Lab: Analysis and Design of EC2 Architecture
Lab Objectives
This lab is an exercise in design and analysis. You will:
- ✅ Analyze existing EC2 architectures
- ✅ Identify best practices and errors
- ✅ Design your own architecture
- ✅ Justify your technical choices
Theoretical Approach
This lab does not require AWS access. You will work on paper/document with diagrams and analyses.
Estimated Duration
2 hours
Part 1: Analysis of Existing Architecture
Scenario: E-Commerce Site
Here is the current architecture of an e-commerce site:
┌─────────────────────────────────────────────────────────────┐
│ REGION: us-east-1 │
├─────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ AZ: us-east-1a │ │
│ │ │ │
│ │ ┌─────────────────────────────────────────────┐ │ │
│ │ │ EC2 Instance: i-web001 │ │ │
│ │ │ Type: t2.micro │ │ │
│ │ │ AMI: Amazon Linux 2 │ │ │
│ │ │ Public IP: 52.1.2.3 │ │ │
│ │ │ │ │ │
│ │ │ Applications: │ │ │
│ │ │ - Apache (port 80) │ │ │
│ │ │ - MySQL (port 3306) │ │ │
│ │ │ - PHP Application │ │ │
│ │ │ │ │ │
│ │ │ Security Group: sg-default │ │ │
│ │ │ Rules: │ │ │
│ │ │ - Inbound: SSH (22) - 0.0.0.0/0 │ │ │
│ │ │ - Inbound: HTTP (80) - 0.0.0.0/0 │ │ │
│ │ │ - Inbound: MySQL (3306) - 0.0.0.0/0 │ │ │
│ │ │ │ │ │
│ │ │ Storage: 8 GB EBS (gp2) │ │ │
│ │ └─────────────────────────────────────────────┘ │ │
│ │ │ │
│ └─────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────┘
Analysis Questions
Question 1: Security Issues
Identify at least 3 security issues in this architecture.
💡 Hint
Look at:
- Security Group rules
- MySQL placement
- Single-instance architecture
Question 2: Availability Issues
Identify the availability risks of this architecture.
💡 Hint
Consider:
- Number of availability zones
- Single Point of Failure (SPOF)
- Scalability capacity
Question 3: Performance Issues
The site becomes slow during sales. What are the possible causes?
💡 Hint
Analyze:
- Instance type
- Component separation
- Storage
Part 2: Architecture Correction
Exercise: Propose a Better Architecture
Redesign the architecture by correcting the identified issues.
Constraints:
- Moderate budget (no giant instances)
- Site must be available 99.9%
- Database must be secure
- Must support traffic spikes (sales)
Response Template
Fill in this template:
PROPOSED NEW ARCHITECTURE
=========================
Region: _____________
Availability Zones used: ____________
COMPONENT 1: Web Server(s)
--------------------------
- Number of instances: _____
- Instance type: _____
- AMI: _____
- Placement: _____
- Security Group:
- Inbound: _____
- Outbound: _____
COMPONENT 2: Database
----------------------
- Service/Instance: _____
- Type: _____
- Placement: _____
- Security Group:
- Inbound: _____
COMPONENT 3: (Optional)
------------------------
- _____
JUSTIFICATIONS
--------------
1. Why this instance type? _____
2. Why this network configuration? _____
3. How do you manage high availability? _____
Part 3: Architecture Diagram
Exercise: Draw the Architecture
Create a professional architecture diagram including:
Mandatory elements:
- AWS region
- At least 2 availability zones
- EC2 instances (web)
- Separate database
- Security Groups with their rules
- Network connections
Suggested tools:
- Draw.io (free): https://app.diagrams.net/
- Lucidchart (limited free)
- PowerPoint/Google Slides
- Paper and pencil (photo to attach)
Example Structure
┌─────────────────────────────────────────────────────────────┐
│ REGION: __________ │
├─────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────────────────────────────────┐ │
│ │ [Your component] │ │
│ └──────────────────────────────────────┘ │
│ │
│ ┌───────────────────┐ ┌───────────────────┐ │
│ │ AZ: ____ │ │ AZ: ____ │ │
│ │ │ │ │ │
│ │ [Instances] │ │ [Instances] │ │
│ │ │ │ │ │
│ └───────────────────┘ └───────────────────┘ │
│ │
│ ┌──────────────────────────────────────┐ │
│ │ [Database] │ │
│ └──────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────┘
Part 4: Case Study - Instance Choices
Scenario A: Startup - MVP
Context:
- Simple web application (blog + contact form)
- 100 visitors/day expected
- Very limited budget (< $20/month)
- Team of 2 developers
Questions:
