►
Description
In this presentation, I will walk you through the process of creating an enterprise-level AWS infrastructure. Throughout it, we will create an infrastructure comprising a VPC with four subnets in two different availability zones with a client application, backend server, and a database deployed inside. Our architecture will be able to provide the scalability and availability required by modern cloud systems. Along the way, I will explain the basic concepts and components of the Amazon Web Services platform.
A
So
first,
let's
start
with
what
is
virtual
plywood
cloud
or
another
as
a
short
name,
vpc,
it's
an
isolated
virtual
network,
which
is
a
part
of
the
aws
network
in
which
we
can
launch
our
aws
resources
and
within
the
vpc,
our
resources
have
private
ip
addresses
to
which
they
can
communicate
with
one
another.
We
can
control
the
access
to
all
those
resources,
nintendo
bpc
and
route
outgoing
traffic.
However,
we
like,
however,
we
cannot
launch
ec2
instances
directly
into
the
vpc.
We
need
for
that
subnet.
A
So
subnets
are
additional
isolated
areas
that
have
its
own
cidr
block
and
routing
policies,
and
we
can
launch
instances
inside
the
subnets
subnets
allow
us
to
create
different
behaviors
in
the
same
vpc.
For
instance,
we
can
create
a
public
subnet
that
can
be
accessed
and
can
have
access
directly
to
the
internet,
the
outside
world,
and
we
can
have
a
private
subnet
which
is
not
accessible
from
the
internet
and
has
access
to
the
internet
only
through
the
nut
gateway,
so
network
address
translation
gateway.
A
Now,
let's
move
to
the
fun
part,
so
aws
management
console
in
top
right
corner.
We
can
select
an
aws
region.
Aws
regions
are
geographical
areas
in
which
aws
has
its
data.
Data,
centers
and
regions
are
further
divided
into
availability
zones,
which
are
independent
data,
centers
relatively
close
to
each
other,
which
are
used
for
redundancy
and
data
replication.
A
So
in
my
case,
I'm
using
eos
one.
It
doesn't
matter
for
this
presentation,
but
it
might
matter
for
your
organization,
for
instance,
due
to
privacy
policies,
so,
as
I
said
before,
we're
gonna
start
with
scaffolding
of
our
application.
So
first
we'll
set
up
the
gpc,
we're
going
to
the
vpc
service
dashboard
and
we're
going
to
click,
launch
vpc
wizard.
A
A
So
we'll
start
with
abilities
on
a
word
name:
public
subnet,
public
subnet,
a
and
private
subnet
private
subnet
a
so,
as
I
mentioned
before.
In
order
to
have
access
to
the
internet
from
our
private
subjects,
we
need
a
nat
gateway.
Aws
provides
us
with
a
manage,
not
gateway
service.
We
just
need
to
allocate
elastic
ip
address
for
it,
so
we're
gonna
go
to
another
tab
once
again
to
the
vpc
service,
dashboard
and
we'll
go
to
the
elastic
ips
tab.
A
Here
we
can
allocate
elastic
ip
elastic.
Ip
is
just
a
static
ip
address
which
is
managed
by
aws,
and
we
can
use
it
to.
We
can
attach
it
and
disattach
it
from
our
resources
freely.
So
that's
where
its
elasticity
comes
from,
for
instance.
If,
if
one
of
our
resources
fails,
we
can
simply
attach
it
to
a
healthy
one.
So
I'm
gonna
allocate
one
elastic
ip
right
now
and
I'm
gonna
change
its
name
to
not
a
ip.
A
Now,
if
we
go
back
to
the
first
step,
we
should
see
our
elastic
ip
again
selected.
We
have
some
other
options
here,
such
as,
for
instance,
dedicated
hardware,
but
that's
very
costly,
and
we
don't
need
that
for
this
presentation,
so
I'm
going
to
just
click,
create
vpc
and
right
now,
aws
is
gonna,
configure
our
vpc.
A
If
we
go
to
the
ppc
dashboard,
we'll
already
see
it.
The
part
which
takes
the
most
is
the
configuration
of
nut
gateway.
