Skip to content

Commit 1799248

Browse files
sebstosebsto
committed
simplify infrastructure architecture
1 parent 59052f3 commit 1799248

File tree

4 files changed

+131
-282
lines changed

4 files changed

+131
-282
lines changed

‎Examples/ServiceLifecycle/INFRASTRUCTURE.md

Lines changed: 114 additions & 143 deletions
Original file line numberDiff line numberDiff line change
@@ -1,154 +1,125 @@
1-
# Infrastructure Documentation
2-
3-
This document describes the AWS infrastructure defined in `template.yaml` for the ServiceLifecycle Lambda with PostgreSQL example.
4-
5-
## Architecture Overview
6-
7-
The infrastructure consists of a secure VPC setup with public and private subnets, a Lambda function in public subnets, and an RDS PostgreSQL database in private subnets. The architecture follows AWS best practices for security and connectivity.
8-
9-
```mermaid
10-
graph TD
11-
subgraph "AWS Cloud"
12-
subgraph "VPC (10.0.0.0/16)"
13-
subgraph "Public Subnets"
14-
Lambda["Lambda Function"]
15-
NAT["NAT Gateway"]
16-
IGW["Internet Gateway"]
17-
end
18-
19-
subgraph "Private Subnets"
20-
RDS["PostgreSQL RDS"]
21-
SSM1["SSM Endpoint"]
22-
SSM2["SSM Messages Endpoint"]
23-
SSM3["EC2 Messages Endpoint"]
24-
end
25-
26-
Lambda -- "Egress to DB (5432)" --> RDS
27-
Lambda -- "Egress to AWS APIs (443)" --> Internet
28-
29-
RDS -- "Ingress from Lambda (5432)" --> Lambda
30-
RDS -- "Ingress from SSM (5432)" --> SSM1
31-
32-
NAT -- "Outbound traffic" --> IGW
33-
IGW -- "Internet Access" --> Internet
34-
end
35-
36-
SecretsManager["Secrets Manager"]
37-
APIGateway["API Gateway"]
38-
EC2["Amazon EC2"]
39-
40-
APIGateway --> Lambda
41-
Lambda --> SecretsManager
42-
EC2 -- "Via SSM Endpoints" --> SSM1
43-
SSM1 --> RDS
44-
end
45-
46-
User["User"] --> APIGateway
47-
Admin["Admin"] --> EC2
48-
```
49-
50-
## Key Components
51-
52-
### Networking
53-
54-
1. **VPC**: A dedicated VPC with CIDR block `10.0.0.0/16`
55-
2. **Subnets**:
56-
- Public Subnets (10.0.1.0/24, 10.0.2.0/24): For Lambda and NAT Gateway
57-
- Private Subnets (10.0.3.0/24, 10.0.4.0/24): For RDS and VPC endpoints
58-
3. **Internet Gateway**: Provides internet access for public subnets
59-
4. **NAT Gateway**: Allows outbound internet access from private subnets
60-
5. **Route Tables**: Separate route tables for public and private subnets
61-
62-
### Security
63-
64-
1. **Security Groups**:
65-
- **Lambda Security Group**: Restricts outbound traffic to:
66-
- PostgreSQL (5432) within the VPC
67-
- HTTPS (443) to the internet
68-
- **Database Security Group**: Allows inbound PostgreSQL connections only from:
69-
- Lambda Security Group
70-
- SSM Endpoint Security Group
71-
- **SSM Endpoint Security Group**: Allows HTTPS inbound for SSM connections
72-
73-
2. **Encryption**:
74-
- RDS storage encryption enabled
75-
- SSL/TLS for database connections with certificate verification
76-
- Secrets Manager for secure credential storage
77-
78-
### Compute & Database
79-
80-
1. **Lambda Function**:
81-
- Runtime: provided.al2 (Swift)
82-
- Memory: 512MB
83-
- Timeout: 60 seconds
84-
- VPC integration with public subnets
85-
86-
2. **RDS PostgreSQL**:
87-
- Instance class: db.t3.micro
88-
- Engine version: 15.7
89-
- Storage: 20GB gp2
90-
- Placed in private subnets
91-
- Not publicly accessible
92-
93-
### Access & Management
94-
95-
1. **Secrets Manager**:
96-
- Stores database credentials
97-
- Auto-generates secure password
98-
- Referenced by Lambda and RDS
99-
100-
2. **VPC Endpoints**:
101-
- SSM Endpoint
102-
- SSM Messages Endpoint
103-
- EC2 Messages Endpoint
104-
- Enables CloudShell access to private resources
105-
106-
3. **Function URL**:
107-
- HTTP endpoint for invoking Lambda function
1+
# Infrastructure Architecture
2+
3+
This document describes the AWS infrastructure deployed by the ServiceLifecycle example's SAM template.
4+
5+
## Overview
6+
7+
The infrastructure consists of a secure VPC setup with public and private subnets, a PostgreSQL RDS instance in private subnets, and a Lambda function with VPC access. The architecture follows AWS best practices for security and network isolation.
8+
9+
## Network Architecture
10+
11+
### VPC Configuration
12+
- **VPC**: Custom VPC with CIDR block `10.0.0.0/16`
13+
- **DNS Support**: DNS hostnames and DNS resolution enabled
14+
15+
### Subnet Layout
16+
- **Public Subnets**:
17+
- Public Subnet 1: `10.0.1.0/24` (AZ 1)
18+
- Public Subnet 2: `10.0.2.0/24` (AZ 2)
19+
- Used for Lambda functions and NAT Gateway
20+
- Auto-assign public IP addresses enabled
21+
22+
- **Private Subnets**:
23+
- Private Subnet 1: `10.0.3.0/24` (AZ 1)
24+
- Private Subnet 2: `10.0.4.0/24` (AZ 2)
25+
- Used for RDS PostgreSQL database
26+
- No public IP addresses assigned
27+
28+
### Network Components
29+
- **Internet Gateway**: Provides internet access for public subnets
30+
- **NAT Gateway**: Deployed in Public Subnet 1, allows private subnets to access the internet
31+
- **Route Tables**:
32+
- Public Route Table: Routes traffic to the Internet Gateway
33+
- Private Route Table: Routes traffic through the NAT Gateway
34+
35+
## Security Groups
36+
37+
### Lambda Security Group
38+
- **Outbound Rules**:
39+
- PostgreSQL (5432): Restricted to VPC CIDR `10.0.0.0/16`
40+
- HTTPS (443): Open to `0.0.0.0/0` for AWS service access
41+
42+
### Database Security Group
43+
- **Inbound Rules**:
44+
- PostgreSQL (5432): Only allows connections from the Lambda Security Group
45+
46+
## Database Configuration
47+
48+
### PostgreSQL RDS Instance
49+
- **Instance Type**: `db.t3.micro` (cost-optimized)
50+
- **Engine**: PostgreSQL 15.7
51+
- **Storage**: 20GB GP2 (SSD)
52+
- **Network**: Deployed in private subnets with no public access
53+
- **Security**:
54+
- Storage encryption enabled
55+
- SSL/TLS connections supported
56+
- Credentials stored in AWS Secrets Manager
57+
- **High Availability**: Multi-AZ disabled (development configuration)
58+
- **Backup**: Automated backups disabled (development configuration)
59+
60+
### Database Subnet Group
61+
- Spans both private subnets for availability
62+
63+
## Lambda Function Configuration
64+
65+
### Service Lifecycle Lambda
66+
- **Runtime**: Custom runtime (provided.al2)
67+
- **Architecture**: ARM64
68+
- **Memory**: 512MB
69+
- **Timeout**: 60 seconds
70+
- **Network**: Deployed in public subnets with access to both internet and private resources
71+
- **Environment Variables**:
72+
- `LOG_LEVEL`: trace
73+
- `DB_HOST`: RDS endpoint address
74+
- `DB_USER`: Retrieved from Secrets Manager
75+
- `DB_PASSWORD`: Retrieved from Secrets Manager
76+
- `DB_NAME`: Database name from parameter
77+
78+
## API Gateway
79+
80+
- **Type**: HTTP API
81+
- **Integration**: Direct Lambda integration
82+
- **Authentication**: None (for demonstration purposes)
83+
84+
## Secrets Management
85+
86+
### Database Credentials
87+
- **Storage**: AWS Secrets Manager
88+
- **Secret Name**: `{StackName}-db-credentials`
89+
- **Content**:
90+
- Username: "postgres"
91+
- Password: Auto-generated 16-character password
92+
- Special characters excluded: `"@/\`
93+
94+
## SAM Outputs
95+
96+
The template provides several outputs to facilitate working with the deployed resources:
97+
98+
- **APIGatewayEndpoint**: URL to invoke the Lambda function
99+
- **DatabaseEndpoint**: Hostname for the PostgreSQL instance
100+
- **DatabasePort**: Port number for PostgreSQL (5432)
101+
- **DatabaseName**: Name of the created database
102+
- **DatabaseSecretArn**: ARN of the secret containing credentials
103+
- **DatabaseConnectionInstructions**: Instructions for retrieving connection details
104+
- **ConnectionDetails**: Consolidated connection information
108105

