Lab: Web Service Deployment
Lab Objective
In this lab, you will design and document the deployment of a complete web service on AWS. You will analyze different architecture options and produce a deployment plan.
Lab Format
This lab focuses on design and documentation. You will use CLI commands to simulate with LocalStack if available.
Context
You are tasked with deploying the BlogPro application, a blogging platform for businesses.
Functional Requirements
┌─────────────────────────────────────────────────────────────┐
│ BLOGPRO REQUIREMENTS │
├─────────────────────────────────────────────────────────────┤
│ │
│ APPLICATION │
│ • Website accessible via HTTPS │
│ • Backend API (Node.js or Python) │
│ • MySQL database │
│ • Image storage (S3) │
│ │
│ PERFORMANCE │
│ • Response time < 500ms │
│ • Support for 1000 concurrent users │
│ │
│ AVAILABILITY │
│ • 99.9% uptime (about 8h downtime/year max) │
│ • Zero downtime during deployments │
│ │
│ SECURITY │
│ • SSL/TLS certificate │
│ • Database not accessible from the Internet │
│ • Compliance with AWS best practices │
│ │
│ BUDGET │
│ • Around $200-300/month │
│ │
└─────────────────────────────────────────────────────────────┘
Part 1: Architecture Design
Exercise 1.1: Architecture Choice
Analyze the following three options and choose the best one for BlogPro:
Option A: Simple Architecture
Internet → IGW → EC2 (public) → RDS (private)
Option B: Architecture with ALB
Internet → IGW → ALB → EC2 (private) → RDS (private)
Option C: Serverless Architecture
Internet → CloudFront → API Gateway → Lambda → RDS/DynamoDB
Your analysis:
| Criterion | Option A | Option B | Option C |
|---|---|---|---|
| Estimated Cost | ? | ? | ? |
| High Availability | ? | ? | ? |
| Scalability | ? | ? | ? |
| Complexity | ? | ? | ? |
| Suitable for BlogPro? | ? | ? | ? |
💡 Suggested Solution
| Criterion | Option A | Option B | Option C |
|---|---|---|---|
| Estimated Cost | ~$50/month | ~$200/month | Variable |
| High Availability | ❌ No | ✅ Yes | ✅ Yes |
| Scalability | ❌ Limited | ✅ Good | ✅✅ Excellent |
| Complexity | ⭐ Simple | ⭐⭐ Medium | ⭐⭐⭐ Complex |
| Suitable for BlogPro? | ❌ | ✅ | ❌ (over-engineering) |
Recommendation: Option B
- Meets HA and performance requirements
- Cost within budget
- Reasonable complexity for the team
Exercise 1.2: Architecture Diagram
Draw the complete architecture with all components:
Template:
┌─────────────────────────────────────────────────────────────────────────┐
│ BLOGPRO ARCHITECTURE │
├─────────────────────────────────────────────────────────────────────────┤
│ │
│ INTERNET │
│ │ │
│ [Your diagram here] │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
└─────────────────────────────────────────────────────────────────────────┘
💡 Solution Diagram
┌─────────────────────────────────────────────────────────────────────────┐
│ BLOGPRO ARCHITECTURE │