So
if
we
go
to
nut
gateways,
we'll
see
that
the
nut
gateway
is
being
met
in
the
pending
state,
so
we
can
work,
wait,
wait
for
it,
but
in
meantime
we
can
configure
the
level
piece
on
b
and
in
order
to
do
that,
we
need
to
create
manually
subnets
in
that
ability
zone.
So
I'm
gonna
click
create
subnet,
select
our
vpc.
A
Okay,
so
maybe
it's
still
creating
in
the
meantime,
we
can
talk
about
the
security
in
the
vpc,
so
security
inside
of
pc
can
be
managed
with
use
of
three
key
structures,
which
is
security
groups,
network
access,
control,
lists,
knuckles
and
drought
tables
security
groups,
work
like
mini
firewalls.
They
define
allowed
incoming
and
outgoing
traffic
and
they
work
on
instance
level
and
can
be
shared
among
many
instances
and
allow
access
from
other
security
groups.
A
At
the
same
time,
we
can
use
knuckles,
which
are
ip
filtering
table
for
incoming
outgoing
traffic,
and
they
work
as
an
additional
security
layer
on
top
of
the
security
groups,
and
the
difference
is
that
they
work
on
vpc
or
subnet
level,
instead
of
instance,
level,
and
they
support
denyros.
So
we
can
use
it,
for
instance,
for
blacklisting
specific
ips.
A
A
And
0.3.0
and
t4
and
create
subnet.
So
now
we
have
all
the
subnets
we
need.
We
can
move
to
creation
of
nat
gateway
for
the
second
availability,
and
we
also
need
to
do
that
manually,
so
we're
gonna
click
create
not
gateway,
name
it
not
b
and
now
we
want
to
place
it
in
public
subnet
b
and
we
need
to
allocate
another
elastic
ip
address
for
it.
A
That's
it
the
last
step
in
infrastructure.
In
our
part
of
our
infrastructure,
scaffolding
is
set
up
of
routing
rules,
so
we're
going
to
move
to
route
tables,
and
we
can
see
that
aws
set
us
up
with
two
route
tables.
As
default.
We
have
the
main
route
table
and
some
additional
one.
So
we
start
with
main
routing
cable,
we're
gonna
name
it
main
rt
and
we're
gonna
use
our
main
right
table
for
our
public
subnets.
A
Now
we
can
look
at
the
routing
rules,
edit
routes,
and
we
have
two
entries
here.
The
first
one
says
that
each
ip
address,
which
is
part
of
the
vpc
cider
block,
should
resolve
locally
and
that's
fine
for
us
and
the
second
one
redirects,
the
outgoing
traffic,
through
the
nut
gateway
and
in
case
of
the
public
subnet.
We
want
to
go
through
the
entire
net
gateway.
A
A
A
A
A
A
Here
we
can
choose
an
imagined
motion
image.
Ami
amazon
machine
images
are
basically
image
templates
that
contain
software
operating
system,
runtime
environments
and
our
actual
applications
that
are
used
to
launch
ec2
instances,
and
we
can
use
some
pre-configured
aws
emis
such
as
here
or
we
can
have
our
own
mmis.
For
now,
I'm
going
to
use
just
the
basic
amazon
links
to
mi,
but
later
on,
we
also
use
our
own.
A
A
So
one
more
thing
we
should
like
to
do
is
use
the
user
data
script.
User
data
script
is
the
script
which
is
executed
during
the
boot
up
of
our
ec2
instance,
and
I
prepared
a
script
here
which
will
basically
install
java,
11
and
download
the
jar
file
of
our
back-end
application
from
aws
s3
service
aws,
three
services
file
search
service,
which
we
use
to
store
our
jar
file
right
now,
so
I'm
gonna
click
next.
A
A
Security
groups
allow
access
on
ssh
port,
but
we
don't
need
that
because
we'll
use
aws
session
manager
in
order
to
access
our
instance.
If
we
want
ssh
to
them
directly,
we
can
go
further
and
review
our
instance.
Details
and
click
lounge
here
adapters
ask
us
for
a
keeper
because
it
uses
a
public
private
key
cryptography
during
in
order
to
ssh
into
the
instance,
but,
as
I
said,
we're
not
gonna
ssh
to
it.
So
we
don't
need
the
keeper
large
instance
and
it's
being
launched.
