AWS 3-Tier Architecture is an excellent choice for developers who aim to run their systems efficiently while minimizing costs. This architecture is structured into three distinct layers: the Presentation Tier, the Application Tier, and the Database Tier.
Presentation Tier
The Presentation Tier is the user interface layer where users interact with your application. It utilizes services such as AWS S3 for storage, CloudFront for content delivery, and Cognito for user authentication. To enhance security, it's advisable to implement additional layers like AWS WAF (Web Application Firewall) and AWS Shield to protect against common web exploits and DDoS attacks.
Application Tier
The Application Tier is responsible for processing business logic and handling interactions. This tier can leverage services like AWS API Gateway for creating and managing APIs, EC2 for scalable computing capacity, Lambda for serverless computing, and ECS for container orchestration. Security Groups should be configured in this layer to control inbound and outbound traffic to your application resources.
Database Tier
The Database Tier is where your application's data is stored and managed. Services such as RDS (Relational Database Service), Aurora (a MySQL and PostgreSQL-compatible relational database), and DynamoDB (a NoSQL database) are commonly used. This tier requires robust encryption to ensure secure data storage and should include backup and recovery solutions to safeguard against data loss.
Initiating VPC
Initiating a VPC (Virtual Private Cloud) involves creating a network environment with both private and public subnets, enabling DNS hostname and resolution. Once the VPC is successfully created, it provides a secure and isolated environment for your AWS resources.
After success create VPC it’s look like this
EC2 Setup
Create 1 EC2 in private subnet, add some security group rules. Create 1 EC2 more in public subnet.
Using EC2 Private endpoint
Setting up EC2 instances involves deploying one instance in a private subnet and another in a public subnet, with appropriate security group rules to manage access. For instances in a private subnet, a private endpoint is necessary to facilitate direct connections, as these instances cannot be accessed directly from the internet.
Let’s try these scenario, you will create 1 or more VirtualHost on EC2 which in Private Subnet.
Load Balancer
A Load Balancer is essential for distributing incoming traffic across multiple EC2 instances, especially those in private subnets that are not directly accessible from the public internet. The load balancer should be configured as internet-facing with an IPv4 address type. It uses a Target Group to manage and scale the instances, ensuring efficient traffic routing and load distribution.
Here you must check when creating Application Load Balancer:
in section Network Mapping choose your VPC and select Public Subnet in every Availability Zone(AZ), also Section Security Groups choose your security group, then you will meet section Target Group see below.
Target Group
This section will organize your instances into a target group, and any scaling configurations will apply to this Target Group. Be sure to select Target Type as instance, protocol as http 80, IP Address Type as IPv4, and protocol as HTTP1.
Register Target
This section you will select EC2 instance with port selected as a target, you can change it later.
after create Target Group back to section Listener and Routing choose that Target Group.
now copy DNS name from ALB
Go to Route 53 and create A record using Alias and select Application Load Balancer and search dns copied
Create VirtualHost
Connect your private instance using EC2 Instance Connect Endpoint.
Now let’s create a VirtualHost in the EC2 private subnet. I've created a script for creating a VirtualHost. Execute chmod +x virtualhost.sh, then run ./virtualhost.sh name-domain. That simple VirtualHost will be created.
#!/bin/bash
if [ "$EUID" -ne 0 ]; then
echo "Please run this script as root or with sudo."
exit 1
fi
if [ -z "$1" ]; then
echo "Usage: $0 <site_name>"
echo "Example: $0 unstable.my.id"
exit 1
fi
SITE_NAME=$1
SITES_AVAILABLE="/etc/nginx/sites-available/$SITE_NAME"
SITES_ENABLED="/etc/nginx/sites-enabled/$SITE_NAME"
WEB_ROOT="/var/www/$SITE_NAME/html"
mkdir -p "$WEB_ROOT"
chown -R $SUDO_USER:$SUDO_USER "$WEB_ROOT"
chmod -R 755 /var/www
echo "<html><head><title>Welcome to $SITE_NAME</title></head><body><h1>Success! The $SITE_NAME virtual host is working!</h1></body></html>" > "$WEB_ROOT/index.html"
cat > "$SITES_AVAILABLE" <<EOL
server {
listen 80;
listen [::]:80;
server_name $SITE_NAME www.$SITE_NAME;
access_log /var/log/nginx/$SITE_NAME-access.log combined buffer=512k flush=1m;
error_log /var/log/nginx/$SITE_NAME-error.log warn;
location / {
root $WEB_ROOT;
index index.html index.htm;
}
}
EOL
ln -s "$SITES_AVAILABLE" "$SITES_ENABLED"
nginx -t
if [ $? -eq 0 ]; then
systemctl restart nginx
echo "Virtual host for $SITE_NAME has been created and enabled."
else
echo "Nginx configuration test failed. Please check your configuration."
exit 1
fi
read -p "Do you want to set up SSL for $SITE_NAME? (y/n) " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
echo "Installing Certbot for SSL setup..."
apt-get update
apt-get install -y certbot python3-certbot-nginx
certbot --nginx -d $SITE_NAME -d www.$SITE_NAME
systemctl restart nginx
echo "SSL has been set up for $SITE_NAME."
fi
echo "Virtual host setup for $SITE_NAME is complete!"
Now our domain has successfully pointed to the EC2 in the private subnet go type your domain in url.
Thank you for reading my article. I hope you found it helpful!. Have a trouble? you can comment below.
Setup RDS for Data Tier
