Modern cloud architectures often require keeping application workloads private while still making them accessible to end users over the internet. AWS provides a powerful combination of services to achieve this — running containers privately on ECS Fargate, fronting them with an internal Application Load Balancer, and exposing them securely through API Gateway using a VPC Link.
\nIn this blog, we will walk through deploying a Next.js React application as a private ECS Fargate task and exposing it to the internet via an AWS API Gateway HTTP API. All infrastructure is provisioned using Terraform, making it repeatable and easy to adapt to your own projects.
\nThe whole code for this solution is available on Github Here. If you want to follow along, this can be used to stand up your own infrastructure.
\nBy the end of this guide, you will have a fully working setup where a containerized React app runs in a private subnet with no public IP, yet is accessible via a clean API Gateway URL. Let’s get started!
\nBefore I start the walkthrough, there are some pre-requisites which are good to have if you want to follow along or want to try this on your own:
\nWith that out of the way, lets dive into the details.
\nAWS API Gateway is a fully managed service that allows you to create, publish, and manage APIs at any scale. It acts as a front door for applications to access backend services — whether those are Lambda functions, HTTP endpoints, or private VPC resources.
\nKey features of API Gateway:
\nA key feature we leverage in this post is VPC Link. By default, API Gateway can only reach publicly accessible endpoints. A VPC Link establishes a private connection between API Gateway and resources inside your VPC, so your ALB and ECS tasks never need to be exposed to the internet.
\nWith a VPC Link:
\nThis is the component that makes the “private ECS + public API Gateway” pattern possible.
\nAmazon ECS (Elastic Container Service) with the Fargate launch type lets you run containers without managing the underlying EC2 instances. You define the CPU, memory, and container image — AWS handles the rest.
\nKey benefits for this use case:
\nNow that we have covered the key services, let me walk through the high-level architecture of what we are building.
\nStep 2 — Apply the infrastructure
\nmake 2-deploy-infraThis runs terraform apply -auto-approve, which provisions all the resources in the correct dependency order. Terraform handles the sequencing — for example, it knows the ECS service depends on the ALB target group, which depends on the VPC, so it wires all of that up automatically.
Once the apply completes, note down the API Gateway endpoint URL from the Terraform outputs — you will need it for testing. You can also find it in the AWS Console under API Gateway → your API → Stages.
\nStep 3 — Build and push the container image
\nmake 2-1-build-appBefore ECS can run the app, the Docker image needs to be in ECR. This Makefile target takes care of the full flow in one command:
\naws ecr get-login-passwordlinux/amd64 (required for Fargate, important if you are on Apple Silicon)You can verify the image landed in ECR by checking the repository in the AWS Console under Elastic Container Registry.
\nStep 4 — Start the ECS service
\nThe ECS service is provisioned with desired_count = 0 so no tasks run before the image is available. Once the image is in ECR, bring the service up by setting the desired count to 1:
aws ecs update-service \\\n --cluster dev-app-cluster \\\n --service dev-app-svc \\\n --desired-count 1ECS will schedule a Fargate task in the private subnet, pull the image from ECR, and start the container. As the task comes up, it registers its private IP with the ALB target group. Once the ALB health check on port 3000 passes, the task is marked healthy and traffic will start flowing through.
\nYou can watch the task come up in the AWS Console under ECS → Clusters → dev-app-cluster → Tasks.
\nCloudWatch Logs
\nContainer output from the ECS task is streamed to CloudWatch under the log group /dev-app-svc-logs. This is where you would look to debug the app or confirm it is receiving requests.
With everything deployed and the ECS task healthy, it is time to verify the end-to-end flow works as expected. There are a few things worth testing here — not just that the app loads, but that the private networking is actually working the way it should.
\nStep 1 — Get the API Gateway URL
\nThe public entry point is the API Gateway endpoint URL. Grab it from the Terraform output after make 2-deploy-infra, or find it in the AWS Console under API Gateway → your API → Stages → $default.
It will look like:
\nhttps://<api-id>.execute-api.us-east-1.amazonaws.comStep 2 — Hit the endpoint
\nOpen the URL in a browser — you should see the Next.js app load. You can also test it from the terminal:
\ncurl -I https://<api-id>.execute-api.us-east-1.amazonaws.comA 200 OK response confirms the full request path is working — API Gateway received the request, forwarded it through the VPC Link to the internal ALB, and the ALB routed it to the ECS Fargate task.
Step 3 — Verify the private networking
\nThis is an important one. Navigate to the running ECS task in the Console under ECS → Clusters → dev-app-cluster → Tasks. Click into the task and confirm:
\nThis confirms the architecture is working as intended — the container is completely off the public internet.
