🌐 AWS VPC Architecture for Production EC2 App with CloudFront, WAF, and ALB

This document outlines a production-ready AWS VPC network design for deploying a secure, scalable application backend on EC2 in the ap-south-1 (Mumbai) region. The stack includes:

🖥️ EC2 (Go Application)
🌐 ALB (Application Load Balancer)
🔐 WAF (Web Application Firewall)
🚀 CloudFront (Edge CDN)
🌉 NAT Gateways (1 per AZ)
📶 Public & Private Subnet Segmentation

📌 Key Architecture Objectives

Multi-AZ fault tolerance
Edge security with AWS WAF (via CloudFront)
Secure, private EC2 backend
Scalable, high-availability NAT
Future-ready for RDS/ElastiCache deployments

📁 VPC Design Summary

Component	Count	Description
VPC	1	10.0.0.0/16
Subnets	9	3 AZs × (Public + Private App + Private Data)
NAT Gateways	3	1 per AZ for AZ-local egress routing
Route Tables	5–6	Split per subnet type and AZ
Internet Gateway	1	For public subnet internet access
EC2	N	Go app, deployed in private app subnets
ALB	1	Public subnets, exposed via CloudFront
CloudFront	1	Global CDN + TLS offload
WAF	1	Attached to CloudFront

🧱 Subnet Layout

Subnet Type	ap-south-1a	ap-south-1b	ap-south-1c
Public Subnet	10.0.1.0/24	10.0.2.0/24	10.0.3.0/24
Private App	10.0.11.0/24	10.0.12.0/24	10.0.13.0/24
Private Data	10.0.21.0/24	10.0.22.0/24	10.0.23.0/24

🧭 Topology Diagram (Simplified)

                     ┌─────────────────┐
                     │     Internet    │
                     └───────┬─────────┘
                             │
                     ┌───────▼─────────┐
                     │  Internet Gateway│
                     └───────┬─────────┘
                             │
             [ Clients / Browsers ]
                             │
                       ┌─────────────┐
                       │ CloudFront  │
                       │ + WAF       │
                       └────┬────────┘
                            │
                      ┌─────▼──────┐
                      │   ALB      │
                      └────┬───────┘
            ┌──────────────┼─────────────────┐
            │              │                 │
    ┌───────▼──────┐┌──────▼──────┐┌────────▼──────┐
    │ Private App  ││ Private App ││ Private App   │
    │ Subnet 1a    ││ Subnet 1b   ││ Subnet 1c     │
    └──────┬───────┘└──────┬──────┘└───────┬───────┘
           │               │               │
   ┌───────▼───────┐┌──────▼───────┐┌──────▼───────┐
   │ NAT Gateway   ││ NAT Gateway  ││ NAT Gateway  │
   │ (Public 1a)   ││ (Public 1b)  ││ (Public 1c)  │
   └───────────────┘└──────────────┘└──────────────┘

🔐 Security Considerations

WAF: Deployed on CloudFront for global edge protection
SGs: EC2 only accepts traffic from ALB SG
Public subnets: Only ALB and NAT Gateways reside here
Private subnets: EC2 and future data services (e.g., RDS)
No direct internet access to EC2; only via NAT

🚦 Route Tables

Route Table	Routes
Public RT	`0.0.0.0/0 → Internet Gateway`
Private App RT (x3)	`0.0.0.0/0 → NAT Gateway (local AZ)`
Private Data RT (x3)	Local only (no internet)

🌍 DNS + TLS

Route53 record app.example.com → CloudFront distribution
ACM certificate in us-east-1 for CloudFront (required)
Optional TLS cert in ALB (for origin verification)

📦 Optional Modules for Extension

🔒 Bastion Host in Public Subnet for SSH (restricted by SG)
🛑 NACLs for enhanced subnet-level filtering
🧪 Flow Logs for auditing and compliance
📊 CloudWatch + VPC Flow Logs for visibility

✅ Deployment Notes

Terraform modules highly recommended for reproducibility
Place EC2 instances in private subnets across all 3 AZs
Disable caching in CloudFront if backend is fully dynamic

📘 References

Custom Vpc Az Key Vault