Deploying a Three-Tier Architecture on AWS: End-to-End Project

1. Internet Gateway
   1. 1. 1. To give the public subnets in our VPC internet access, we must create and attach an Internet Gateway. On the left-hand side of the VPC dashboard, select Internet Gateway.

2. Create your internet gateway by simply giving it a name and clicking Create internet gateway.

3. After creating the internet gateway, attach it to your VPC that you create in the VPC and Subnet Creation step of the workshop. You have a couple of options on how to do this, either with the creation success message or the Actions drop-down.

Then, select the correct VPC and click Attach internet gateway.

1. NAT Gateway
   1. For our instances in the app layer private subnet to be able to access the internet, they will need to go through a NAT Gateway. For high availability, you’ll deploy one NAT gateway in each of your public subnets. Navigate to NAT Gateways on the left side of the current dashboard and click Create NAT Gateway.

2. Fill in the Name, choose one of the public subnets you created in part 2, and then allocate an Elastic IP. Click Create NAT gateway.

1. 3. Repeat steps 1 and 2 for the other subnet.

Routing Configuration

1. Navigate to Route Tables on the left side of the VPC dashboard and click Create Route Table. First, let’s create one route table for the web layer public subnets and name it accordingly.

2. After creating the route table, you’ll automatically be taken to the details page. Scroll down and click on the Routes tab and Edit routes.

3. Add a route that directs traffic from the VPC to the internet gateway. In other words, for all traffic destined for IPs outside the VPC CDIR range, add an entry that directs it to the internet gateway as a target. Save the changes.

4. Edit the Explicit Subnet Associations of the route table by navigating to the route table details again. Select Subnet Associations and click Edit subnet associations.

Select the two web layer public subnets you created eariler and click Save associations.

4. Now create 2 more route tables, one for each app layer private subnet in each availability zone. These route tables will route app layer traffic destined for outside the VPC to the NAT gateway in the respective availability zone, so add the appropriate routes for that.

Once the route tables are created and routes added, add the appropriate subnet associations for each of the app layer private subnets.

Security Groups

1. Security groups will tighten the rules around which traffic will be allowed to our Elastic Load Balancers and EC2 instances. Navigate to Security Groups on the left side of the VPC dashboard under Security.

2. The first security group you’ll create is for the public, internet-facing load balancer. After typing a name and description, add an inbound rule to allow HTTP-type traffic for your IP.

3. The second security group you’ll create is for the public instances in the web tier. After typing a name and description, add an inbound rule that allows HTTP type traffic from your internet-facing load balancer security group you created in the previous step. This will allow traffic from your public facing load balancer to hit your instances. Then, add an additional rule allowing HTTP type traffic for your IP. This will allow you to access your instance when we test.

4. The third security group will be for our internal load balancer. Create this new security group and add an inbound rule that allows HTTP type traffic from your public instance security group. This will allow traffic from your web tier instances to hit your internal load balancer.

5. The fourth security group we’ll configure is for our private instances. After typing a name and description, add an inbound rule that will allow TCP type traffic on port 4000 from the internal load balancer security group you created in the previous step. This is the port our app tier application is running on and allows our internal load balancer to forward traffic on this port to our private instances. You should also add another route for port 4000 that allows your IP for testing.

6. The fifth security group we’ll configure protects our private database instances. For this security group, add an inbound rule that will allow traffic from the private instance security group to the MYSQL/Aurora port (3306).

1. Navigate to the RDS dashboard in the AWS console and click on Subnet groups on the left-hand side. Click Create DB subnet group.

2. Give your subnet group a name, description, and choose the VPC we created. When adding subnets, make sure to add the subnets we created in each availability zone specifically for our database layer. You may have to navigate back to the VPC dashboard and check to make sure you’re selecting the correct subnet IDs.

1. Navigate to your list of running EC2 Instances by clicking on Instances on the left hand side of the EC2 dashboard. When the instance state is running, connect to your instance by clicking the checkmark box to the left of the instance, and click the connect button on the top right corner of the dashboard.Select the Session Manager tab, and click connect. This will open a new browser tab for you.

NOTE: If you get a message saying that you cannot connect via session manager, then check that your instances can route to your NAT gateways and verify that you gave the necessary permissions on the IAM role for the Ec2 instance.

2. When you first connect to your instance like this, you will be logged in as ssm-user which is the default user. Switch to ec2-user by executing the following command in the browser terminal:

sudo -su ec2-user

3. Let’s take this moment to make sure that we are able to reach the internet via our NAT gateways. If your network is configured correctly up till this point, you should be able to ping the google DNS servers:

ping 8.8.8.8

You should see a transmission of packets. Stop it by pressing cntrl c.

NOTE: If you can’t reach the internet, then you need to double-check your route tables and subnet associations to verify if traffic is being routed to your NAT gateway!

1. Start by downloading the MySQL CLI:

sudo yum install mysql -y

 

2. Initiate your DB connection with your Aurora RDS writer endpoint. In the following command, replace the RDS writer endpoint and the username, and then execute it in the browser terminal:

mysql -h CHANGE-TO-YOUR-RDS-ENDPOINT -u CHANGE-TO-USER-NAME -p

 

You will then be prompted to type in your password. Once you input the password and hit enter, you should now be connected to your database.

NOTE: If you cannot reach your database, check your credentials and security groups.