\nStep 4 — Check the ALB target health
\nNavigate to EC2 → Load Balancers → dev-app-svc-lb → Target Groups → dev-app-svc-lb-tg. The registered target should show as healthy. If it shows unhealthy, the most common cause is the HOSTNAME=0.0.0.0 environment variable missing from the container — Next.js will only be listening on localhost and the health check on the container’s network interface will fail.
Once you are done testing, make sure to tear down the infrastructure to avoid unnecessary AWS charges. Resources like the NAT Gateway, ALB, and Fargate tasks accrue costs while running even if there is no traffic.
\nStep 1 — Destroy the infrastructure
\nmake 3-destroy-infraThis runs terraform destroy -auto-approve inside infrastructure/environments/dev. Terraform will remove all provisioned resources in the correct order — ECS service, API Gateway, VPC Link, ALB, NAT Gateway, subnets, and VPC. The ECR repository is also deleted since it was created with force_delete = true, which means Terraform can remove it even if it still contains images.
Once complete, verify in the AWS Console that the resources are gone — particularly the NAT Gateway and ALB, as these are the most common sources of unexpected charges if a destroy is incomplete.
\nStep 2 — Clean up local Docker images
\nmake 4-cleanThis removes the locally built Docker images that were created during the build step. It is a good habit to run this after a project teardown to keep your local Docker environment tidy, especially since the linux/amd64 image can be a few hundred MB.
In this post, we walked through deploying a Next.js React app as a private ECS Fargate workload and exposing it to the internet through AWS API Gateway — without ever putting the application itself on the public internet. The key pieces that make this pattern work are the internal ALB sitting in the private subnet, and the VPC Link that bridges API Gateway into the VPC to reach it.
\nEverything was provisioned with Terraform, split across three focused modules — networking, compute, and security — making it straightforward to understand, modify, and extend. The Makefile ties the deployment workflow together into a handful of commands.
\nThis pattern is a solid foundation for any containerized web application that needs to stay private while remaining publicly accessible. It is easy to build on — you can swap the Next.js app for any other containerized service, add a custom domain with Route 53 and ACM, or layer on API Gateway features like throttling and authorization as your requirements grow.
\nThe full code is available on Github Here.
","htmlAst":{"type":"root","children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Modern cloud architectures often require keeping application workloads private while still making them accessible to end users over the internet. AWS provides a powerful combination of services to achieve this — running containers privately on ECS Fargate, fronting them with an internal Application Load Balancer, and exposing them securely through API Gateway using a VPC Link."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"In this blog, we will walk through deploying a Next.js React application as a private ECS Fargate task and exposing it to the internet via an AWS API Gateway HTTP API. All infrastructure is provisioned using Terraform, making it repeatable and easy to adapt to your own projects."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The whole code for this solution is available on Github "},{"type":"element","tagName":"a","properties":{"href":"https://github.com/amlana21/react-apigw-publish","target":"_blank"},"children":[{"type":"text","value":"Here"}]},{"type":"text","value":". If you want to follow along, this can be used to stand up your own infrastructure."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"By the end of this guide, you will have a fully working setup where a containerized React app runs in a private subnet with no public IP, yet is accessible via a clean API Gateway URL. Let’s get started!"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"Pre Requisites"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Before I start the walkthrough, there are some pre-requisites which are good to have if you want to follow along or want to try this on your own:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"ul","properties":{},"children":[{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"Basic AWS knowledge"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"An AWS account"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"AWS CLI installed and configured with appropriate permissions"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"Terraform installed (>= 1.14.0)"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"Docker installed locally"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"Basic knowledge of React / Next.js"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"Familiarity with ECS and API Gateway concepts"}]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"With that out of the way, lets dive into the details."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"What is API Gateway and how does VPC Link work?"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"AWS API Gateway is a fully managed service that allows you to create, publish, and manage APIs at any scale. It acts as a front door for applications to access backend services — whether those are Lambda functions, HTTP endpoints, or private VPC resources."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Key features of API Gateway:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"ul","properties":{},"children":[{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"HTTP APIs and REST APIs"}]},{"type":"text","value":" — HTTP APIs are lighter weight and lower cost, ideal for proxying to backend services"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"VPC Link support"}]},{"type":"text","value":" — enables private integration with resources inside a VPC without exposing them to the internet"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Auto-deploy stages"}]},{"type":"text","value":" — changes can be automatically deployed to a stage without manual promotion"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Built-in throttling and security"}]},{"type":"text","value":" — rate limiting, API keys, and IAM authorization options out of the box"}]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"A key feature we leverage in this post is "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"VPC Link"}]},{"type":"text","value":". By default, API Gateway can only reach publicly accessible endpoints. A VPC Link establishes a private connection between API Gateway and resources inside your VPC, so your ALB and ECS tasks never need to be exposed to the internet."