1. What instance type do you recommend?
2. Which region?
3. What compromises do you make?
Scenario B: SME - Business Application
Context:
- ERP/CRM for 50 employees
- PostgreSQL database (20 GB)
- Usage 8am-6pm, Monday-Friday
- Need for consistent performance
Questions:
1. What instance type for the application?
2. What instance type for the database?
3. Are Reserved instances needed?
Scenario C: E-Commerce - Black Friday
Context:
- Existing e-commerce site
- Normal traffic: 1000 visitors/hour
- Black Friday: 50000 visitors/hour (peak)
- Catalog of 10000 products
Questions:
1. How to handle the traffic peak?
2. What scaling strategy?
3. What types of instances for each load level?
Part 5: Summary Table of Choices
Complete this table for each scenario:
| Criterion | Scenario A | Scenario B | Scenario C |
|---|---|---|---|
| Web Instance | |||
| DB Instance | |||
| Pricing Model | |||
| Number of AZs | |||
| Estimated Cost/Month | |||
| Main Justification |
Lab Deliverables
Document to Submit
Create a document (Word, PDF, or Markdown) containing:
1. Title Page
- Name, date, lab title
2. Part 1: Analysis (20%)
- List of 3+ security issues
- List of availability risks
- Performance issues analysis
3. Part 2: Correction (25%)
- Filled template with new architecture
- Detailed justifications
4. Part 3: Diagram (25%)
- Clear and readable architecture diagram
- Component legend
- Documented Security Groups
5. Part 4: Case Studies (20%)
- Answers for the 3 scenarios
- Justifications for choices
6. Part 5: Table (10%)
- Completed summary table
Evaluation Grid
| Criterion | Points |
|---|---|
| Correct identification of issues | 4 |
| Coherent corrected architecture | 5 |
| Clear and complete diagram | 5 |
| Justified instance choices | 4 |
| Complete summary table | 2 |
| Total | 20 |
Correction - Part 1 (To consult after completing the exercise)
📋 See the correction
Security Issues
-
SSH open to everyone (0.0.0.0/0)
- Risk: Brute-force attacks
- Solution: Restrict to admin's IP
-
MySQL publicly exposed (0.0.0.0/0)
- Risk: Unauthorized access to DB
- Solution: Close the port, internal access only
-
Everything on the same instance
- Risk: If the instance is compromised, everything is
- Solution: Separate web and DB
-
Using default SG
- Risk: Unaudited rules
- Solution: Create specific SGs
Availability Issues
-
Single AZ
- Risk: Zone failure = site down
- Solution: Multi-AZ
-
Single instance (SPOF)
- Risk: Instance failure = site down
- Solution: Multiple instances + Load Balancer
-
No visible backup
- Risk: Data loss
- Solution: EBS snapshots, RDS Multi-AZ
Performance Issues
-
t2.micro too small
- Burst credits exhausted quickly
- Solution: t3.small minimum for production
-
MySQL on the same instance
- Resource competition
- Solution: Dedicated instance or RDS
-
8 GB storage insufficient
- Solution: Larger EBS gp3
Lab Resources
AWS Icons
Documentation
Pricing Calculator
Congratulations! You have completed the EC2 architecture lab. These design skills are essential for any cloud architect.