Umami on AWS: Self-Hosted, Cookie-Free Web Analytics

Google Analytics Is Free. That Doesn't Mean It's the Right Fit.

Google Analytics is free, but it's heavy. It sets cookies that trigger a consent banner in a lot of places, and every visit ends up in Google's cloud. Most sites don't need that much. They need to know which pages people read, where those people came from, and whether last week's campaign did anything. Umami answers those questions on one screen, sets no cookies, and runs on your own AWS account.

Meetrix's AMI sets it up in 5-10 minutes: Umami 3.4.0 and PostgreSQL 17 on one server, behind Nginx, with Let's Encrypt SSL and a backup script that writes to your S3 bucket. Below are the install steps, how to add your first website, and an honest look at when Umami Cloud is the better deal. You can launch the Meetrix Umami AMI on AWS Marketplace.

What Is Umami?

Umami is an open-source web analytics platform released under the MIT licence. You add one small script to your site's pages (roughly 2 KB, compared to the much heavier Google Analytics tag), and it records visits without cookies and without storing anything that identifies a person. The source and release notes are on GitHub.

What it does

What's new in Umami 3.4.0

The 3.x line has moved fast, and 3.4.0, released on September 16, 2026, is the current release. Here's what landed.

Annotations. You can now add dated notes to your website charts, with markers showing when something happened. Mark the day you launched a feature, started a campaign, changed pricing, or had an outage. When you come back to the data later, the context is sitting right there next to the spike.

MCP support. Umami now supports the Model Context Protocol, so compatible AI tools can query your analytics directly, with questions like "How did traffic this month compare with last month?" or "Which channels brought the most visitors to our pricing page?" The tools are read-only and follow the same user and team permission checks as the app. On self-hosted instances, the remote MCP endpoint is disabled by default; you enable it with MCP_ENABLED=1 and connect using an account API key.

Account API keys. Self-hosted users can create and revoke API keys under Settings → API keys. The full key is shown once at creation, so copy it before closing the dialog. Access follows the key owner's existing permissions.

A typed API client. @umami/api-client is a TypeScript client generated from Umami's OpenAPI spec, with typed inputs and responses for both Cloud and self-hosted instances. Analytics endpoints are now organised by website and feature, with dedicated saved funnel and goal resources.

Session property filters in saved segments. You can now attach session properties, such as plan type or account tier, to a saved audience and return to it without rebuilding the filters.

Security fixes. This release rejects partial 2FA tokens for authenticated API access, binds authenticated sessions to password fingerprints (so changing your password invalidates old sessions), excludes deleted teams from access checks, and prevents website reassignment when updating reports.

Worth noting from earlier 3.x releases: 3.2.0 brought heatmaps and better session replay controls, and 3.3.0 added two-factor authentication, session identity stitching, board cloning, sparklines, and improved bounce detection.

Who Self-Hosted Umami Suits

The clearest fit is an agency, a SaaS company, or a publisher running more than one site, where Cloud's event caps or retention windows start to bite. There are no per-site or per-event fees on the AMI, so adding a client's site costs nothing extra.

Why Run Umami on AWS

You could run the Docker image anywhere. The AMI exists for the parts around it that are easy to postpone and painful to skip.

Billing goes through your AWS account, like the rest of our self-hosted software on AWS.

Install Umami on AWS in Six Steps

1. Create an S3 bucketThe stack asks for a backup bucket, and it has to exist already, in the region you deploy to. It's the one thing people forget before they hit Launch.
2. Subscribe on AWS MarketplaceSubscribe to Umami on AWS Marketplace, then choose the CloudFormation fulfilment option and Launch CloudFormation.
3. Fill in the stack parametersUse the table below. Leave the VPC and subnet ranges at their defaults.
4. Create the stackTick the box acknowledging IAM resources, then wait 5-10 minutes for CREATE_COMPLETE. If it fails on vCPUs, follow our guide to increase your AWS vCPU quota.
5. Point your domainCopy PublicIp from the Outputs tab and create a DNS A record for your DomainName pointing at it.
6. Sign inOpen DashboardUrl, or DashboardUrlIp over plain HTTP until DNS and SSL are ready. The username is admin and the password is your AdminPassword.

