Requirement

Instance Configuration Requirements

Overview:

When setting up your AWS instance, you’ll need to configure a few key options. Here’s a detailed guide on the recommended configurations and selections.

1. Instance Type

For optimal performance, we recommend using the following instance types:

t3a.small – 2 virtual CPUs and 2 GB memory.
t3.small – 2 virtual CPUs and 2 GB memory.

However, you can choose an instance type based on your specific workload and traffic needs. Matomo sizing follows the traffic you measure rather than the number of sites, so a single busy site needs more than several quiet ones. Here’s a quick reference table to help you decide:

CPU / Memory	Suitable for
2 CPU cores / 2 GB	Evaluation, and sites up to roughly 100,000 page views a month
2 CPU cores / 4 GB	Everyday use up to roughly 500,000 page views a month
4 CPU cores / 8 GB	Above a million page views a month, or several busy sites together
8 CPU cores / 16 GB	Above ten million page views a month, or heavy use of segments and custom reports

Matomo is a PHP application backed by MariaDB, and both run on this instance. The work that grows fastest is not serving the dashboard but processing the reports behind it, which happens on a schedule in the background. If Matomo feels slow before the CPU is busy, add memory first.

For more details on different instance types and configurations, refer to the AWS Instance Types documentation.

2. Storage Space

The default allocated storage size for our AMI. You may specify the necessary storage size when launching a new instance or change it after deployment.

30 GB (recommended)

Analytics data grows steadily rather than levelling off, because Matomo keeps a record of every visit alongside the processed reports built from them. Both live on this volume, so allow room for a few years of traffic rather than sizing for this month.

3. Ports Configuration

To ensure smooth operation of your installation, open the inbound ports below. These three are all that this image needs.

Please note: the database does not need an open port, and must not be given one. MariaDB runs on a private network inside the instance and is reachable only by the application. Opening port 3306 to the internet would expose every visit record you hold and is not required for anything.

Please also note: mail ports do not need to be open. Matomo connects out to your mail server, and an AWS security group already permits the reply to a connection you started. Opening 465, 587, 993 or 995 for inbound traffic achieves nothing and exposes the instance.

Inbound Ports:

Type	Protocol	Port Range	Source	Why
SSH	TCP	22	0.0.0.0/0	To run the one-click installer and the domain setup tool. Restrict this to your own address if you can.
HTTP	TCP	80	0.0.0.0/0	Reaching Matomo before you add a domain, SSL certificate validation afterwards, and receiving tracking requests from your website visitors.
HTTPS	TCP	443	0.0.0.0/0	Required once you associate a domain. Without it your site cannot serve HTTPS, and a tracking snippet on an HTTPS page cannot reach Matomo.

Outbound Ports:

Outbound access is needed to download the application on first boot, to obtain and renew your SSL certificate, to send email through your own SMTP provider, and to download a geolocation database if you choose to use one. The default AWS security group allows all outbound traffic, and no change is required.