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"With a VPC Link:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"ul","properties":{},"children":[{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"Your ALB and ECS tasks can stay in "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"private subnets"}]},{"type":"text","value":" with no internet exposure"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"Traffic from API Gateway flows privately through AWS’s internal network"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"No need to open inbound internet access on your security groups for the application tier"}]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"This is the component that makes the “private ECS + public API Gateway” pattern possible."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"What is ECS Fargate?"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Amazon ECS (Elastic Container Service) with the Fargate launch type lets you run containers without managing the underlying EC2 instances. You define the CPU, memory, and container image — AWS handles the rest."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Key benefits for this use case:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"ul","properties":{},"children":[{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Serverless containers"}]},{"type":"text","value":" — no EC2 fleet to patch or scale"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Private networking"}]},{"type":"text","value":" — tasks can run in private subnets with no public IP"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Pay per use"}]},{"type":"text","value":" — billed only for the vCPU and memory consumed while the task is running"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Easy integration with ALB"}]},{"type":"text","value":" — task IPs register directly as ALB targets"}]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"Architecture Overview"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Now that we have covered the key services, let me walk through the high-level architecture of what we are building."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-wrapper"],"style":"position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1170px;"},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"a","properties":{"className":["gatsby-resp-image-link"],"href":"/static/43fcec4b437ad7eac2a7365d74272f1d/6924e/architecture.png","style":"display: block","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-background-image"],"style":"padding-bottom: 51.716961498439126%; position: relative; bottom: 0; left: 0; background-image: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAIAAAA7N+mxAAAACXBIWXMAAAsSAAALEgHS3X78AAABkUlEQVQoz3WRu24VMRCGz1PxQLQIiY4qb4AURAWipEgqGlJEoJSQBnGIuIiAQs7RLru+e3ftsdd3vDlE4SJGo9HvX/ONxvaqXEfKOaTrrLqUm+NVxlzib2aMYVWxfAUbH4n2FDw1iQrG8CWFcJMm4kagDati54SU/oGVZaV0x/vk4S0G8zKomtqzWM7vPf1y5wl1+f9w7XOl/Xq2efMcK4u1JxBqZXO6OHl/8WpdxbId+L9hrKpbR8zEAJsdlrSmUIJOvFO8jxolwGZARmJQIeY/YO4inyMBN4+sDCQL5ig33Co5YcvBYmMRsZJ6Scy0wCklykRMgY/24EG3PgVZzOlRc7TfJiFtu+GHd+XH485OU4eAEKTZ2ae+5WPMeWXnedv8AGOoNI/uf3h9wsdiXx6eP9v77Cmfvn/bPr7N370gXrPLVjaoV/TtetvwYYFzrh+Yd2s3UmHtCPhh4nogSrJR8L6nlAtsB6Z7rlEVzUQQjL/uvAsfkwnJ+AQuahe039VgQqxPC4tO1awCaq3dOf8EQnExAooA/AUAAAAASUVORK5CYII='); background-size: cover; display: block;"},"children":[]},{"type":"text","value":"\n "},{"type":"element","tagName":"img","properties":{"className":["gatsby-resp-image-image"],"alt":"Architecture Diagram","title":"Architecture Diagram","src":"/static/43fcec4b437ad7eac2a7365d74272f1d/913fc/architecture.png","srcSet":["/static/43fcec4b437ad7eac2a7365d74272f1d/bc34b/architecture.png 293w","/static/43fcec4b437ad7eac2a7365d74272f1d/da9f0/architecture.png 585w","/static/43fcec4b437ad7eac2a7365d74272f1d/913fc/architecture.png 1170w","/static/43fcec4b437ad7eac2a7365d74272f1d/efb0c/architecture.png 1755w","/static/43fcec4b437ad7eac2a7365d74272f1d/6924e/architecture.png 1922w"],"sizes":["(max-width:","1170px)","100vw,","1170px"]},"children":[]},{"type":"text","value":"\n "}]},{"type":"text","value":"\n "}]},{"type":"text","value":" "},{"type":"element","tagName":"br","properties":{},"children":[]},{"type":"text","value":" "}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The architecture is built around a single VPC that is split into two tiers — a "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"public tier"}]},{"type":"text","value":" and a "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"private tier"}]},{"type":"text","value":" — each serving a distinct role."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h3","properties":{},"children":[{"type":"text","value":"Public Tier"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The public subnets contain the components that need outbound internet access. A "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"NAT Gateway"}]},{"type":"text","value":" sits here, allowing resources in the private subnets to make outbound calls (for example, pulling container images or reaching AWS service endpoints) without being directly reachable from the internet. An "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Internet Gateway"}]},{"type":"text","value":" is attached to the VPC to facilitate this outbound traffic."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Importantly, there is no application workload in the public tier. Nothing serving the React app is exposed here."