├─────────────────────────────────────────────────────────────────────────┤
│ │
│ Users / Internet │
│ │ │
│ ▼ │
│ ┌─────────────────┐ │
│ │ Route 53 │ blog.example.com │
│ └────────┬────────┘ │
│ │ │
│ ┌────────▼────────┐ │
│ │ CloudFront │ CDN + SSL │
│ └────────┬────────┘ │
│ │ │
│ ┌─────────────────────────┼─────────────────────────────────┐ │
│ │ VPC │ (10.0.0.0/16) │ │
│ │ │ │ │
│ │ ┌──────────▼──────────┐ │ │
│ │ │ IGW │ │ │
│ │ └──────────┬──────────┘ │ │
│ │ │ │ │
│ │ ┌─────────────────────┼─────────────────────────┐ │ │
│ │ │ PUBLIC SUBNETS │ │ │ │
│ │ │ │ │ │ │
│ │ │ ┌─────────┐ ┌─────▼─────┐ ┌─────────┐ │ │ │
│ │ │ │ NAT GW │ │ ALB │ │ NAT GW │ │ │ │
│ │ │ │ 1a │ │ │ │ 1b │ │ │ │
│ │ │ └────┬────┘ └─────┬─────┘ └────┬────┘ │ │ │
│ │ └───────┼─────────────┼─────────────┼──────────┘ │ │
│ │ │ │ │ │ │
│ │ ┌───────┼─────────────┼─────────────┼──────────┐ │ │
│ │ │ PRIVATE SUBNETS │ │ │ │
│ │ │ │ ┌────┴────┐ │ │ │ │
│ │ │ ┌────────▼────┤ ├────▼────────┐ │ │ │
│ │ │ │ │ │ │ │ │ │
│ │ │ │ ┌───────┐ │ │ ┌───────┐ │ │ │ │
│ │ │ │ │ EC2 │ │ │ │ EC2 │ │ │ │ │
│ │ │ │ │ App 1 │ │ │ │ App 2 │ │ │ │ │
│ │ │ │ └───┬───┘ │ │ └───┬───┘ │ │ │ │
│ │ │ │ │ │ │ │ │ │ │ │
│ │ │ └──────┼──────┘ └──────┼──────┘ │ │ │
│ │ └─────────┼───────────────────────┼───────────┘ │ │
│ │ │ │ │ │
│ │ ┌─────────┼───────────────────────┼───────────┐ │ │
│ │ │ DB SUBNETS │ │ │ │
│ │ │ │ ┌──────────────────┘ │ │ │
│ │ │ │ │ │ │ │
│ │ │ ┌────▼────▼────┐ │ │ │
│ │ │ │ RDS │ │ │ │
│ │ │ │ Multi-AZ │ │ │ │
│ │ │ │ MySQL │ │ │ │
│ │ │ └──────────────┘ │ │ │
│ │ └─────────────────────────────────────────────┘ │ │
│ │ │ │
│ │ ┌─────────────────────────────────────────────┐ │ │
│ │ │ S3 Bucket │ │ │
│ │ │ (images/assets) │ │ │
│ │ └─────────────────────────────────────────────┘ │ │
│ │ │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │
└────────────────────────────────────────────────────────────────────────┘
Part 2: IP Addressing Plan
Exercise 2.1: Define the CIDRs
Complete the addressing plan:
| Resource | CIDR | Usable IPs | Usage |
|---|---|---|---|
| VPC | 10.0.0.0/16 | 65,531 | - |
| Public Subnet 1a | ? | ? | ALB, NAT |
| Public Subnet 1b | ? | ? | ALB, NAT |
| Private Subnet 1a | ? | ? | App servers |
| Private Subnet 1b | ? | ? | App servers |
| DB Subnet 1a | ? | ? | RDS |
| DB Subnet 1b | ? | ? | RDS |
💡 Solution
| Resource | CIDR | Usable IPs | Usage |
|---|---|---|---|
| VPC | 10.0.0.0/16 | 65,531 | - |
| Public Subnet 1a | 10.0.1.0/24 | 251 | ALB, NAT |
| Public Subnet 1b | 10.0.2.0/24 | 251 | ALB, NAT |
| Private Subnet 1a | 10.0.11.0/24 | 251 | App servers |
| Private Subnet 1b | 10.0.12.0/24 | 251 | App servers |
| DB Subnet 1a | 10.0.21.0/24 | 251 | RDS |
| DB Subnet 1b | 10.0.22.0/24 | 251 | RDS |
Part 3: Security Configuration
Exercise 3.1: Security Groups
Define the rules for each Security Group:
sg-alb:
Inbound:
- Type: ?, Port: ?, Source: ?
- Type: ?, Port: ?, Source: ?