109106
## Security Considerations
110107

111-
1. **Network Isolation**: Database is in private subnets, not directly accessible from the internet
112-
2. **Least Privilege**: Security groups follow principle of least privilege
113-
3. **Encryption**: Data at rest is encrypted
114-
4. **Secure Credentials**: No hardcoded credentials, using Secrets Manager
115-
5. **SSL/TLS**: Database connections use SSL/TLS with certificate verification
108+
This infrastructure implements several security best practices:
116109

117-
## Accessing the Database
118-
119-
The database is in a private subnet and not directly accessible from the internet. To connect:
120-
121-
1. **From Lambda**: Direct connection through VPC networking
122-
2. **From Amazon EC2**: Through SSM VPC endpoints
123-
3. **From your local machine**: Options include:
124-
- SSH tunnel through a bastion host
125-
- AWS Session Manager port forwarding
126-
- AWS Cloud9 environment in the same VPC
127-
128-
## Deployment
129-
130-
Deploy this infrastructure using AWS SAM:
131-
132-
```bash
133-
sam deploy
134-
```
135-
136-
## Outputs
137-
138-
After deployment, the following information is available in CloudFormation outputs:
139-
140-
- API Gateway endpoint URL
141-
- Database endpoint hostname and port
142-
- Database name
143-
- Secret ARN for retrieving credentials
144-
- Connection instructions
110+
1. **Network Isolation**: Database is placed in private subnets with no direct internet access
111+
2. **Least Privilege**: Security groups restrict traffic to only necessary ports and sources
112+
3. **Encryption**: Database storage is encrypted at rest
113+
4. **Secure Credentials**: Database credentials are managed through AWS Secrets Manager
114+
5. **Secure Communication**: Lambda function connects to database over encrypted connections
145115

146116
## Cost Optimization
147117

148-
The template uses cost-effective resources:
149-
- db.t3.micro RDS instance (eligible for free tier)
118+
The template uses cost-effective resources suitable for development:
119+
120+
- `db.t3.micro` instance (eligible for free tier)
150121
- Minimal storage allocation (20GB)
151-
- Single-AZ deployment
122+
- No Multi-AZ deployment
152123
- No automated backups
153124

154125
For production workloads, consider adjusting these settings based on your requirements.

0 commit comments

Comments
 (0)