Getting Started

Getting Started with OpenEMR on AWS

2026-07-30 · openemr docs · aws

The CloudSOE OpenEMR image gives you a fully installed OpenEMR 8.0 — Apache, PHP, MariaDB and the Node.js C-CDA service — on a hardened Ubuntu base. OpenEMR is installed and configured at build time, so there is no setup wizard: on first boot the instance rotates the Administrator password to a per-instance value and regenerates the TLS certificate for your public IP. You log in with the rotated credentials.

What you’ll need

  • An AWS account subscribed to the CloudSOE OpenEMR listing on AWS Marketplace
  • An EC2 key pair in your target region (SSH is key-based only; password login is disabled)
  • About ten minutes

Step 1 — Launch the instance

  1. Open the OpenEMR listing on AWS Marketplace and click Continue to Subscribe, then Continue to Configuration.
  2. Pick your region and click Continue to Launch → Launch through EC2.
  3. Choose an instance type. t3.medium (2 vCPU, 4 GB RAM) is a good starting point for a small practice.
  4. Select your key pair, and give the root volume at least 30 GB — patient documents live on this disk.

Prefer the CLI? Once subscribed:

aws ec2 run-instances \
  --image-id <ami-id-from-the-listing> \
  --instance-type t3.medium \
  --key-name my-key \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=openemr-01}]'

Step 2 — Open the firewall ports

Your security group needs exactly three inbound rules:

PortProtocolPurpose
22TCPSSH administration
80TCPHTTP (redirects to HTTPS)
443TCPHTTPS (OpenEMR)

Restrict port 22 to your own IP range where possible — this is a medical records system, so consider restricting ports 80/443 to your clinic’s network too.

Step 3 — Let first boot finish

On the very first boot the instance runs a one-time setup service (openemr-firstboot) that:

  • waits about a minute for the network to settle,
  • rotates the Administrator password to this instance’s EC2 instance ID,
  • regenerates the self-signed TLS certificate with your public IP as its CN,
  • writes the credentials to a root-protected file and fills your public IP into the login banner.

Give it two to three minutes after the instance enters the running state. You can watch it:

ssh ubuntu@<public-ip>
systemctl status openemr-firstboot

Step 4 — Retrieve your credentials

SSH in as the ubuntu user. The login banner (MOTD) shows your instance’s public IP and points at the credentials file:

sudo cat /opt/openemr-default-credentials.txt

This file (mode 600) holds the Administrator username and the rotated password. If the automatic reset ever fails, the file says so explicitly and tells you to change the password immediately after login.

Step 5 — Log in to OpenEMR

Browse to https://<public-ip>/ (plain HTTP redirects to HTTPS). Your browser will warn about the self-signed certificate — expected on a fresh instance; see the configuration guide for switching to a trusted certificate and your own domain.

Log in as Administrator with the password from the credentials file, then change it from within OpenEMR. The system is fully installed — start configuring your facility, users and calendars.

Next steps