3. Create a database called webappdb with the following command using the MySQL CLI:

CREATE DATABASE webappdb; 

 

You can verify that it was created correctly with the following command:

SHOW DATABASES;

 

4. Create a data table by first navigating to the database we just created:

USE webappdb; 

 

Then, create the following transactions table by executing this create table command:

CREATE TABLE IF NOT EXISTS transactions(id INT NOT NULL AUTO_INCREMENT, amount DECIMAL(10,2), description VARCHAR(100), PRIMARY KEY(id)); 

 

Verify the table was created:

SHOW TABLES; 

 

5. Insert data into table for use/testing later:

INSERT INTO transactions (amount,description) VALUES ('400','groceries'); 

 

Verify that your data was added by executing the following command:

SELECT * FROM transactions;

6. When finished, just type exit and hit enter to exit the MySQL client.

 

Configure App Instance

1. The first thing we will do is update our database credentials for the app tier. To do this, open the application-code/app-tier/DbConfig.js file from the github repo in your favorite text editor on your computer. You’ll see empty strings for the hostname, user, password and database. Fill this in with the credentials you configured for your database, the writer endpoint of your database as the hostname, and webappdb for the database. Save the file.

NOTE: This is NOT considered a best practice and is done for the simplicity of the lab. Moving these credentials to a more suitable place, like Secrets Manager, is left as an extension for this workshop.

2. Upload the app-tier folder to the S3 bucket that you created in part 0.

3.  Go back to your SSM session. Now we need to install all of the necessary components to run our backend application. Start by installing NVM (node version manager).

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash source ~/.bashrc

 

4. Next, install a compatible version of Node.js and make sure it’s being used.

nvm install 16 nvm use 16

 

5. PM2 is a daemon process manager that will keep our node.js app running when we exit the instance or if it is rebooted. Install that as well.

npm install -g pm2 

 

6. Now, we need to download our code from our s3 buckets onto our instance. In the command below, replace BUCKET_NAME with the name of the bucket you uploaded the app-tier folder to:

cd ~/ aws s3 cp s3://BUCKET_NAME/app-tier/ app-tier --recursive

 

7. Navigate to the app directory, install dependencies, and start the app with pm2.

cd ~/app-tier npm install pm2 start index.js 

 

To make sure the app is running correctly, run the following:

pm2 list

 

If you see a status of online, the app is running. If you see errored, then you need to do some troubleshooting. To look at the latest errors, use this command:

pm2 logs

 

NOTE: If you’re having issues, check your configuration file for any typos, and double check that you have followed all installation commands till now.

8. Right now, pm2 is just making sure our app stays running when we leave the SSM session. However, if the server is interrupted for some reason, we still want the app to start and keep running. This is also important for the AMI we will create:

pm2 startup

 

After running this, you will see a message similar to this.

[PM2] To setup the Startup Script, copy/paste the following command: sudo env PATH=$PATH:/home/ec2-user/.nvm/versions/node/v16.0.0/bin /home/ec2-user/.nvm/versions/node/v16.0.0/lib/node_modules/pm2/bin/pm2 startup systemd -u ec2-user —hp /home/ec2-user

DO NOT run the above command, rather you should copy and paste the command in the output you see in your own terminal. After you run it, save the current list of node processes with the following command:

pm2 save

Test App Tier

Now, let’s run a couple of tests to see if our app is configured correctly and can retrieve data from the database.

To hit out health check endpoint, copy this command into your SSM terminal. This is our simple health check endpoint that tells us if the app is simply running.

curl http://localhost:4000/health

 

The response should looks like the following:

"This is the health check"

 

Next, test your database connection. You can do that by hitting the following endpoint locally:

curl http://localhost:4000/transaction

 

You should see a response containing the test data we added earlier:

{"result":[{"id":1,"amount":400,"description":"groceries"},{"id":2,"amount":100,"description":"class"},{"id":3,"amount":200,"description":"other groceries"},{"id":4,"amount":10,"description":"brownies"}]}

 

If you see both of these responses, then your networking, security, database and app configurations are correct.

7. Congrats! Your app layer is fully configured and ready to go.

 

1. Navigate to Instances on the left-hand side of the EC2 dashboard. Select the app tier instance we created, and under Actions, select Image and templates. Click Create Image.

2. Give the image a name and description, and then click Create image. This will take a few minutes, but if you want to monitor the status of image creation, you can see it by clicking AMIs under Images on the left-hand navigation panel of the EC2 dashboard.

Before we create and configure the web instances, open up the application-code/nginx.conf file from the repo we downloaded. Scroll down to line 58 and replace [INTERNAL-LOADBALANCER-DNS] with your internal load balancer’s DNS entry. You can find this by navigating to your internal load balancer’s details page.

Then, upload this file and the application-code/web-tier folder to the s3 bucket you created for this lab.

sudo -su ec2-user ping 8.8.8.8

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash source ~/.bashrc nvm install 16 nvm use 16

cd ~/
aws s3 cp s3://BUCKET_NAME/web-tier/ web-tier --recursive

cd ~/web-tier npm install npm run build

sudo yum install nginx -y

cd /etc/nginx ls

sudo rm nginx.conf sudo aws s3 cp s3://BUCKET_NAME/nginx.conf .

sudo service nginx restart

chmod -R 755 /home/ec2-user

sudo chkconfig nginx on

1. Navigate to Instances on the left-hand side of the EC2 dashboard. Select the web tier instance we created, and under Actions, select Image and Templates. Click Create Image.

2. Give the image a name and description and then click Create image. This will take a few minutes, but if you want to monitor the status of image creation you can see it by clicking AMIs under Images on the left hand navigation panel of the EC2 dashboard.