{"slug":"install-tailscale-on-an-aws-vm","title":"Install Tailscale on an AWS VM","tags":["tailscale","setup"],"agent_summary":"Last validated: Jan 12, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Install Tailscale on an AWS VM\r\n\r\nLast validated: Jan 12, 2026\r\n\r\nYou can install the Tailscale client on an AWS EC2 VM to connect it to your Tailscale network (known as a tailnet) and configure common features such as subnet routers, exit nodes, and app connectors.\r\n\r\n## [Install manually](https://tailscale.com/docs/install/cloud/aws/quickstart\\#install-manually)\r\n\r\n1. (Optional) Go to the [Keys](https://login.tailscale.com/admin/settings/keys) page of the admin console and select **Generate auth key** to create an [authentication key](https://tailscale.com/docs/features/access-control/auth-keys). This lets you add the VM to the tailnet automatically without needing to manually authenticate using your credentials.\r\n\r\n2. SSH into your EC2 VM.\r\n\r\n3. [Install Tailscale](https://tailscale.com/docs/install/linux) using the following command:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\ncurl -fsSL https://tailscale.com/install.sh | sh\r\n```\r\n\r\n4. Start the Tailscale client using one of the following commands:\r\n - If you want to use an auth key, use the command `sudo tailscale up --auth-key=foo` where `foo` is they auth key string that you generated in the first step.\r\n - If you do not want to use an auth key, use the command `sudo tailscale up`, copy and paste the provided URL into your web browser, then authenticate to your tailnet with your credentials.\r\n5. In the [Machines](https://login.tailscale.com/admin/machines) page of the admin console, verify that the VM is connected to the tailnet. If the VM you added is a server, you may want to consider [disabling key expiry](https://tailscale.com/docs/features/access-control/key-expiry) to prevent the need to periodically re-authenticate.\r\n\r\n\r\n## [Install automatically](https://tailscale.com/docs/install/cloud/aws/quickstart\\#install-automatically)\r\n\r\nYou can use our AWS installation wizard to deploy Tailscale on an AWS VM using an [AWS CloudFormation](https://aws.amazon.com/pm/cloudformation) template. To do this, you will need access to an account with AWS CloudFormation console and permission to create a new stack. You can use this to launch a user-owned node, or a tagged node. We recommend using tagged nodes for shared infrastructure. For more information, refer to [Group devices with tags](https://tailscale.com/docs/features/tags).\r\n\r\n1. Go to the [Machines](https://login.tailscale.com/admin/machines) page of the admin console. In the **Add devices to your network** section, select **Add AWS VM**.\r\n1. (Recommended) To make this a tagged node, toggle **Tags** to on, select **Add tags**, then choose the tag you want to use for the AWS VM.\r\n2. (Optional) Toggle **Ephemeral** to on if you want the AWS VM to be removed from your tailnet when it goes offline.\r\n3. (Optional) Toggle **Use as exit node** to on if you want to route tailnet traffic through your AWS VM. For more information, refer to [Advertise an exit node](https://tailscale.com/docs/features/exit-nodes/how-to/setup?tab=linux#advertise-a-device-as-an-exit-node).\r\n4. Select **Continue to AWS**. You will be redirected to the AWS CloudFormation console. If you are already authenticated, the **Quick create stack** page will display.\r\n2. From the CloudFormation console.\r\n1. In the **Stack name** field, enter a name. This serves as a description of the stack you are creating.\r\n2. (Optional) In the **ExtraArgs** field, specify functionality such as [Tailscale SSH](https://tailscale.com/docs/how-to/connect-ssh-linux-vm) (`--ssh`) and a [subnet router](https://tailscale.com/docs/features/subnet-routers/how-to/setup?tab=linux) (`--advertise-routes=192.0.1.0/24`), if applicable. Each functionality should be separated by a space.\r\n3. (Optional) In the **Hostname** field, enter a name for the VM that will display in the [Machines](https://login.tailscale.com/admin/machines) page of the admin console.\r\n4. (Optional) In the **ImageId** field, change if you want to use another image ID for the VM. For more information about image IDs, refer to [Find an AMI that meets the requirements for your EC2 instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/finding-an-ami.html).\r\n5. (Optional) In the **InstanceType** field, change the VM size if you want to use a different Amazon EC2 instance.\r\n6. (Optional) In the **VpcId** field, enter an Amazon Virtual Private Cloud (VPC) and subnet ID if you want the VM to be provisioned in a specific VPC.\r\n7. Select **Create stack** to start provisioning.\r\n3. Go to the [Machines](https://login.tailscale.com/admin/machines) page of the admin console and verify that the VM is added. It may take up to 5 minutes for a provisioned VM to join your tailnet.\r\n\r\n## [Next steps](https://tailscale.com/docs/install/cloud/aws/quickstart\\#next-steps)\r\n\r\nIf you have not done so already, you can add the following tailnet functionality to your AWS VM.\r\n\r\n- [SSH into your VM](https://tailscale.com/docs/how-to/connect-ssh-linux-vm) using Tailscale SSH.\r\n- [Advertise an exit node](https://tailscale.com/docs/features/exit-nodes/how-to/setup?tab=linux#advertise-a-device-as-an-exit-node) to route traffic in your tailnet.\r\n- [Use an existing exit node](https://tailscale.com/docs/features/exit-nodes/how-to/setup?tab=linux#use-an-exit-node) in your tailnet.\r\n- [Configure a subnet router](https://tailscale.com/docs/features/subnet-routers/how-to/setup?tab=linux) to relay access in your network, including resources where Tailscale cannot be installed.\r\n- [Configure an app connector](https://tailscale.com/docs/features/app-connectors) to route application-specific traffic from the tailnet through a selected device that serves as an app connector.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Install Tailscale on an AWS VM

