grafana developer guide](https://meetrix.io/blogs/grafana-developer-guide/) sets up monitoring dashboards on the same cloud. Specs, launch options, and the developer guide are also collected on the [NetBox store page](https://meetrix.io/store/netbox/). ## Frequently Asked Questions What is NetBox? An open-source tool for documenting and modeling network infrastructure (IPAM for addresses and prefixes, DCIM for sites, racks and devices) with a full REST and GraphQL API on top. Is self-hosted NetBox free? The software is Apache 2.0 licensed and free. On the Meetrix AMI, you pay an hourly software fee plus your AWS charges for the EC2 instance, storage, and any S3 backup costs. Which version of NetBox does the AMI run? The AMI ships a 4.7.x release. Check the Marketplace listing for the exact patch version, because NetBox ships patches roughly every one to two weeks. The latest community patch at the time of writing is 4.7.4, released October 27, 2026. What instance size do I need? t3a.medium is the recommended starting point. Size up if you're tracking a very large network or running heavy automation against the API. What are the login details? Username admin, password is the AdminPassword you set in the CloudFormation stack. The AMI generates its own database and application secrets on first boot. Can I use NetBox as an Ansible inventory? Yes. That's one of its main uses. The REST API and the netbox.netbox Ansible collection let playbooks read devices, interfaces, IPs, and config contexts directly from NetBox. Self-hosted NetBox or NetBox Cloud? Under 100 devices with no data residency requirement, the free Cloud plan is the easier call, though it's limited to 2 operational branches and daily backups, with no plugins, webhooks, or custom scripts. Past that, or if the network map has to stay in your own account, self-hosting wins on cost and control. Where do I get help? Support goes to the Meetrix team at [aws@meetrix.io](mailto:aws@meetrix.io), and the [developer guide](/blogs/netbox-developer-guide/) covers setup, logs, and troubleshooting. ## Ready to Replace the IP Spreadsheet? Deploy NetBox on AWS in about ten minutes, with PostgreSQL, SSL, and S3 backups set up for you. One source of truth for your network, on your own server. [Get Started on AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-m47brkiticifc) Meetrix Store NetBox Open-source IPAM and DCIM, the source of truth for your network [Deploy it](https://meetrix.io/store/netbox/) Meetrix Store New Deploy what this guide covers, pre-configured. - [NetBox Open-source IPAM and DCIM, the source of truth for your network](https://meetrix.io/store/netbox/) - [Grafana Dashboards and alerts for Prometheus and more](https://meetrix.io/store/grafana/) - [Headscale Your own Tailscale control plane](https://meetrix.io/store/headscale/) - [Jitsi Meet Self-hosted video calls for 50 to 500 users](https://meetrix.io/store/jitsi-meet/) - [RustDesk Remote desktop AMI, a TeamViewer alternative](https://meetrix.io/store/rustdesk/) - [Coturn TURN/STUN for WebRTC, no per-minute relay fees](https://meetrix.io/store/coturn/) [Browse all products](https://meetrix.io/store/)