Skip to main content
HashnodeCloud & DevOps by Solomon Ndimu Cloud & DevOps by Solomon Ndimu

Command Palette

Search for a command to run...

Architecting Infrastructure of The AWS

# Step 1: Create the Network Infrastructure

To host the e-commerce application and database securely, we will create a custom VPC spanning two Availability Zones (AZs). The public subnets will host the Linux web server (EC2), while the private subnets will house the Amazon RDS database.

### Architecture Overview

```text
                        +-----------------------+
                        |   Internet Gateway    |
                        +-----------+-----------+
                                    |
                                    v
                        +-----------------------+
                        |          VPC          |
                        |      10.0.0.0/16      |
                        +-----------+-----------+
                                    |
            +-----------------------+-----------------------+
            |                                               |
            v                                               v
  Availability Zone 1 (us-west-2a)                Availability Zone 2 (us-west-2b)
+-------------------------------+               +-------------------------------+
| Public Subnet 1               |               | Public Subnet 2               |
| 10.0.1.0/24                   |               | 10.0.3.0/24                   |
|  +-------------------------+  |               |                               |
|  | EC2 Linux Web Server    |  |               |                               |
|  +-------------------------+  |               |                               |
+-------------------------------+               +-------------------------------+
            |                                               |
+-------------------------------+               +-------------------------------+
| Private Subnet 1              |               | Private Subnet 2              |
| 10.0.2.0/24                   |               | 10.0.4.0/24                   |
|  +-------------------------+  |               |  +-------------------------+  |
|  | RDS Primary             |  |               |  | RDS Standby/Subnet     |  |
|  +-------------------------+  |               |  +-------------------------+  |
|                               |               |                               |
|   <------- DB Subnet Group (Spans Both Private Subnets) ------->              |
+-------------------------------+               +-------------------------------+

Step 2: Create the VPC

Navigation:

VPC Console → Your VPCs → Create VPC → Select VPC only

Configuration:

  • Name tag: Ecommerce-VPC
  • IPv4 CIDR block: 10.0.0.0/16
  • Tenancy: Default

Result:

  • VPC Name: Ecommerce-VPC
  • CIDR: 10.0.0.0/16

Step 3: Create Public Subnets

AWS Best Practice: Creating two public subnets across different Availability Zones provides high availability and fault tolerance.

Navigation:

VPC Console → Subnets → Create subnet

Select VPC: Ecommerce-VPC

Public Subnet 1

  • Subnet name: Public-Subnet-1
  • Availability Zone: us-west-2a
  • IPv4 CIDR block: 10.0.1.0/24 (256 IPs)
  • Purpose: Hosts the Linux EC2 Web Server

Public Subnet 2

  • Subnet name: Public-Subnet-2
  • Availability Zone: us-west-2b
  • IPv4 CIDR block: 10.0.3.0/24 (256 IPs)
  • Purpose: Multi-AZ redundant public subnet

Step 4: Create Private Subnets

Private Subnet 1

  • Subnet name: Private-Subnet-1
  • Availability Zone: us-west-2a
  • IPv4 CIDR block: 10.0.2.0/24 (256 IPs)
  • Purpose: Primary subnet for Amazon RDS Database

Private Subnet 2

  • Subnet name: Private-Subnet-2
  • Availability Zone: us-west-2b
  • IPv4 CIDR block: 10.0.4.0/24 (256 IPs)
  • Purpose: Secondary subnet required for RDS DB Subnet Group

Step 5: Create and Attach Internet Gateway

Navigation:

VPC Console → Internet gateways → Create internet gateway

Configuration:

  • Name tag: Ecommerce-IGW

Attachment:

  • Select Ecommerce-IGW → Actions → Attach to VPC → Select Ecommerce-VPC

Purpose:

Provides internet communication capabilities for instances residing in the public subnets.

Step 6: Create and Configure Route Tables

Public Route Table

  1. Create Route Table:
  • Name: Public-RT
  • VPC: Ecommerce-VPC
  1. Add Route:
  • Destination: 0.0.0.0/0
  • Target: Internet Gateway (Ecommerce-IGW)
  1. Subnet Associations:
  • Associate with Public-Subnet-1 and Public-Subnet-2.

Route Summary (Public-RT):

Destination Target
10.0.0.0/16 local
0.0.0.0/0 Ecommerce-IGW

Private Route Table

  1. Create Route Table:
  • Name: Private-RT
  • VPC: Ecommerce-VPC
  1. Subnet Associations:
  • Associate with Private-Subnet-1 and Private-Subnet-2.
  1. Routes:
  • Keep default local route only (10.0.0.0/16 → local).

Purpose:

Keeps database instances in private subnets shielded from direct inbound or outbound internet access.

Step 7: Create Security Groups

Linux Server Security Group

  • Group name: LinuxServer-SG
  • Description: Security group for EC2 Linux Web Server
  • VPC: Ecommerce-VPC

Inbound Rules:

Type Protocol Port Range Source Note
SSH TCP 22 0.0.0.0/0 Admin access (Restrict to your specific IP in production)
HTTP TCP 80 0.0.0.0/0 Public web traffic
HTTPS TCP 443 0.0.0.0/0 Secure public web traffic

Outbound Rules:

  • Allow all traffic (0.0.0.0/0)

RDS Database Security Group

  • Group name: RDS-MySQL-SG
  • Description: Security group for Amazon RDS MySQL Database
  • VPC: Ecommerce-VPC

Inbound Rules:

Type Protocol Port Range Source Note
MySQL/Aurora TCP 3306 Custom (LinuxServer-SG) Restricts DB access strictly to the web server

Important: Do NOT set source to 0.0.0.0/0. Pointing the source directly to LinuxServer-SG guarantees that only instances attached to that security group can connect to port 3306.

Outbound Rules:

  • Allow all traffic (0.0.0.0/0)

Step 8: Launch the Linux EC2 Instance

Navigation:

EC2 Console → Instances → Launch instances

Configuration:

  • Name: LinuxServer
  • AMI: Amazon Linux 2023 AMI
  • Instance Type: t2.micro or t3.micro
  • Key Pair: Select or create ecommerce-key.pem

Network Settings:

  • VPC: Ecommerce-VPC
  • Subnet: Public-Subnet-1
  • Auto-assign Public IP: Enable (Required for SSH and external access)
  • Security Group: Select existing → LinuxServer-SG

Click Launch Instance.

Step 9: Create DB Subnet Group

Requirement: AWS RDS requires a DB Subnet Group spanning at least two subnets across different Availability Zones, even when deploying a Single-AZ database.

Navigation:

RDS Console → Subnet groups → Create DB subnet group

Configuration:

  • Name: ecommerce-db-subnet-group
  • Description: Subnet group spanning private subnets across two AZs
  • VPC: Ecommerce-VPC

Add Subnets:

  • Availability Zones: Select us-west-2a and us-west-2b
  • Subnets: Select the IP ranges corresponding to Private-Subnet-1 (10.0.2.0/24) and Private-Subnet-2 (10.0.4.0/24).

Click Create.

Step 10: Provision the RDS Database

Navigation:

RDS Console → Databases → Create database

Configuration:

  • Choose a creation method: Standard create
  • Engine options: MySQL
  • Templates: Dev/Test
  • Availability and durability: Single DB instance

Settings:

  • DB instance identifier: ecommerce-db
  • Master username: admin
  • Master password: Enter a secure password

Instance Configuration:

  • DB instance class: Burstable classes → db.t3.micro

Connectivity:

  • VPC: Ecommerce-VPC
  • Existing DB Subnet Group: ecommerce-db-subnet-group
  • Public access: No
  • VPC Security Group: Choose RDS-MySQL-SG (Remove default security group)

Click Create database.

Security Architecture Summary

Internet
   |
   | SSH (22) / HTTP (80) / HTTPS (443)
   v
[ LinuxServer-SG ]
   |
   v
EC2 Linux Server (Public Subnet)
   |
   | MySQL (3306)
   v
[ RDS-MySQL-SG ]
   |
   v
Amazon RDS MySQL (Private Subnet)

Security Principles Applied

  • Subnet Isolation: Web server operates in a public subnet, while the database remains protected inside a private subnet.
  • Least Privilege Access: Port 3306 on the database accepts connections strictly from LinuxServer-SG.
  • Multi-AZ Readiness: Subnet groups and public/private subnets are pre-configured across two distinct Availability Zones.