👨🏼‍💻 Deploying a 3 Tier H.A Web Application on AWS 👨🏼‍💻

STEP 1: Create The Base Networking Infrastructure For NAT/ELB, Webservers, Appservers and Database

A) Create The VPC Network

Name: Prod-VPC
CidirBlock: 10.0.0.0/16

B) Create The NAT/AL Subnet 1 and 2

NAT/ALB Subnet 1

Name: Prod-NAT-ALB-Subnet-1
CidirBlock: 10.0.5.0
Availability Zone: us-west-1a

NAT/ALB Subnet 2

Name: Prod-NAT-ALB-Subnet-2
CidirBlock: 10.0.10.0
Availability Zone: us-west-1c

B) Create The Webserver Subnet 1 and 2

Webserver Subnet 1

Name: Prod-Webserver-Subnet-1
CidirBlock: 10.0.15.0
Availability Zone: us-west-1a

Webserver Subnet 2

Name: Prod-Webserver-Subnet-2
CidirBlock: 10.0.20.0
Availability Zone: us-west-1c

C) Create The Appserver Subnet 1 and 2

Appserver Subnet 1

Name: Prod-Appserver-Subnet-1
CidirBlock: 10.0.25.0
Availability Zone: us-west-1a

Appserver Subnet 2

Name: Prod-Appserver-Subnet-2
CidirBlock: 10.0.30.0
Availability Zone: us-west-1c

D) Create The Database Subnet 1 and 2

Database Subnet 1

Name: Prod-db-Subnet-1
CidirBlock: 10.0.35.0
Availability Zone: us-west-1a

Database Subnet 2

Name: Prod-db-Subnet-2
CidirBlock: 10.0.40.0
Availability Zone: us-west-1c

STEP 2: Create 2 Public Route Rable and 6 Private Route Tables (Because of NAT Redundancy Implementation)

See AWS Doc: https://www.shorturl.at/HSU18

A) NAT/ALB Public Subnet 1 Route Table

Name: Prod-NAT-ALB-Public-RT-1
VPC: Select the Prod-VPC

B) NAT/ALB Public Subnet 2 Route Table

Name: Prod-NAT-ALB-Public-RT-2
VPC: Select the Prod-VPC

C) Webserver Subnet 1 Route Table

Name: Prod-Webserver-RT-1
VPC: Select the Prod-VPC

D) Webserver Subnet 2 Route Table

Name: Prod-Webserver-RT-2
VPC: Select the Prod-VPC

E) Appserver Subnet 1 Table Table

Name: Prod-Appserver-RT-1
VPC: Select the Prod-VPC

F) Appserver Subnet 2 Table Table

Name: Prod-Appserver-RT-2
VPC: Select the Prod-VPC

G) Database Subnet 1 Route Table

Name: Prod-Database-RT-1
VPC: Select the Prod-VPC

H) Database Subnet 2 Route Table

Name: Prod-Database-RT-2
VPC: Select the Prod-VPC

STEP 3: Associate All Above Route Tables With Their Respective Subnets

Associate Prod-NAT-ALB-Public-RT-1 with Prod-NAT-ALB-Subnet-1
Associate Prod-NAT-ALB-Public-RT-2 with Prod-NAT-ALB-Subnet-2
Associate Prod-Webserver-RT-1 with Prod-Webserver-Subnet-1
Associate Prod-Webserver-RT-2 with Prod-Webserver-Subnet-2
Associate Prod-Appserver-RT-1 with Prod-Appserver-Subnet-1
Associate Prod-Appserver-RT-2 with Prod-Appserver-Subnet-2
Associate Prod-Database-RT-1 with Prod-db-Subnet-1
Associate Prod-Database-RT-2 with Prod-db-Subnet-2

STEP 4: Create and Configure IGW and NAT Gateways

A) Create and Configure IGW to Expose The `NAT/ALB Subnet 1` and `NAT/ALB Subnet 2`

Create the Internet Gatway

Name: Prod-VPC-IGW
VPC: Select the Prod-VPC Network

Configure/Edit the Prod-NAT-ALB-Public-RT Route Table

Destination: 0.0.0.0/0
Target: Select the Prod-VPC-IGW
SAVE

B) Create and Configure The NAT Gateways to point at the Web, App and Database Tiers/Subnets