It's
gonna
take
a
moment.
A
So
in
the
meantime,
we
can
create
an
ec2
instance
for
availability
on
a
for
client
application.
So
I'm
going
to
click
cloud
launch
instance
again,
select
the
same
same
mmi
on
amazon
links
to
same
instance
type
this
time
we
wanted
to
our
institute
instance
to
be
deployed
in
public
someday.
So
that's
fine
in
public
subnet.
We
need
an
public
ip,
so
I'm
going
to
enable
it
I'm
going
to
select
client
ectural
and
we'll
also
need
a
user
data
script,
but
this
time
a
bit
different.
A
A
A
A
This
one
already
contains
the
jar
and
java.
We
just
need
to
place
it
in
the
proper
subnet.
So
this
time
it's
going
to
be
private
subnet
b
again
we
don't
need
public
ip.
We
need
irm
servers
to
immoral
and
this
time
we
don't
need
the
user
data
script,
because
we
already
have
the
runtime
environment
prepared
in
our
amazon
machine
image,
again
default
storage,
name
server,
b,
ec2.
A
A
A
A
A
A
A
A
A
A
Rds
is
a
rational
database
service.
So
it's
an
aws
service
for
create
information.
Databases
managed
by
aws,
so
we
don't
have
to
care,
for
instance,
about
the
underlying
infrastructure.
I'll
just
click
create
database,
and
here
we
have
different
engine
options.
Amazon
aurora
is
supposed
to
be
the
fastest
and
the
cheapest
one,
but
in
this
printer
I'm
going
to
use
mysql
because
it
provides
a
free
tier
option.
A
A
A
A
A
A
A
A
A
A
We
can
talk
a
bit
about
the
ec2
storage,
so
all
ec2
instances
come
with
instant
store
volumes
for
temporary
data
that
is
deleted
whenever
the
instance
is
stopped
or
terminated,
as
well
as
with
elastic
block
store.
So
that's
the
part
which
were
always
going
with
the
default
setting,
but
we
could
change
it,
which
is
a
persistent
storage
volume
working
independently
of
the
ec2
instance
itself,
there's
also
a
third
option,
which
is
a
classic
file
system
which
is
file
storage
service,
and
this
one
can
be
shared
among
many
instances.
A
A
A
So,
let's
go
back
to
the
aws
network
service.
In
the
meantime,
we
can
this
one
is
still
creating.
That's
not
a
problem,
so
we're
going
to
go
to
the
ec2
service
dashboard
again
and
we're
going
to
scroll
a
bit
here.
We
have
the
load
balancing
tab,
so
the
load
balancing
in
aws
works
with
use
of
target
groups.
A
Target
groups
allow
us
to
define
a
set
of
targets
that
are
supposed
to
handle
traffic
of
the
same
type.
Then
each
load
balancer
has
a
set
of
listeners
that
consists
of
request
conditions
such
as,
for
instance,
at
this
point,
all
the
requests
at
the
specific
part
we'd
like
to
forward
to
a
specific
target
group.
So
first
we're
going
to
set
up
our
target
groups,
we'll
have
two
target
groups,
one
for
server
instances
and
one
for
client
instances.
A
We
can
see
that
the
target
groups
can
have
instances
of
targets
ip
addresses,
random
functions.
In
our
case,
it's
going
to
be
instances
so
server
tg.
Our
application
is
going
to
be
running
on
port
8080.
So
we'll
change
that
it's
part
of
our
user
manager,
ppc
and
health
check
path.
Our
application
doesn't
have
that
base
path,
so
we're
gonna
use
user's
path.
A
Next,
and
here
we
can
specify
instances
which
should
be
part
of
our
target
group,
so
I'm
gonna
select
server
a
and
server
bc,
to
instance
include
a
spending
and
I'm
going
to
create
target
group.
Now
we're
going
to
do
the
same
for
client
target
group.
Client
tg,
our
client
application
runs
on
port
5000.
A
A
A
A
We
don't
need
any
specific
configuration
here,
we'll
create
a
new
security
group
for
our
password,
so
user
manager,
lbst,
sg4,
load
balancer,
and
this
one
allows
traffic
incoming
traffic
on
port,
8080
and
5000
from
everywhere.