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h3","properties":{},"children":[{"type":"text","value":"Private Tier"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The private subnets are where all the application workload lives. Two key resources sit here:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"ul","properties":{},"children":[{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Internal Application Load Balancer (ALB)"}]},{"type":"text","value":" — this ALB has no public-facing DNS. It is only reachable from within the VPC or via an API Gateway VPC Link. It listens for incoming HTTP traffic and forwards it to the ECS tasks registered in its target group."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"ECS Fargate Tasks"}]},{"type":"text","value":" — the containerized React app runs here. Each task gets a private IP address only, with no public IP assigned. The container listens on port 3000 and registers itself with the ALB target group automatically when the service starts."}]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h3","properties":{},"children":[{"type":"text","value":"API Gateway and VPC Link"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Sitting outside the VPC entirely, the "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"API Gateway HTTP API"}]},{"type":"text","value":" is the only public entry point. It exposes a URL to the internet and is configured with two routes — "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"ANY /"}]},{"type":"text","value":" and "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"ANY /{proxy+}"}]},{"type":"text","value":" — so all paths are forwarded to the backend."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The API Gateway is connected to the internal ALB through a "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"VPC Link"}]},{"type":"text","value":". The VPC Link is what bridges the gap between API Gateway (which lives outside the VPC) and the internal ALB (which lives inside). AWS handles the private network plumbing behind the scenes — from the user’s perspective, they hit the API Gateway URL and the request lands on the React app."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h3","properties":{},"children":[{"type":"text","value":"Container Registry"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Before the ECS task can run, the Docker image for the React app needs to be stored somewhere AWS can pull it from. An "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Amazon ECR (Elastic Container Registry)"}]},{"type":"text","value":" repository holds the built image. When ECS starts a new task, it pulls the image from ECR over the private network using the NAT Gateway for the initial pull — no public image registry required."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h3","properties":{},"children":[{"type":"text","value":"Logging"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"All container output from the ECS tasks is streamed to "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Amazon CloudWatch Logs"}]},{"type":"text","value":". This gives a central place to debug the application without needing to SSH into any servers (there are none with Fargate)."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h3","properties":{},"children":[{"type":"text","value":"Request Flow"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Putting it all together, here is the end-to-end flow when a user opens the React app:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"ol","properties":{},"children":[{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"User sends a request to the "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"API Gateway"}]},{"type":"text","value":" endpoint URL"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"API Gateway matches the route and forwards the request via the "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"VPC Link"}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"The VPC Link delivers the request to the "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"internal ALB"}]},{"type":"text","value":" inside the private subnet"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"The ALB selects a healthy "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"ECS Fargate task"}]},{"type":"text","value":" from its target group and forwards the request"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"The Next.js app running in the container handles the request and sends back a response"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"The response travels back through ALB → VPC Link → API Gateway → user"}]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"At no point does any internet traffic touch the ECS task directly. The only publicly addressable component is the API Gateway endpoint."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"Infrastructure Walkthrough"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Now let’s walk through the Terraform code that provisions all of this. The infrastructure is organized into three modules: "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"networking"}]},{"type":"text","value":", "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"compute"}]},{"type":"text","value":", and "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"security"}]},{"type":"text","value":". All of this lives under "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"infrastructure/"}]},{"type":"text","value":", with a "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"dev"}]},{"type":"text","value":" environment wiring the modules together in "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"environments/dev/main.tf"}]},{"type":"text","value":"."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h3","properties":{},"children":[{"type":"text","value":"Networking Module"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"This is the foundation of the whole setup. It provisions the VPC, public and private subnets across availability zones, an Internet Gateway, a NAT Gateway (so private resources can reach the internet for things like pulling images without being publicly reachable), and the route tables to wire everything together."