Create the First NAT Gateway

Name: Prod-NAT-Gateway-1
Elastic IP: Clcik Allocate Elastic IP
Click Create NAT gateway

Create the Second NAT Gateway

Name: Prod-NAT-Gateway-2
Elastic IP: Clcik Allocate Elastic IP
Click Create NAT gateway

C) Configure/Edit the Route Tables of `Webserver subnets`, `Appserver subnets` and `Database subnets` to Add the `Nat gateway` Configs

C.1) Update the `Webserver subnet` Route tables (2) with the following configs

Select the Prod-Webserver-RT-1

Click on Edit and Add route
Destination: 0.0.0.0/0
Target: Select Prod-NAT-Gateway-1

Select the Prod-Webserver-RT-2

Click on Edit and Add route
Destination: 0.0.0.0/0
Target: Select Prod-NAT-Gateway-2

C.2) Update the `Appserver subnet` Route tables (2) with the following configs

Select the Prod-Appserver-RT-1

Click on Edit and Add route
Destination: 0.0.0.0/0
Target: Select Prod-NAT-Gateway-1

Select the Prod-Appserver-RT-2

Click on Edit and Add route
Destination: 0.0.0.0/0
Target: Select Prod-NAT-Gateway-2

C.3) Update the `Database subnet` Route tables (2) with the following configs

Select the Prod-Database-RT-1

Click on Edit and Add route
Destination: 0.0.0.0/0
Target: Select Prod-NAT-Gateway-1

Select the Prod-Database-RT-2

Click on Edit and Add route
Destination: 0.0.0.0/0
Target: Select Prod-NAT-Gateway-2

STEP 5: Create Security Groups

Create the Bastion Host Security Group

Click on Create Security group
- Name: Bastion-Host-Security-Group
- Inbound:
  - Ports: 22
  - Source: Provide Your IP or 0.0.0.0/0

Create the Frontend/External Load Balancer Security Group

Navigate to Security groups
Click on Create Security group
- Name: Frontend-LB-Security-Group
- Inbound:
  - Ports: 80 and 443
  - Source: 0.0.0.0/0
- Click Create Security Group

Create the Webservers Security Group

Click on Create Security group
- Name: Webservers-Security-Group
- Inbound:
  - Ports: 80 and 443
    - Source: Provide the Frontend-LB-Security-Group ID
  - Ports: 22
    - Source: Bastion-Host-Security-Group ID

Create the Backend/Internal Load Balancer Security Group

Click on Create Security group
- Name: Backend-LB-Security-Group
- Inbound:
  - Ports: 80 and 443
  - Source: Provide the Webservers-Security-Group ID

Create the Appservers Security Group

Click on Create Security group
- Name: Appservers-Security-Group
- Inbound:
  - Ports: 80 and 443
    - Source: Provide the Backend-LB-Security-Group ID
  - Ports: 22
    - Source: Bastion-Host-Security-Group ID

Create the Database Security Group

Click on Create Security group
- Name: Database-Security-Group
- Inbound:
  - Ports: 3306
    - Source: Provide the Appservers-Security-Group ID
  - Ports: 3306
    - Source: Bastion-Host-Security-Group ID

STEP 6: Create External/Frontend and Internal/Backend Load Balancers

Create External/Frontend Load Balancer

Navigate to EC2/Load Balancers and Click on Create Load Balancer
- Type: Choose Application Load Balancer
- Load balancer name: Prod-Frontend-LB
- Scheme: Internet-facing
- IP address type: IPv4
- Network mapping:
  - VPC: Select Prod-VPC
  - Mappings: Select the Prod-NAT-ALB-Subnet-1 and Prod-NAT-ALB-Subnet-2 frontend subnets
- Security groups: Select the Frontend-LB-Security-Group
- Listeners and routing:
  - Click on Create a target group to create HTTP target group
    - target type: select instances
    - Target group name: Frontend-LB-HTTP-TG
    - Protocol and Port: HTTP:80
    - VPC: Select Prod-VPC
    - Protocol version: HTTP1
    - Health checks: HTTP
    - Health check path: /
    - Click on Next
    - Click on Create target group
- NOTE: Navigate back to the page where you're creating the LoadBalancer and Refresh (Not The Whole Page)
- Listeners and routing:
  - Protocol: HTTP
  - Listener HTTP:80
  - Select the Frontend-LB-HTTP-TG
- Click on Create load balancer