That's
fine
configure
routing!
So
here
we
can
select
an
existing
target
group.
We're
gonna,
select,
server,
tg
and
we'll
have
to
configure
this
client
target
group
later
on
manually,
so
register
target
the
targets
of
our
target
group
and
create.
A
A
A
So
our
backend
application
is
a
spring
boot
application
and
during
the
startup
it's
gonna
try
to
connect
to
aws
system
manager
which
we're
gonna
use
as
a
config
server.
So
during
the
startup,
our
application
is
gonna.
Try
to
fetch
configuration
from
the
parameter
server.
I
pre-configured
here
some
configuration
properties
such
as
username
name.
In
our
case
it
was
admin
the
password
addme123
and
we
have
the
url
which
into
edit
to
point
to
our
database.
A
A
A
So
that
our
load
balancer
can
forward
traffic
to
the
server
instances
the
same
for
client
hd,
but
instead
of
port
8080,
we're
gonna
use,
port
5000
and
as
well
user
manager,
lbsg
save
the
last
thing.
Is
the
user
manager
db
security
group
into
edit
in
controls,
and
we
need
to
allow
traffic
on
the
mysql
port.
So
it's
3306
for
the
server
security
group
so
that
our
server
instances
can
connect
to
the
database.
A
A
Script
so
we'll
go
to
this
home
here:
okay
system
user.
Here
we
have
our
jar
file,
so
I'm
gonna
use
the
command.
So
first
I
just
kill
any
process
with
shining
and
using
port
id80.
Then
I
export
spring
profile
as
production
profile,
and
I
run
the
jar,
our
application
through
execution
of
the
jar
file
and
in
the
end
I
just
disarm
the
process
so
that
whenever
we
kill
this
terminal,
the
process
doesn't
die.
A
A
So
now
let's
go
here:
I
prepared
some
simple
script:
deploy.sage,
which
basically
installs
all
the
node
dependencies
and
runs
the
react
application
here
as
a
parameter.
We
pass
the
address
of
the
backend
server,
which
is
the
load
balancer
url
with
the
port
8080,
and
we
again
design
the
process
so
and
same
here.
A
A
But
actually,
if
we
just
go
here
and
try
to
access
the
url
of
our
backend
server,
we
get
the
mtra.
That
means
that
the
back-end
server
is
running
and
now,
if
we
try
to
access
the
application
for
5000,
we
started
what
gateway.
So
that
means
that
our
application
didn't
okay,
this
one
didn't
yet
start.
A
We
need
to
wait
a
moment
in
general.
The
load
balancer
should
forward
traffic
only
to
health
instances,
but
that
only
happens
if
any
of
the
instances
is
already
marked
as
healthy
and
because
of
the
delay.
Both
of
the
instances
are
unhealthy.
So
right
now
the
load
balancers
is
in
a
pass-through
mode
and
just
forwarding
the
request
to
all
the
targets.
A
A
A
So
that's
it.
We
created
an
aws
infrastructure
comprising
of
four
subnets
into
different
availability
zones.
We
deployed
our
client
application
and
a
backend
server.
We
configured
and
rational
database
with
use
of
rda's
aws
service.
We
use
a
nat
gateway,
we
configured
application
balancer
and
along
the
way
we
used
aws
system
manager
to
access
our
instances.
A
So
thank
you
very
much
here
here
are
the
urls
of
the
back-end
application
code,
front
application
code
and
cloud
formation
for
the
indus
infrastructure.
The
cloud
formation
templates
were
not
created
by
me,
but
by
my
colleague,
but
feel
free
to
check
it
out.
If
you
need
what
are
your
top
tips
on
debugging
vpc
connectivity
issue,
where
do
you
find
that
things
are
usually
misconfigured?
A
So
usually
it's
in
security
groups
or
routing
rules,
I
would
say,
and
for
debugging
that
means
on
what
stage
we
are.
If
we
already
have
running
applications
we
can
use
and
we
have
logging
unlocking
in
our
applications.
We
can
use
aws,
x-ray
or
cloudwatch,
but
in
most
cases
when
it
comes
to
connectivity,
security
groups
or
routing
or
eventual
network
access
control
lists.
So
all
the
security
measures
we
have.