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Two security groups are defined here:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"ul","properties":{},"children":[{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"web_sg"}]},{"type":"text","value":" — attached to the ALB, allows inbound HTTP/HTTPS from the internet"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"app_sg"}]},{"type":"text","value":" — attached to ECS tasks, allows inbound traffic only from "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"web_sg"}]},{"type":"text","value":" on port 3000"}]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"This enforces a clean two-tier boundary — no internet traffic can reach the ECS tasks directly."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The most important resource in this module is the "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"internal ALB"}]},{"type":"text","value":". Setting "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"internal = true"}]},{"type":"text","value":" is what keeps it off the public internet — it has no public DNS and is only reachable from within the VPC or via the API Gateway VPC Link."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"div","properties":{"className":["gatsby-highlight"],"dataLanguage":"hcl"},"children":[{"type":"element","tagName":"pre","properties":{"className":["language-hcl"]},"children":[{"type":"element","tagName":"code","properties":{"className":["language-hcl"]},"children":[{"type":"element","tagName":"span","properties":{"className":["token","keyword"]},"children":[{"type":"text","value":"resource "},{"type":"element","tagName":"span","properties":{"className":["token","type","variable"]},"children":[{"type":"text","value":"\"aws_lb\""}]}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","string"]},"children":[{"type":"text","value":"\"app_svc_lb\""}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"{"}]},{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["token","property"]},"children":[{"type":"text","value":"name"}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"="}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","string"]},"children":[{"type":"text","value":"\""},{"type":"element","tagName":"span","properties":{"className":["token","interpolation"]},"children":[{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"$"}]},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"{"}]},{"type":"element","tagName":"span","properties":{"className":["token","keyword"]},"children":[{"type":"text","value":"var"}]},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"."}]},{"type":"element","tagName":"span","properties":{"className":["token","type","variable"]},"children":[{"type":"text","value":"environment_val"}]},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"}"}]}]},{"type":"text","value":"-app-svc-lb\""}]},{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["token","property"]},"children":[{"type":"text","value":"internal"}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"="}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","boolean"]},"children":[{"type":"text","value":"true"}]},{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["token","property"]},"children":[{"type":"text","value":"load_balancer_type"}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"="}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","string"]},"children":[{"type":"text","value":"\"application\""}]},{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["token","property"]},"children":[{"type":"text","value":"security_groups"}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"="}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"["}]},{"type":"text","value":"aws_security_group.web_sg.id"},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"]"}]},{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["token","property"]},"children":[{"type":"text","value":"subnets"}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"="}]},{"type":"text","value":" aws_subnet.app_private"},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"["}]},{"type":"text","value":"*"},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"]"}]},{"type":"text","value":".id\n"},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"}"}]}]}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The ALB target group uses "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"target_type = \"ip\""}]},{"type":"text","value":", which is required for Fargate — there are no EC2 instances to register, so Fargate registers each task’s private IP directly."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h3","properties":{},"children":[{"type":"text","value":"Compute Module"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"This module provisions everything needed to run the app and expose it. It covers four things:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"ECR"}]},{"type":"text","value":" — a private container registry to store the Docker image. ECS pulls from here when starting new tasks."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"ECS cluster and task definition"}]},{"type":"text","value":" — the task definition is where the container is configured: the ECR image URL, CPU (512) and memory (1024 MB), port 3000, and CloudWatch log shipping. The cluster itself is just a logical grouping."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"ECS service"}]},{"type":"text","value":" — runs the Fargate tasks in the private subnets. The key setting here is "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"assign_public_ip = false"}]},{"type":"text","value":", which ensures tasks never get a public IP. The service also registers tasks with the ALB target group automatically as they start up."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"API Gateway + VPC Link"}]},{"type":"text","value":" — this is the piece that makes the private app accessible from the internet. A VPC Link bridges API Gateway (which lives outside the VPC) to the internal ALB. An HTTP API is created with an "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"HTTP_PROXY"}]},{"type":"text","value":" integration pointing at the ALB listener, and two routes ("},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"ANY /"}]},{"type":"text","value":" and "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"ANY /{proxy+}"}]},{"type":"text","value":") forward all traffic through."