Create Internal/Backend Load Balancer

Navigate to EC2/Load Balancers and Click on Create Load Balancer
- Type: Choose Application Load Balancer
- Load balancer name: Prod-Backend-LB
- Scheme: Internal
- IP address type: IPv4
- Network mapping:
  - VPC: Select Prod-VPC
  - Mappings: Select the Prod-Webserver-Subnet-1 and Prod-Webserver-Subnet-2 Webserver/Provate subnets
- Security groups: Select the Backend-LB-Security-Group
- Listeners and routing:
  - Click on Create a target group to create HTTP target group
    - target type: select instances
    - Target group name: Backend-LB-HTTP-TG
    - Protocol and Port: HTTP:80
    - VPC: Select Prod-VPC
    - Protocol version: HTTP1
    - Health checks: HTTP
    - Health check path: /
    - Click on Next
    - Click on Create target group
- NOTE: Navigate back to the page where you're creating the LoadBalancer and Refresh (Not The Whole Page)
- Listeners and routing:
  - Protocol: HTTP
  - Listener HTTP:80
  - Select the Backend-LB-HTTP-TG
- Click on Create load balancer

STEP : Create an S3 Bucket Environment To Upload The Automation and Database Configs

Navigate to Amazon S3
Click on Create Bucket
- Name: Use naming convention prod-proxy-app-db-config-YOUR-LAST-NAME-and-DAY-OF-BIRTH
- AWS Region: Select your project region (California) us-west-1
- Object Ownership: ACLs disabled
- Block Public Access settings for this bucket: Enable Block all public access
- Bucket Versioning: Enable
- Default encryption: Enable
- Click CREATE BUCKET

STEP : Create a Bastion Host VM For Remote Access ((SSH)) To Webservers, Appservers and MySQL Database

Navigate to Instance in EC2
Click on Create Instance
- Name: Prod-Bastion-Host
- AMI: Ubuntu 18.04
- Instance type: t2.micro
- Key pair name: Select/Create Key pair
  - Name: Prod-"YOUR_REGION"-Key
- Network:
  - VPC: Prod-VPC
  - Subnet: Select either Prod-NAT-ALB-Subnet-1 or Prod-NAT-ALB-Subnet-2
  - Security Group: Select the Bastion-Host-Security-Group
- Click LAUNCH INSTANCE

Setup SSH Port Forwarding Between Your Local and Bastion Host To Point at The Web, App and DB Instance.

Create an AmazonS3ReadOnlyAccess For Your Web and App Servers

Navigate to IAM
Click on Roles and Create Role
- Select EC2
- Click on Next
- Permissions policies: Assign AmazonS3ReadOnlyAccess
- Click on Next
- Name: EC2-AmazonS3ReadOnlyAccess
- Click CREATE

STEP 7: Create Webservers and Apservers Launch Templates

Create Webserver Launch Template

Naviagte to EC2/Launch Configuration
- Click on Create Launch Configuration
- Switch by Clicking on Create launch template
  - Name: Prod-Webservers-LT
  - Template version description: Prod-Webservers-LT Version 1
  - AMI: Select for Ubuntu 18.04
  - Instance type: t2.micro
  - Key pair: Create a new key pair california-keypair
  - Network Settings:
    - Subnet: Select one of the Webserver subnets
    - Security groups (Firewalls): Select the Webservers-Security-Group
  - Expand Advance details
    - IAM instance profile: Select S3-AmazonS3ReadOnlyAccess IAM Role
    - NOTE: Make sure to update the LoadBalancer DNS INTERNAL_LOAD_BALANCER_DNS in https://github.com/awanmbandi/aws-real-world-projects/blob/main/webserver-reverse-proxy-config/000-default.conf before passing the below User Data
    - User data: provide the user data in https://github.com/awanmbandi/aws-real-world-projects/blob/main/webserver-reverse-proxy-config/web-automation.sh
    - NOTE: Update the webserver-reverse-proxy-config/000-default.conf on GitHub before passing User Data
    - Click on Create launch template

