Design AWS Web App Infrastructure
Budget: $30 – $250 AUD
The task starts with a working but very simple web application: one EC2 instance running the site and a separate MariaDB database. I need an end-to-end AWS architecture that evolves this proof-of-concept into a production-ready, highly available, and secure solution.
Phase 1 – Baseline Deployment
• Spin up the initial EC2 instance, install the chosen web stack, and point it to a freshly created Amazon RDS MariaDB instance.
• Import the provided SQL dump so the application launches with real data.
• Store all connection strings and privileged credentials in AWS Secrets Manager, leaving zero hard-coded secrets on the servers.
Phase 2 – Layered Architecture
• Separate the web tier and database tier into distinct subnets inside a new VPC.
• Design a clear, labelled diagram (Visio, Lucidchart, or draw.io) that shows every AWS service and the traffic flow between them: EC2, RDS, Secrets Manager, and any supporting components such as subnets, route tables, and security groups.
Phase 3 – High Availability & Scalability
• Replace the single EC2 instance with an Auto Scaling group spanning at least two Availability Zones.
• Introduce an Application Load Balancer in front of the web tier and configure health checks.
• Enable Multi-AZ on the MariaDB RDS instance to remove the database single point of failure.
• Confirm that the entire stack can survive an AZ outage without downtime.
Security Hardening
• Keep application servers in private subnets; only the load balancer is public.
• Lock down security groups / network ACLs so the database is reachable only from the web tier.
• Apply IAM roles with least-privilege policies to let EC2 read from Secrets Manager while blocking everything else.
Deliverables
• A clearly readable architecture diagram (PDF or PNG).
• An infrastructure-as-code template (CloudFormation or Terraform) or a detailed step-by-step deployment guide.
• Verification notes showing successful fail-over tests and secure connectivity checks.
Acceptance Criteria
• Web application is reachable through the load balancer URL and remains online when one AZ is disabled.
• No direct public access to EC2 instances or the RDS endpoint.
• Secrets are only retrievable via the assigned IAM role.
This project is ideal for someone comfortable with EC2, RDS (MariaDB), ELB, Auto Scaling, Secrets Manager, and general VPC networking best practices.
Phase 1 – Baseline Deployment
• Spin up the initial EC2 instance, install the chosen web stack, and point it to a freshly created Amazon RDS MariaDB instance.
• Import the provided SQL dump so the application launches with real data.
• Store all connection strings and privileged credentials in AWS Secrets Manager, leaving zero hard-coded secrets on the servers.
Phase 2 – Layered Architecture
• Separate the web tier and database tier into distinct subnets inside a new VPC.
• Design a clear, labelled diagram (Visio, Lucidchart, or draw.io) that shows every AWS service and the traffic flow between them: EC2, RDS, Secrets Manager, and any supporting components such as subnets, route tables, and security groups.
Phase 3 – High Availability & Scalability
• Replace the single EC2 instance with an Auto Scaling group spanning at least two Availability Zones.
• Introduce an Application Load Balancer in front of the web tier and configure health checks.
• Enable Multi-AZ on the MariaDB RDS instance to remove the database single point of failure.
• Confirm that the entire stack can survive an AZ outage without downtime.
Security Hardening
• Keep application servers in private subnets; only the load balancer is public.
• Lock down security groups / network ACLs so the database is reachable only from the web tier.
• Apply IAM roles with least-privilege policies to let EC2 read from Secrets Manager while blocking everything else.
Deliverables
• A clearly readable architecture diagram (PDF or PNG).
• An infrastructure-as-code template (CloudFormation or Terraform) or a detailed step-by-step deployment guide.
• Verification notes showing successful fail-over tests and secure connectivity checks.
Acceptance Criteria
• Web application is reachable through the load balancer URL and remains online when one AZ is disabled.
• No direct public access to EC2 instances or the RDS endpoint.
• Secrets are only retrievable via the assigned IAM role.
This project is ideal for someone comfortable with EC2, RDS (MariaDB), ELB, Auto Scaling, Secrets Manager, and general VPC networking best practices.
Related categories:
PHP
Linux
SQL
MySQL
Amazon Web Services
Network Security
Database Management
Terraform