AWS TURN Server: Deploy Coturn on AWS in Minutes with a Pre-Configured AMI

Every WebRTC app works fine in testing. Then a customer joins from a hotel, a hospital or a corporate network, and the call connects with no video. That's NAT and firewalls blocking the direct path between peers, and the fix is a TURN server that relays the media for them.

This guide covers running that TURN server on AWS with Coturn, the open source server most WebRTC stacks use, packaged by Meetrix as a ready-to-launch AMI.

What an AWS TURN server does

WebRTC tries to connect peers directly. STUN helps each side discover its public address, and that's enough for most home connections. When it isn't, typically behind symmetric NAT or a firewall that only allows web traffic, the peers fall back to TURN: both send their media to the relay, and the relay forwards it. Our explainer on STUN vs TURN vs ICE walks through how the browser decides.

Running the relay on AWS puts it close to your users and inside an account you control, so relayed media doesn't pass through a third-party TURN service. One Coturn process does both jobs: it's your AWS STUN server and your TURN server on the same port.

Coturn on AWS: what the Meetrix AMI includes

• Coturn 4.11 on Ubuntu 24.04, configured with long-term credentials so the relay isn't open to the world.
• UDP mode ready on port 3478 as soon as the instance starts.
• TURN over TLS on TCP 443, for networks that block everything except HTTPS. This needs a certificate.
• Automatic Let's Encrypt SSL when the domain you give is hosted in Route 53, with scripts for doing it by hand if not.
• A CloudFormation template that takes your instance type, domain and admin email.

If you'd rather build it yourself, our guides to installing Coturn on Ubuntu and the Docker Compose installation guide cover the manual routes, and Coturn on GCP Marketplace is the same one-click setup on Google Cloud. For a deep dive into the workings of Coturn, see Meetrix's Developer Guide.

How to set up a TURN server on AWS

The short version of the Developer Guide:

1. Open Meetrix Coturn on AWS Marketplace, click "Continue to Subscribe" and accept the terms.
2. Under "Configure this software", pick your region, then "Continue to Launch" and choose "Launch CloudFormation".
3. Fill in the stack: name, admin email, instance type (t3.micro is the recommended starting point), deployment name and your TURN domain. Choose "Roll back all stack resources" on failure, then submit.
4. Point your domain at the instance. If it's in Route 53, SSL is set up for you; otherwise SSH in and run certificate_generate_dns.sh or certificate_generate_standalone.sh.
5. Generate a TURN username and password on the server with the provided script, then test (next section).

To pause it, stop the EC2 instance; a stopped instance stops the hourly software charge too. To remove it entirely, delete the CloudFormation stack.

Meetrix Coturn - Developer Guide

Welcome to the Meetrix Coturn Developer Guide! This guide is designed to assist you in seamlessly integrating Coturn into your AWS environment. Whether you're new to AWS or an experienced developer, you'll discover step-by-step instructions, configuration details, and troubleshooting tips to ensure a smooth experience.

By Dinesh Chathuranga • Meetrix.io

Testing your AWS TURN server with Trickle ICE

Open the WebRTC project's Trickle ICE page, add turn:your-domain:3478 with the credentials you generated, and click "Gather candidates". A line of type relay means the TURN server works. Then test turns:your-domain:443 the same way. If you only see host and srflx lines, the relay isn't reachable, and nine times out of ten that's the security group.

AWS STUN server and TURN server costs

Three things make up the bill:

• EC2: a t3.micro is about $0.0104 an hour on-demand in us-east-1, roughly $7.60 a month. Coturn is light on CPU; you size up for network throughput, not compute.
• Software fee: $0.048 an hour on the Marketplace listing, about $35 a month, or less on the annual contract the listing offers.
• Data transfer: this is the one that grows. Every relayed stream leaves AWS as outbound traffic, billed at EC2 data transfer rates.

To get a feel for the bandwidth: a 1 Mbps video stream is about 450 MB an hour. A two-person call fully relayed through TURN sends each person's stream out once, so roughly 0.9 GB an hour leaves AWS. Most calls never touch TURN at all, since STUN connects them directly, so in practice only the share of users on difficult networks costs you bandwidth. STUN on its own costs almost nothing, because no media flows through it.

Running Coturn on AWS in production

• Open the right ports: 3478 UDP and TCP, 443 TCP, and the UDP relay range from turnserver.conf (Coturn's default is 49152 to 65535).
• Use an Elastic IP so the address in your ICE configuration survives a restart.
• Don't hand out static credentials in client code. Generate short-lived ones from your backend using Coturn's shared-secret (TURN REST API) mode.
• Watch outbound bandwidth in CloudWatch, not CPU. That's where a busy TURN server runs out first.
• Put it near your users. A relay in another continent adds latency to every relayed call. Run one per region if your users are spread out.

For Jitsi specifically, our guide to setting up a TURN server for Jitsi Meet covers the extra Prosody configuration, and Jitsi Meet and firewalls explains when TURN actually kicks in.

Where a TURN server earns its keep

Anything built on WebRTC needs one eventually: video conferencing, telehealth, online classrooms, customer-support video, voice AI agents in the browser, and peer-to-peer file transfer. The pattern is always the same. A share of users sit behind networks that block direct connections, and without TURN those users just can't connect. If you're selling to enterprises, hospitals or schools, that share is large enough that a TURN server isn't optional.