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"div","properties":{"className":["gatsby-highlight"],"dataLanguage":"hcl"},"children":[{"type":"element","tagName":"pre","properties":{"className":["language-hcl"]},"children":[{"type":"element","tagName":"code","properties":{"className":["language-hcl"]},"children":[{"type":"element","tagName":"span","properties":{"className":["token","keyword"]},"children":[{"type":"text","value":"resource "},{"type":"element","tagName":"span","properties":{"className":["token","type","variable"]},"children":[{"type":"text","value":"\"aws_apigatewayv2_integration\""}]}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","string"]},"children":[{"type":"text","value":"\"app_alb_integration\""}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"{"}]},{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["token","property"]},"children":[{"type":"text","value":"api_id"}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"="}]},{"type":"text","value":" aws_apigatewayv"},{"type":"element","tagName":"span","properties":{"className":["token","number"]},"children":[{"type":"text","value":"2"}]},{"type":"text","value":"_api.app_api.id\n "},{"type":"element","tagName":"span","properties":{"className":["token","property"]},"children":[{"type":"text","value":"integration_type"}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"="}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","string"]},"children":[{"type":"text","value":"\"HTTP_PROXY\""}]},{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["token","property"]},"children":[{"type":"text","value":"integration_method"}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"="}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","string"]},"children":[{"type":"text","value":"\"ANY\""}]},{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["token","property"]},"children":[{"type":"text","value":"integration_uri"}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"="}]},{"type":"text","value":" var.app_svc_alb_listener_arn\n "},{"type":"element","tagName":"span","properties":{"className":["token","property"]},"children":[{"type":"text","value":"connection_type"}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"="}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","string"]},"children":[{"type":"text","value":"\"VPC_LINK\""}]},{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["token","property"]},"children":[{"type":"text","value":"connection_id"}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"="}]},{"type":"text","value":" aws_apigatewayv"},{"type":"element","tagName":"span","properties":{"className":["token","number"]},"children":[{"type":"text","value":"2"}]},{"type":"text","value":"_vpc_link.app_vpc_link.id\n"},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"}"}]}]}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The stage is set to "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"$default"}]},{"type":"text","value":" with "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"auto_deploy = true"}]},{"type":"text","value":", so changes go live immediately without a manual deploy step."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h3","properties":{},"children":[{"type":"text","value":"Security Module"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"This module defines the IAM role used by ECS as both the execution role and the task role. The execution role lets ECS pull images from ECR and write logs to CloudWatch. The task role is what the running container itself uses to interact with AWS services."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The core permission is the "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"AmazonECSTaskExecutionRolePolicy"}]},{"type":"text","value":" managed policy. Additional policies for CloudWatch Agent and X-Ray are also attached to support observability."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"Application Walkthrough"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The application is a standard Next.js app. The main page lives in "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"app/page.tsx"}]},{"type":"text","value":" — for this post it is a simple scaffold, but the infrastructure pattern works the same regardless of what the app actually does. The focus here is on how it gets packaged and run inside a container."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h3","properties":{},"children":[{"type":"text","value":"Dockerfile"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The Dockerfile uses a "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"multi-stage build"}]},{"type":"text","value":" to keep the final image small. The three stages are:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"ul","properties":{},"children":[{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"deps"}]},{"type":"text","value":" — installs dependencies using "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"npm ci"}]},{"type":"text","value":" for a clean, reproducible install from "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"package-lock.json"}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"builder"}]},{"type":"text","value":" — copies the source and runs "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"npm run build"}]},{"type":"text","value":" to produce the Next.js production output"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"runner"}]},{"type":"text","value":" — the final image. Only the compiled output and necessary files are copied over from the builder, leaving the build toolchain behind"}]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"A few things in the runner stage are worth calling out. A non-root "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"nextjs"}]},{"type":"text","value":" system user is created and used to run the app — a standard security practice for containerized workloads. And "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"HOSTNAME"}]},{"type":"text","value":" is explicitly set to "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"0.0.0.0"}]},{"type":"text","value":":"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"div","properties":{"className":["gatsby-highlight"],"dataLanguage":"dockerfile"},"children":[{"type":"element","tagName":"pre","properties":{"className":["language-dockerfile"]},"children":[{"type":"element","tagName":"code","properties":{"className":["language-dockerfile"]},"children":[{"type":"element","tagName":"span","properties":{"className":["token","keyword"]},"children":[{"type":"text","value":"ENV"}]},{"type":"text","value":" PORT=3000\n"},{"type":"element","tagName":"span","properties":{"className":["token","keyword"]},"children":[{"type":"text","value":"ENV"}]},{"type":"text","value":" HOSTNAME=0.0.0.0\n"},{"type":"element","tagName":"span","properties":{"className":["token","keyword"]},"children":[{"type":"text","value":"CMD"}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"["}]},{"type":"element","tagName":"span","properties":{"className":["token","string"]},"children":[{"type":"text","value":"\"npm\""}]},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":","}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","string"]},"children":[{"type":"text","value":"\"start\""}]},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"]"}]}]}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"This is important. By default Next.js binds only to "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"localhost"}]},{"type":"text","value":", which means ALB health checks — which arrive on the container’s network interface — would fail. Setting "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"HOSTNAME=0.0.0.0"}]},{"type":"text","value":" tells Next.js to listen on all interfaces, making the container reachable from the ALB."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"One other thing to keep in mind when building locally on Apple Silicon: the image needs to be built for "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"linux/amd64"}]},{"type":"text","value":" since that is what ECS Fargate runs on. The Makefile handles this with the "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"--platform linux/amd64"}]},{"type":"text","value":" flag."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"Deploying the Solution"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"With the code in place, deploying the full solution involves two phases: provisioning the infrastructure and then building and pushing the container image. A "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"Makefile"}]},{"type":"text","value":" wraps both phases into numbered targets."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h3","properties":{},"children":[{"type":"text","value":"Folder Structure"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Before deploying, it helps to understand how the repo is laid out:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"div","properties":{"className":["gatsby-highlight"],"dataLanguage":"text"},"children":[{"type":"element","tagName":"pre","properties":{"className":["language-text"]},"children":[{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":".\n├── Makefile # top-level commands for deploying infra and building the app\n├── infrastructure/\n│ ├── environments/\n│ │ └── dev/ # the dev environment — Terraform is run from here\n│ │ ├── locals.tf # defines environment name, region, and naming conventions\n│ │ ├── main.tf # wires the three modules together and passes variables between them\n│ │ └── provider.tf # AWS provider configuration\n│ └── modules/\n│ ├── networking/ # VPC, public/private subnets, NAT Gateway, internal ALB, security groups\n│ ├── compute/ # ECR repository, ECS cluster, task definition, ECS service, API Gateway, VPC Link\n│ └── security/ # IAM task execution role and the policies attached to it\n└── src/\n └── api-app/ # the Next.js application\n ├── app/ # Next.js app directory — pages and layouts live here\n │ ├── layout.tsx # root layout wrapping all pages\n │ └── page.tsx # home page\n ├── Dockerfile # multi-stage build for the production container image\n └── package.json # app dependencies and build scripts"}]}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"infrastructure/environments/dev"}]},{"type":"text","value":" directory is where Terraform commands are run from. The modules under "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"infrastructure/modules"}]},{"type":"text","value":" are reusable and environment-agnostic — the "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"dev"}]},{"type":"text","value":" environment passes in the values via variables."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h3","properties":{},"children":[{"type":"text","value":"Lets Deploy!!"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Step 1 — Plan the infrastructure"}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"div","properties":{"className":["gatsby-highlight"],"dataLanguage":"bash"},"children":[{"type":"element","tagName":"pre","properties":{"className":["language-bash"]},"children":[{"type":"element","tagName":"code","properties":{"className":["language-bash"]},"children":[{"type":"element","tagName":"span","properties":{"className":["token","function"]},"children":[{"type":"text","value":"make"}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","number"]},"children":[{"type":"text","value":"1"}]},{"type":"text","value":"-plan-infra"}]}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"This runs "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"terraform init"}]},{"type":"text","value":" and "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"terraform plan"}]},{"type":"text","value":" inside "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"infrastructure/environments/dev"}]},{"type":"text","value":". Terraform will print out every resource it intends to create — VPC, subnets, NAT Gateway, ALB, security groups, ECR repo, ECS cluster, API Gateway, and the VPC Link. It is worth taking a minute to review the plan output before applying, especially the first time, to make sure nothing unexpected is included."