Skip to main content

​
🌐 AWS VPC Architecture for Production EC2 App with CloudFront, WAF, and ALB

This document outlines a production-ready AWS VPC network design for deploying a secure, scalable application backend on EC2 in the ap-south-1 (Mumbai) region. The stack includes:
  • 🖥️ EC2 (Go Application)
  • 🌐 ALB (Application Load Balancer)
  • 🔐 WAF (Web Application Firewall)
  • 🚀 CloudFront (Edge CDN)
  • 🌉 NAT Gateways (1 per AZ)
  • 📶 Public & Private Subnet Segmentation

​
📌 Key Architecture Objectives

  • Multi-AZ fault tolerance
  • Edge security with AWS WAF (via CloudFront)
  • Secure, private EC2 backend
  • Scalable, high-availability NAT
  • Future-ready for RDS/ElastiCache deployments

​
📁 VPC Design Summary

ComponentCountDescription
VPC110.0.0.0/16
Subnets93 AZs × (Public + Private App + Private Data)
NAT Gateways31 per AZ for AZ-local egress routing
Route Tables5–6Split per subnet type and AZ
Internet Gateway1For public subnet internet access
EC2NGo app, deployed in private app subnets
ALB1Public subnets, exposed via CloudFront
CloudFront1Global CDN + TLS offload
WAF1Attached to CloudFront

​
🧱 Subnet Layout

Subnet Typeap-south-1aap-south-1bap-south-1c
Public Subnet10.0.1.0/2410.0.2.0/2410.0.3.0/24
Private App10.0.11.0/2410.0.12.0/2410.0.13.0/24
Private Data10.0.21.0/2410.0.22.0/2410.0.23.0/24

​
🧭 Topology Diagram (Simplified)

                     ┌─────────────────┐
                     │     Internet    │
                     └───────┬─────────┘
                             │
                     ┌───────▼─────────┐
                     │  Internet Gateway│
                     └───────┬─────────┘
                             │
             [ Clients / Browsers ]
                             │
                       ┌─────────────┐
                       │ CloudFront  │
                       │ + WAF       │
                       └────┬────────┘
                            │
                      ┌─────▼──────┐
                      │   ALB      │
                      └────┬───────┘
            ┌──────────────┼─────────────────┐
            │              │                 │
    ┌───────▼──────┐┌──────▼──────┐┌────────▼──────┐
    │ Private App  ││ Private App ││ Private App   │
    │ Subnet 1a    ││ Subnet 1b   ││ Subnet 1c     │
    └──────┬───────┘└──────┬──────┘└───────┬───────┘
           │               │               │
   ┌───────▼───────┐┌──────▼───────┐┌──────▼───────┐
   │ NAT Gateway   ││ NAT Gateway  ││ NAT Gateway  │
   │ (Public 1a)   ││ (Public 1b)  ││ (Public 1c)  │
   └───────────────┘└──────────────┘└──────────────┘

​
🔐 Security Considerations

  • WAF: Deployed on CloudFront for global edge protection
  • SGs: EC2 only accepts traffic from ALB SG
  • Public subnets: Only ALB and NAT Gateways reside here
  • Private subnets: EC2 and future data services (e.g., RDS)
  • No direct internet access to EC2; only via NAT

​
🚦 Route Tables

Route TableRoutes
Public RT0.0.0.0/0 → Internet Gateway
Private App RT (x3)0.0.0.0/0 → NAT Gateway (local AZ)
Private Data RT (x3)Local only (no internet)

​
🌍 DNS + TLS

  • Route53 record app.example.com → CloudFront distribution
  • ACM certificate in us-east-1 for CloudFront (required)
  • Optional TLS cert in ALB (for origin verification)

​
📦 Optional Modules for Extension

  • 🔒 Bastion Host in Public Subnet for SSH (restricted by SG)
  • 🛑 NACLs for enhanced subnet-level filtering
  • 🧪 Flow Logs for auditing and compliance
  • 📊 CloudWatch + VPC Flow Logs for visibility

​
✅ Deployment Notes

  • Terraform modules highly recommended for reproducibility
  • Place EC2 instances in private subnets across all 3 AZs
  • Disable caching in CloudFront if backend is fully dynamic

​
📘 References