Create Appserver Launch Template

Naviagte to EC2/Launch Configuration
- Click on Create Launch Configuration
- Switch by Clicking on Create launch template
  - Name: Prod-Appservers-LT
  - Template version description: Prod-Appservers-LT Version 1
  - AMI: Select for Ubuntu 18.04
  - Instance type: t2.micro
  - Key pair: Create a new key pair california-keypair
  - Network Settings:
    - Subnet: Select one of the Appserver subnets
    - Security groups (Firewalls): Select the Appservers-Security-Group
  - Expand Advance details
    - IAM instance profile: Select S3-AmazonS3ReadOnlyAccess IAM Role
    - NOTE: Make sure to update the Database Configurations in https://github.com/awanmbandi/aws-real-world-projects/blob/main/appserver-database-config/wp-config.php with Yours, before passing the below User Data
    - User data: provide the user data in https://github.com/awanmbandi/aws-real-world-projects/blob/main/appserver-startup-script/app-automation.sh
    - NOTE: Update the Database Configuration file main/appserver-database-config/wp-config.php on GitHub before passing the User Data
    - Once changes have been made and user data passed
    - Click on Create launch template

STEP 8: Create Webserver and Appserver Auto Scaling Groups

A). Webserver Autocsaling Group

Navigate to EC2/Auto Scaling
- Click on Create Auto Scaling Group
  - Auto Scaling group name: prod-webservers-autoscaling-group
  - Launch template: Select the Prod-Webservers-LT
  - Click on NEXT
  - VPC: Select Prod-VPC
  - Availability Zones and subnets: Select Prod-Webserver-Subnet-1 and Prod-Webserver-Subnet-2
  - Click NEXT
  - Load balancing: Select "Attach to an existing load balancer", select Frontend-LB-HTTP-TG
    - Select Choose from your load balancer target groups
    - Existing load balancer target groups: Select the Frontend-LB-HTTP-TG
  - Health check type: Select EC2 and ELB
  - Click on NEXT
  - Group size:
    - Desired: 2
    - Min: 2
    - Max: 5
  - Scaling policies:
    - NOTE: Also Known as Dynamic Scaling. This defines the Scale Out Policy/Action
    - Select Target tracking scaling policy
      - Scaling policy name: prod-asg-scale-out-policy
      - Metric type: Select Average VPU Utilization
      - Target value: 80%
    - Click on NEXT
    - Click on NEXT
    - Click on NEXT
    - Click on Create Auto Scaling Group

B). Appserver Autocsaling Group

Navigate to EC2/Auto Scaling
- Click on Create Auto Scaling Group
  - Auto Scaling group name: prod-appservers-autoscaling-group
  - Launch template: Select the Prod-Appserver-LT
  - Click on NEXT
  - VPC: Select Prod-VPC
  - Availability Zones and subnets: Select Prod-Appserver-Subnet-1 and Prod-Appserver-Subnet-2
  - Click NEXT
  - Load balancing: Select "Attach to an existing load balancer", select Backend-LB-HTTP-TG
    - Select Choose from your load balancer target groups
    - Existing load balancer target groups: Select the Backend-LB-HTTP-TG
  - Health check type: Select EC2 and ELB
  - Click on NEXT
  - Group size:
    - Desired: 2
    - Min: 2
    - Max: 5
  - Scaling policies:
    - NOTE: Also Known as Dynamic Scaling. This defines the Scale Out Policy/Action
    - Select Target tracking scaling policy
      - Scaling policy name: prod-asg-scale-out-policy
      - Metric type: Select Average VPU Utilization
      - Target value: 80%
    - Click on NEXT
    - Click on NEXT
    - Click on NEXT
    - Click on Create Auto Scaling Group

STEP 9: Create a Database Subnet Group and Database Instance (RDS)

A) Create Databse Subnet Group

Navigate to the RDS Service
Click on Subnet groups
- Click Create DB Subnet Group
- Name: prod-db-subnet-group
- VPC: Select Prod-VPC
- Availability Zones: Select the two zones you used for this project. Example us-west-1a and us-west-1c
- Subnets: Select Prod-db-Subnet-1 and Prod-db-Subnet-2
- Click on CREATE

