> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ahmadraza.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise VPC

# 🌐 AWS VPC Architecture for Production EC2 App with CloudFront, WAF, and ALB

This document outlines a **production-ready AWS VPC network design** for deploying a secure, scalable application backend on **EC2** in the **ap-south-1 (Mumbai)** region. The stack includes:

* 🖥️ EC2 (Go Application)
* 🌐 ALB (Application Load Balancer)
* 🔐 WAF (Web Application Firewall)
* 🚀 CloudFront (Edge CDN)
* 🌉 NAT Gateways (1 per AZ)
* 📶 Public & Private Subnet Segmentation

***

## 📌 Key Architecture Objectives

* Multi-AZ fault tolerance
* Edge security with AWS WAF (via CloudFront)
* Secure, private EC2 backend
* Scalable, high-availability NAT
* Future-ready for RDS/ElastiCache deployments

***

## 📁 VPC Design Summary

| Component        | Count | Description                                   |
| ---------------- | ----- | --------------------------------------------- |
| VPC              | 1     | 10.0.0.0/16                                   |
| Subnets          | 9     | 3 AZs × (Public + Private App + Private Data) |
| NAT Gateways     | 3     | 1 per AZ for AZ-local egress routing          |
| Route Tables     | 5–6   | Split per subnet type and AZ                  |
| Internet Gateway | 1     | For public subnet internet access             |
| EC2              | N     | Go app, deployed in private app subnets       |
| ALB              | 1     | Public subnets, exposed via CloudFront        |
| CloudFront       | 1     | Global CDN + TLS offload                      |
| WAF              | 1     | Attached to CloudFront                        |

***

## 🧱 Subnet Layout

| Subnet Type   | ap-south-1a  | ap-south-1b  | ap-south-1c  |
| ------------- | ------------ | ------------ | ------------ |
| Public Subnet | 10.0.1.0/24  | 10.0.2.0/24  | 10.0.3.0/24  |
| Private App   | 10.0.11.0/24 | 10.0.12.0/24 | 10.0.13.0/24 |
| Private Data  | 10.0.21.0/24 | 10.0.22.0/24 | 10.0.23.0/24 |

***

## 🧭 Topology Diagram (Simplified)

```plaintext theme={null}
                     ┌─────────────────┐
                     │     Internet    │
                     └───────┬─────────┘
                             │
                     ┌───────▼─────────┐
                     │  Internet Gateway│
                     └───────┬─────────┘
                             │
             [ Clients / Browsers ]
                             │
                       ┌─────────────┐
                       │ CloudFront  │
                       │ + WAF       │
                       └────┬────────┘
                            │
                      ┌─────▼──────┐
                      │   ALB      │
                      └────┬───────┘
            ┌──────────────┼─────────────────┐
            │              │                 │
    ┌───────▼──────┐┌──────▼──────┐┌────────▼──────┐
    │ Private App  ││ Private App ││ Private App   │
    │ Subnet 1a    ││ Subnet 1b   ││ Subnet 1c     │
    └──────┬───────┘└──────┬──────┘└───────┬───────┘
           │               │               │
   ┌───────▼───────┐┌──────▼───────┐┌──────▼───────┐
   │ NAT Gateway   ││ NAT Gateway  ││ NAT Gateway  │
   │ (Public 1a)   ││ (Public 1b)  ││ (Public 1c)  │
   └───────────────┘└──────────────┘└──────────────┘
```

***

## 🔐 Security Considerations

* **WAF**: Deployed on CloudFront for global edge protection
* **SGs**: EC2 only accepts traffic from ALB SG
* **Public subnets**: Only ALB and NAT Gateways reside here
* **Private subnets**: EC2 and future data services (e.g., RDS)
* **No direct internet access to EC2**; only via NAT

***

## 🚦 Route Tables

| Route Table          | Routes                               |
| -------------------- | ------------------------------------ |
| Public RT            | `0.0.0.0/0 → Internet Gateway`       |
| Private App RT (x3)  | `0.0.0.0/0 → NAT Gateway (local AZ)` |
| Private Data RT (x3) | Local only (no internet)             |

***

## 🌍 DNS + TLS

* Route53 record `app.example.com` → CloudFront distribution
* ACM certificate in `us-east-1` for CloudFront (required)
* Optional TLS cert in ALB (for origin verification)

***

## 📦 Optional Modules for Extension

* 🔒 Bastion Host in Public Subnet for SSH (restricted by SG)
* 🛑 NACLs for enhanced subnet-level filtering
* 🧪 Flow Logs for auditing and compliance
* 📊 CloudWatch + VPC Flow Logs for visibility

***

## ✅ Deployment Notes

* Terraform modules highly recommended for reproducibility
* Place EC2 instances in private subnets across all 3 AZs
* Disable caching in CloudFront if backend is fully dynamic

***

## 📘 References

* [AWS VPC Best Practices](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html)
* [CloudFront and WAF Integration](https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html)
* [NAT Gateway Docs](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html)

***