AWS · Application architecture
AWS architecture for a new application
Summary
A provider needed a test environment to deploy and validate a new application. Based on their requirements, I proposed the simplest option for this stage and we implemented it together, separating our infrastructure work from the application installation.
- My role
- Architecture proposal, diagrams and joint deployment.
- Status
- Test environment running and still under validation.
- Infrastructure
- ALB, Cognito, EC2, EBS and RDS MariaDB.
- Technical access
- SSH through AWS Systems Manager.
Starting point
The provider shared the technical requirements and several options for the test environment and a future production setup. We did not need a complex platform at this stage. First, we needed to deploy the application, protect access and validate it.
Because the application handles sensitive information, we needed to limit exposure and clearly separate user access from the provider's technical access.
Decisions
- A simple test architecture
- We agreed on an environment with ALB, Cognito, one EC2 instance and RDS MariaDB. Containers and CI/CD were left for a possible future phase.
- Cognito to protect the test environment
- The ALB uses Cognito to authenticate users before sending traffic to the application, keeping the test environment restricted to authorised users.
- Instance access through SSM
- We used SSH over SSM to avoid a VPN and prepare the move to a private instance behind the ALB.
- Separate responsibilities
- We deployed the infrastructure together. The provider installed the application and configured their part of the database.
My part
I reviewed the requirements, proposed the architecture from the available options and created diagrams for the test environment and the possible production setup.
I worked on the network, ALB, EC2, EBS, RDS, Cognito and SSM configuration. I also configured the Microsoft Entra ID enterprise application for SSO. The provider shared their metadata and certificates and configured their side of the application.
Validation and status
We checked connectivity, SSH access through the SSM tunnel, the MariaDB connection and the application authentication flow.
The test environment is running and validation is still in progress. The production architecture with containers, high availability and CI/CD remains a future proposal.
SSM access was validated, and I prepared tag-based controls so the same model can be used for future technical access.