B) Create a Database Instance

Navigate to the RDS Service
Click on Databases and Create Database
- Choose a database creation method: Select Standard create
- Engine type: MySQL
- Engine Version: Select the latest
- Templates: Production
- Deployment options: Multi-AZ DB instance
- Databse Settings:
  - DB instance identifier: prod-database
  - Master username: admin
  - Master password: For example admin2022
  - NOTE: Password must be at least 8 characters, Can't contain / , ', " and @
  - DB instance class: Choose Burstable classes
    - Select db.t3.micro
- Storage:
  - Storage type: Select General Purpose SSD (gp3)
  - Allocated storage: 30
  - Storage autoscaling: Enable
  - Maximum storage threshold: Default 1000
- Connectivity:
  - Compute resource: Select Don’t connect to an EC2 compute resource
  - Virtual private cloud (VPC): Prod-VPC
  - DB Subnet group: Select your DB Subnet group prod-db-subnet-group
  - Public access: NO
    - NOTE: To remote Programatically manually, we'll have to setup a bastion host
  - Database authentication: Select Password authentication
- Monitoring:
  - Enhanced Monitoring: Disable
- Additional configuration:
  - Initial database name: proddatabase
  - Backup: Enable automated backups
  - Encryption: Enable encryption
  - Maintenance: Disable
  - Deletion protection: Disable
- Click CREATE DATABASE

vikoro178 / four-tier Goto Github PK

four-tier's Introduction

👨🏼‍💻 Deploying a 3 Tier H.A Web Application on AWS 👨🏼‍💻

STEP 1: Create The Base Networking Infrastructure For NAT/ELB, Webservers, Appservers and Database

A) Create The VPC Network

B) Create The NAT/AL Subnet 1 and 2

B) Create The Webserver Subnet 1 and 2

C) Create The Appserver Subnet 1 and 2

D) Create The Database Subnet 1 and 2

STEP 2: Create 2 Public Route Rable and 6 Private Route Tables (Because of NAT Redundancy Implementation)

A) NAT/ALB Public Subnet 1 Route Table

B) NAT/ALB Public Subnet 2 Route Table

C) Webserver Subnet 1 Route Table

D) Webserver Subnet 2 Route Table

E) Appserver Subnet 1 Table Table

F) Appserver Subnet 2 Table Table

G) Database Subnet 1 Route Table

H) Database Subnet 2 Route Table

STEP 3: Associate All Above Route Tables With Their Respective Subnets

STEP 4: Create and Configure IGW and NAT Gateways

A) Create and Configure IGW to Expose The NAT/ALB Subnet 1 and NAT/ALB Subnet 2

B) Create and Configure The NAT Gateways to point at the Web, App and Database Tiers/Subnets

C) Configure/Edit the Route Tables of Webserver subnets, Appserver subnets and Database subnets to Add the Nat gateway Configs

C.1) Update the Webserver subnet Route tables (2) with the following configs

C.2) Update the Appserver subnet Route tables (2) with the following configs

C.3) Update the Database subnet Route tables (2) with the following configs

STEP 5: Create Security Groups

Create the Bastion Host Security Group

Create the Frontend/External Load Balancer Security Group

Create the Webservers Security Group

Create the Backend/Internal Load Balancer Security Group

Create the Appservers Security Group

Create the Database Security Group

STEP 6: Create External/Frontend and Internal/Backend Load Balancers

Create External/Frontend Load Balancer

Create Internal/Backend Load Balancer

STEP : Create an S3 Bucket Environment To Upload The Automation and Database Configs

STEP : Create a Bastion Host VM For Remote Access ((SSH)) To Webservers, Appservers and MySQL Database

Setup SSH Port Forwarding Between Your Local and Bastion Host To Point at The Web, App and DB Instance.

Create an AmazonS3ReadOnlyAccess For Your Web and App Servers

STEP 7: Create Webservers and Apservers Launch Templates

Create Webserver Launch Template

Create Appserver Launch Template

STEP 8: Create Webserver and Appserver Auto Scaling Groups

A). Webserver Autocsaling Group

B). Appserver Autocsaling Group

STEP 9: Create a Database Subnet Group and Database Instance (RDS)

A) Create Databse Subnet Group

B) Create a Database Instance

STEP 10: Create a Route 53 Hosted Zone and Record For The Frontend Load Balancer Endpoint

four-tier's People

Contributors

Watchers

Recommend Projects

Recommend Topics

Recommend Org

A) Create and Configure IGW to Expose The `NAT/ALB Subnet 1` and `NAT/ALB Subnet 2`

C) Configure/Edit the Route Tables of `Webserver subnets`, `Appserver subnets` and `Database subnets` to Add the `Nat gateway` Configs

C.1) Update the `Webserver subnet` Route tables (2) with the following configs

C.2) Update the `Appserver subnet` Route tables (2) with the following configs

C.3) Update the `Database subnet` Route tables (2) with the following configs