Stack parameters

The Umami developer guide walks through each step with screenshots, plus logs, shutdown, and troubleshooting.

If SSL doesn't set itself up

This happens when the domain isn't on Route 53, or DNS wasn't pointing at the server when the stack finished. Point the record, wait until it resolves, then SSH in and run the certificate script:

ssh -i your-key.pem ubuntu@<PublicIp>
sudo /root/certificate_generate_standalone.sh

Seeing a 502 Bad Gateway?

Umami can take a few minutes to start after the instance boots. Wait about five minutes and refresh before you start debugging anything.

Add Your First Website

1. Add the websiteOn the Websites page, click Add website, enter a name and the site's domain, and save.
2. Copy the tracking codeOpen the website's settings, copy the snippet from Tracking code, and paste it into the <head> of every page you want to track.
3. Check it worksVisit your site once. The visit shows on the dashboard within a few seconds. If it doesn't, test from a browser without an ad blocker.
4. Add people (optional)Create a user for each teammate rather than sharing the admin password, or give outsiders a public share link.

The snippet looks like this, with your own Umami domain and website ID filled in:

<script defer src="https://analytics.yourcompany.com/script.js" data-website-id="your-website-id"></script>

To count a button click as an event, add a data-umami-event attribute to it. No extra JavaScript needed:

<button data-umami-event="Signup button">Sign up</button>

In 3.4.0, there's also a data-distinct-id attribute for setting a visitor identity through the tracker, which is useful if you want to stitch sessions together across devices.

The official docs on tracking events cover event properties and the umami.track() JavaScript call.

Running Umami Safely

Backups: schedule the script

Every website, user, and event you've ever recorded is in that one PostgreSQL database. The backup script copies it to your S3 bucket, but only when it runs, so put it on a cron schedule the day you launch. Then add an S3 lifecycle rule so old dumps don't pile up forever.

One upgrade note worth knowing: 3.4.0 includes schema migrations for annotations and API keys, and they run automatically during the build process. That's handled for you on the AMI, but if you're running your own Docker deployment, make sure the migration completes before you send traffic.

Self-Hosted vs Umami Cloud

Umami sells a hosted version too, and it's a fair option. Here's how the two compare, using the current plans on umami.is/pricing. Umami Cloud runs in the US and EU, and you pick the region for your account.

A few details worth calling out from the Cloud pricing structure. Hobby is genuinely limited: one website, no API access, no teams, no session replays or heatmaps, and six months of retention. Pro at $20/month gets you a million events, 20 websites, 10 team members, two years of retention, API access, MCP access, and email reports, but still no replays or heatmaps. Business at $200/month unlocks unlimited websites and team members, five years of retention, the Streaming API, session replays (5,000 included, then $0.005 each), heatmaps, white-labeling, and email and chat support. Enterprise adds SAML SSO, an audit log, an uptime SLA, and invoice billing.

There's also a 14-day free trial on Pro and Business, no card required during the window.

Here's my view. A single small site belongs on the free Cloud tier. Once you're past 100K events a month, or running a handful of client sites, Pro's $20 and its 20-site limit start to look tight, and a t3a.small with no caps (and no feature paywalls for replays, heatmaps, or the API) starts to look cheap.

AMI, Docker, or Cloud

Docker is the quickest way to try it. For sites you actually care about, the AMI is less work, because SSL and backups are the parts people tend to put off.

Resources

Umami - Developer Guide

Step-by-step deployment on AWS: launching the AMI, creating the CloudFormation stack, pointing DNS, adding your first website, generating SSL, and checking logs and upgrades.

Meetrix.IO | Binuka Ranatunga

Is Self-Hosting Umami Worth It?

For anyone tracking several sites, or a team that has to keep visitor data in its own account, yes. You get unlimited sites and events, history for as long as you keep it, and share links for clients, on one small server. The AMI handles the setup work that usually stops people from self-hosting: the database, the proxy, and the certificate.

It's a weaker deal for one personal site with modest traffic. The free Cloud tier does the job and costs nothing. And whichever way you go, schedule the backup on day one.

Umami tells you who visits your websites. For the servers behind them, our Grafana developer guide sets up infrastructure dashboards on the same cloud. Specs, launch options, and the developer guide are also collected on the Umami store page.