\n

Last validated: Jan 12, 2026

\n

You can install the Tailscale client on an AWS EC2 VM to connect it to your Tailscale network (known as a tailnet) and configure common features such as subnet routers, exit nodes, and app connectors.

\n

Install manually

\n
    \n
  1. \n

    (Optional) Go to the Keys page of the admin console and select Generate auth key to create an authentication key. This lets you add the VM to the tailnet automatically without needing to manually authenticate using your credentials.

    \n
    2. \n
  2. \n

    SSH into your EC2 VM.

    \n
    3. \n
  3. \n

    Install Tailscale using the following command:

    \n
    4. \n
\n
curl -fsSL https://tailscale.com/install.sh | sh\n
\n
    \n
  1. Start the Tailscale client using one of the following commands:\n\n
    2. \n
  2. In the Machines page of the admin console, verify that the VM is connected to the tailnet. If the VM you added is a server, you may want to consider disabling key expiry to prevent the need to periodically re-authenticate.
    3. \n
\n

Install automatically

\n

You can use our AWS installation wizard to deploy Tailscale on an AWS VM using an AWS CloudFormation template. To do this, you will need access to an account with AWS CloudFormation console and permission to create a new stack. You can use this to launch a user-owned node, or a tagged node. We recommend using tagged nodes for shared infrastructure. For more information, refer to Group devices with tags.

\n
    \n
  1. Go to the Machines page of the admin console. In the Add devices to your network section, select Add AWS VM.
    2. \n
  2. (Recommended) To make this a tagged node, toggle Tags to on, select Add tags, then choose the tag you want to use for the AWS VM.
    3. \n
  3. (Optional) Toggle Ephemeral to on if you want the AWS VM to be removed from your tailnet when it goes offline.
    4. \n
  4. (Optional) Toggle Use as exit node to on if you want to route tailnet traffic through your AWS VM. For more information, refer to Advertise an exit node.
    5. \n
  5. Select Continue to AWS. You will be redirected to the AWS CloudFormation console. If you are already authenticated, the Quick create stack page will display.
    6. \n
  6. From the CloudFormation console.
    7. \n
  7. In the Stack name field, enter a name. This serves as a description of the stack you are creating.
    8. \n
  8. (Optional) In the ExtraArgs field, specify functionality such as Tailscale SSH (--ssh) and a subnet router (--advertise-routes=192.0.1.0/24), if applicable. Each functionality should be separated by a space.
    9. \n
  9. (Optional) In the Hostname field, enter a name for the VM that will display in the Machines page of the admin console.
    10. \n
  10. (Optional) In the ImageId field, change if you want to use another image ID for the VM. For more information about image IDs, refer to Find an AMI that meets the requirements for your EC2 instance.
    11. \n
  11. (Optional) In the InstanceType field, change the VM size if you want to use a different Amazon EC2 instance.
    12. \n
  12. (Optional) In the VpcId field, enter an Amazon Virtual Private Cloud (VPC) and subnet ID if you want the VM to be provisioned in a specific VPC.
    13. \n
  13. Select Create stack to start provisioning.
    14. \n
  14. Go to the Machines page of the admin console and verify that the VM is added. It may take up to 5 minutes for a provisioned VM to join your tailnet.
    15. \n
\n

Next steps

\n

If you have not done so already, you can add the following tailnet functionality to your AWS VM.

\n\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}