Outbound:
- Type: ?, Port: ?, Destination: ?
sg-app:
Inbound:
- Type: ?, Port: ?, Source: ?
- Type: ?, Port: ?, Source: ?
Outbound:
- Type: ?, Port: ?, Destination: ?
- Type: ?, Port: ?, Destination: ?
sg-db:
Inbound:
- Type: ?, Port: ?, Source: ?
Outbound:
- Type: ?, Port: ?, Destination: ?
💡 Solution
sg-alb:
Inbound:
- Type: HTTPS, Port: 443, Source: 0.0.0.0/0
- Type: HTTP, Port: 80, Source: 0.0.0.0/0 (redirect to HTTPS)
Outbound:
- Type: HTTP, Port: 80, Destination: sg-app
sg-app:
Inbound:
- Type: HTTP, Port: 80, Source: sg-alb
- Type: SSH, Port: 22, Source: sg-bastion (or admin IP)
Outbound:
- Type: MySQL, Port: 3306, Destination: sg-db
- Type: HTTPS, Port: 443, Destination: 0.0.0.0/0 (APIs, updates)
sg-db:
Inbound:
- Type: MySQL, Port: 3306, Source: sg-app
Outbound:
- (No explicit rule needed - stateful)
Part 4: Validation Plan
Exercise 4.1: End-to-End Tests
List the tests to perform to validate the deployment:
| Test | Command/Action | Expected Result |
|---|---|---|
| DNS resolution | ? | ? |
| HTTPS accessible | ? | ? |
| Health check | ? | ? |
| DB connection | ? | ? |
| AZ failover | ? | ? |
💡 Solution
| Test | Command/Action | Expected Result |
|---|---|---|
| DNS resolution | nslookup blog.example.com | Returns ALB IP |
| HTTPS accessible | curl -I https://blog.example.com | HTTP 200 OK |
| Health check | curl https://blog.example.com/health | status: healthy |
| DB connection | Application log | Database connected |
| AZ failover | Stop AZ-a instance | Site still accessible |
| Load balancing | Multiple requests | Responses from both instances |
| SSL certificate | Browser check | Valid certificate |
Part 5: Documentation
Final Deliverable
Produce a document containing:
-
Architecture Diagram (with all components)
-
IP Addressing Table
-
Security Groups Matrix
-
Validation Test Plan
-
Cost Estimation:
| Service | Configuration | Monthly Cost |
|---|---|---|
| EC2 (x2) | t3.medium | ~$60 |
| RDS | db.t3.small Multi-AZ | ~$50 |
| ALB | + data transfer | ~$30 |
| NAT Gateway (x2) | + data | ~$70 |
| Route 53 | 1 hosted zone | ~$1 |
| Total | ~$211/month |
- Identified Risks and mitigations
Evaluation Criteria
| Criterion | Points |
|---|---|
| Correct and complete architecture | /25 |
| Consistent addressing plan | /15 |
| Well-configured Security Groups | /20 |
| Relevant validation tests | /15 |
| Realistic cost estimation | /10 |
| Quality of documentation | /15 |
| Total | /100 |
Bonus: Deployment Script
If you have access to LocalStack, test these commands:
#!/bin/bash
# deploy-blogpro.sh
ENDPOINT="--endpoint-url=http://localhost:4566"
# 1. Create the VPC
VPC_ID=$(aws $ENDPOINT ec2 create-vpc \
--cidr-block 10.0.0.0/16 \
--query 'Vpc.VpcId' --output text)
echo "VPC created: $VPC_ID"
# 2. Create public subnets
SUBNET_PUB_1A=$(aws $ENDPOINT ec2 create-subnet \
--vpc-id $VPC_ID \
--cidr-block 10.0.1.0/24 \
--availability-zone us-east-1a \
--query 'Subnet.SubnetId' --output text)
echo "Public subnet 1a: $SUBNET_PUB_1A"
# ... continue with other resources
Next section: Tests and Validation