​

🌐 AWS VPC Architecture for Production EC2 App with CloudFront, WAF, and ALB

• 🖥️ EC2 (Go Application)
• 🌐 ALB (Application Load Balancer)
• 🔐 WAF (Web Application Firewall)
• 🚀 CloudFront (Edge CDN)
• 🌉 NAT Gateways (1 per AZ)
• 📶 Public & Private Subnet Segmentation

​

📌 Key Architecture Objectives

• Multi-AZ fault tolerance
• Edge security with AWS WAF (via CloudFront)
• Secure, private EC2 backend
• Scalable, high-availability NAT
• Future-ready for RDS/ElastiCache deployments

​

📁 VPC Design Summary

​

🧱 Subnet Layout

​

🧭 Topology Diagram (Simplified)

                     ┌─────────────────┐
                     │     Internet    │
                     └───────┬─────────┘
                             │
                     ┌───────▼─────────┐
                     │  Internet Gateway│
                     └───────┬─────────┘
                             │
             [ Clients / Browsers ]
                             │
                       ┌─────────────┐
                       │ CloudFront  │
                       │ + WAF       │
                       └────┬────────┘
                            │
                      ┌─────▼──────┐
                      │   ALB      │
                      └────┬───────┘
            ┌──────────────┼─────────────────┐
            │              │                 │
    ┌───────▼──────┐┌──────▼──────┐┌────────▼──────┐
    │ Private App  ││ Private App ││ Private App   │
    │ Subnet 1a    ││ Subnet 1b   ││ Subnet 1c     │
    └──────┬───────┘└──────┬──────┘└───────┬───────┘
           │               │               │
   ┌───────▼───────┐┌──────▼───────┐┌──────▼───────┐
   │ NAT Gateway   ││ NAT Gateway  ││ NAT Gateway  │
   │ (Public 1a)   ││ (Public 1b)  ││ (Public 1c)  │
   └───────────────┘└──────────────┘└──────────────┘

​

🔐 Security Considerations

• WAF: Deployed on CloudFront for global edge protection
• SGs: EC2 only accepts traffic from ALB SG
• Public subnets: Only ALB and NAT Gateways reside here
• Private subnets: EC2 and future data services (e.g., RDS)
• No direct internet access to EC2; only via NAT

​

🚦 Route Tables

​

🌍 DNS + TLS

• Route53 record app.example.com → CloudFront distribution
• ACM certificate in us-east-1 for CloudFront (required)
• Optional TLS cert in ALB (for origin verification)

​

📦 Optional Modules for Extension

• 🔒 Bastion Host in Public Subnet for SSH (restricted by SG)
• 🛑 NACLs for enhanced subnet-level filtering
• 🧪 Flow Logs for auditing and compliance
• 📊 CloudWatch + VPC Flow Logs for visibility

​

✅ Deployment Notes

• Terraform modules highly recommended for reproducibility
• Place EC2 instances in private subnets across all 3 AZs
• Disable caching in CloudFront if backend is fully dynamic

​

📘 References

• AWS VPC Best Practices
• CloudFront and WAF Integration
• NAT Gateway Docs