installing my “FREE” cloud phone system (AWS and 3CX)
Based on NetworkChuck's video on YouTube. If you like this content, support the original creators by watching, liking and subscribing to their content.
Create an AWS IAM user with programmatic access and EC2 permissions so 3CX can deploy and manage an EC2 instance.
Briefing
A cloud-based business phone system can be assembled with three building blocks—AWS for hosting, 3CX for the PBX software, and Amazon Chime for a real phone number—so calls can route to extensions from anywhere. The setup is “mostly free” for a limited window: AWS’s free tier and 3CX’s one-year free plan cover the server and PBX, while a paid phone number (and its calling service) is the main ongoing cost.
The process starts by creating an AWS account and configuring access for 3CX. An IAM user is created with programmatic access and granted full access to EC2, since 3CX needs permissions to deploy a virtual machine. A key pair (PEM format) is generated for secure authentication to that EC2 instance. To keep costs down, the guide uses AWS Marketplace to subscribe to a Debian 9 image and then relies on a free-tier EC2 size (notably t2.nano) in a selected AWS region (the example uses us-east-1 / “North Virginia” initially).
Next comes 3CX setup in the cloud. A free 3CX account is created for one year, and the system is configured to self-host on AWS. The AWS credentials from the IAM user (access key ID from the downloaded CSV) are entered so 3CX can spin up the server automatically. Region alignment matters: 3CX must deploy into the same AWS region where the key pair exists. Once the server is created, the PBX becomes reachable via a 3CX domain, and extensions can be added using the 3CX app (soft phones) and additional devices like tablets or hard phones.
To make the system usable for business calls, a public phone number is required—extensions alone can’t serve as a business line. Amazon Chime is used for SIP trunking: a toll-free number is provisioned, then a Voice Connector is created to connect Chime to the 3CX PBX. The connector is configured for outbound calling by allowing the 3CX server’s public IPv4 address (from the EC2 instance) and setting authentication credentials. Inbound routing is also defined so calls to the Chime number land on a specific 3CX destination (initially an extension).
Finally, 3CX is configured with the SIP trunk details from Chime, including the voice connector’s outbound host name and the SIP authentication username/password. Inbound tests confirm that dialing the toll-free number reaches the chosen extension. Outbound calling requires an outbound rule in 3CX that normalizes dialed numbers: calls prefixed with “9” are routed through the Chime voice connector, the leading digit is stripped, and the number is converted into E.164-style format by prepending “+1” so Amazon accepts it. A test call demonstrates outbound routing with the purchased toll-free number as caller ID.
The build is completed with an IVR (digital receptionist) in 3CX. A main line extension is created, prompts are recorded, menu options route callers to destinations like an employee extension, and inbound rules are updated so the toll-free number sends callers into the IVR. The result is a fully functional business phone system hosted in AWS, reachable from anywhere, with real inbound/outbound calling through Amazon Chime and automated call handling via IVR—free for the infrastructure for a year, with the phone number as the paid component.
Cornell Notes
The setup creates a working business phone system in the cloud by combining AWS (hosting), 3CX (PBX/phone features), and Amazon Chime (a real phone number via SIP trunking). AWS’s free tier and 3CX’s one-year free plan cover the server and PBX, while Amazon Chime requires payment for the phone number and trunk service. After configuring IAM permissions, an EC2 key pair, and a Debian 9 image, 3CX self-hosts on an EC2 instance in a chosen AWS region. Amazon Chime then provisions a toll-free number and connects to the 3CX server through a Voice Connector, enabling both inbound routing to 3CX extensions and outbound calling with number normalization to E.164 format. An IVR ties it together by routing callers from the main line into menu options and employee extensions.
Why are IAM permissions and an EC2 key pair necessary before 3CX can deploy a cloud PBX?
What cost-control choices keep the AWS portion “mostly free”?
How does Amazon Chime turn an extension-only PBX into a business phone number system?
What is the role of “allowed host list” and the EC2 public IPv4 address in the trunk setup?
Why does outbound calling require digit stripping and E.164 normalization?
How does the IVR integrate with inbound calling to provide menu-based routing?
Review Questions
- What AWS components (IAM permissions, key pairs, EC2 images) must be prepared before 3CX can self-host successfully?
- Describe the inbound call flow from a toll-free number provisioned in Amazon Chime to a specific 3CX extension or IVR.
- In the outbound rule example, how do the dial prefix “9,” digit stripping, and E.164 formatting work together to make outbound calls succeed?
Key Points
- 1
Create an AWS IAM user with programmatic access and EC2 permissions so 3CX can deploy and manage an EC2 instance.
- 2
Generate and securely store an EC2 key pair (PEM); 3CX uses it for server authentication and it can’t be re-downloaded later.
- 3
Use AWS Marketplace to subscribe to a Debian 9 image and keep EC2 within free-tier limits (such as t2.nano) to control costs.
- 4
Provision a public phone number in Amazon Chime and connect it to the 3CX PBX via a Voice Connector to enable real inbound/outbound calling.
- 5
Configure trunk security by adding the 3CX EC2 instance public IPv4 address to the Voice Connector allowed host list.
- 6
Set up 3CX inbound routing so the Chime number forwards to an extension or IVR, and set up outbound rules with number normalization to E.164 format.
- 7
Add a 3CX IVR (digital receptionist) and point the Chime inbound rule at the IVR extension to provide menu-based call handling.