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-wrapper"],"style":"position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1170px;"},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"a","properties":{"className":["gatsby-resp-image-link"],"href":"/static/47fbb274f42f247928322bb638726abf/6dbbe/tf-plan.png","style":"display: block","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-background-image"],"style":"padding-bottom: 39.70013037809648%; position: relative; bottom: 0; left: 0; background-image: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAICAYAAAD5nd/tAAAACXBIWXMAAAsSAAALEgHS3X78AAABY0lEQVQoz2WReU/CUBDE+ULiUa5CgQIt9KAnbYFIMAKi4BX9/sm482pJjH9Mtsd7s7+drXXNBGF+wizYwYufME+PomelMDup6sUHuNFe/feTI5xwh/44R9dMYdprNHtzXDds3DSnqNW1CQZWJlqiZQSY+g/KhBeDxYu61DZC6INYlKBnLqAPE7T7EToXxbhtOcq0xoNjZ4P+JBcVGForZT60y0oC0tDIkGqMspKOpmz0Wy+Emu7CS/ZwZGTb38r4Z2T3X0hXHyg23xLFoxqR43JsPlveFo2uL1Qz3LWdC50y5AdSElvruNI5RW9EmkzRsHuzO0dD90S+nClrZfTPUB/GiIqzInGjA6L8FcnyHXHxhsX6E76QkcoN94qwohxIPGxGgD8jcynGeCG5FGj1ApWZLYupxKUwJ5WjkPOdJiSua9ZFNFNLYfAcl4doyPAZOLdHE00uXt1NwMalSoOKqFL1/gPShiLMv3RfcAAAAABJRU5ErkJggg=='); background-size: cover; display: block;"},"children":[]},{"type":"text","value":"\n "},{"type":"element","tagName":"img","properties":{"className":["gatsby-resp-image-image"],"alt":"Terraform plan output","title":"Terraform plan output","src":"/static/47fbb274f42f247928322bb638726abf/913fc/tf-plan.png","srcSet":["/static/47fbb274f42f247928322bb638726abf/bc34b/tf-plan.png 293w","/static/47fbb274f42f247928322bb638726abf/da9f0/tf-plan.png 585w","/static/47fbb274f42f247928322bb638726abf/913fc/tf-plan.png 1170w","/static/47fbb274f42f247928322bb638726abf/6dbbe/tf-plan.png 1534w"],"sizes":["(max-width:","1170px)","100vw,","1170px"]},"children":[]},{"type":"text","value":"\n "}]},{"type":"text","value":"\n "}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Step 2 — Apply the infrastructure"}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"div","properties":{"className":["gatsby-highlight"],"dataLanguage":"bash"},"children":[{"type":"element","tagName":"pre","properties":{"className":["language-bash"]},"children":[{"type":"element","tagName":"code","properties":{"className":["language-bash"]},"children":[{"type":"element","tagName":"span","properties":{"className":["token","function"]},"children":[{"type":"text","value":"make"}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","number"]},"children":[{"type":"text","value":"2"}]},{"type":"text","value":"-deploy-infra"}]}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"This runs "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"terraform apply -auto-approve"}]},{"type":"text","value":", which provisions all the resources in the correct dependency order. Terraform handles the sequencing — for example, it knows the ECS service depends on the ALB target group, which depends on the VPC, so it wires all of that up automatically."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Once the apply completes, note down the API Gateway endpoint URL from the Terraform outputs — you will need it for testing. You can also find it in the AWS Console under "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"API Gateway → your API → Stages"}]},{"type":"text","value":"."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-wrapper"],"style":"position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1170px;"},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"a","properties":{"className":["gatsby-resp-image-link"],"href":"/static/5dcd4b788b34454069cbfd987d421436/3d35d/tf-apply.png","style":"display: block","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-background-image"],"style":"padding-bottom: 10.575296108291033%; position: relative; bottom: 0; left: 0; background-image: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAACCAYAAABYBvyLAAAACXBIWXMAAAsSAAALEgHS3X78AAAAe0lEQVQI1z2Oyw6CMAAE+SMgtCogEVRo01olKkRvPk6G/z+PtIkeJjubvWzU2B6PKAyJVMRiT7pQgVi0pEtNlhtEbmcM2cqE/ktZ2LB5T2RHpN0bd/5wGib08YVyT/pxojs8Qvded3eq7RAo6wtlc/3npr1R7UbWs/sTXzzFSBok6MONAAAAAElFTkSuQmCC'); background-size: cover; display: block;"},"children":[]},{"type":"text","value":"\n "},{"type":"element","tagName":"img","properties":{"className":["gatsby-resp-image-image"],"alt":"Terraform apply output and API Gateway URL","title":"Terraform apply output and API Gateway URL","src":"/static/5dcd4b788b34454069cbfd987d421436/913fc/tf-apply.png","srcSet":["/static/5dcd4b788b34454069cbfd987d421436/bc34b/tf-apply.png 293w","/static/5dcd4b788b34454069cbfd987d421436/da9f0/tf-apply.png 585w","/static/5dcd4b788b34454069cbfd987d421436/913fc/tf-apply.png 1170w","/static/5dcd4b788b34454069cbfd987d421436/3d35d/tf-apply.png 1182w"],"sizes":["(max-width:","1170px)","100vw,","1170px"]},"children":[]},{"type":"text","value":"\n "}]},{"type":"text","value":"\n "}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Step 3 — Build and push the container image"}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"div","properties":{"className":["gatsby-highlight"],"dataLanguage":"bash"},"children":[{"type":"element","tagName":"pre","properties":{"className":["language-bash"]},"children":[{"type":"element","tagName":"code","properties":{"className":["language-bash"]},"children":[{"type":"element","tagName":"span","properties":{"className":["token","function"]},"children":[{"type":"text","value":"make"}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","number"]},"children":[{"type":"text","value":"2"}]},{"type":"text","value":"-1-build-app"}]}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Before ECS can run the app, the Docker image needs to be in ECR. This Makefile target takes care of the full flow in one command:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"ol","properties":{},"children":[{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"Authenticates your local Docker client with ECR using "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"aws ecr get-login-password"}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"Builds the image targeting "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"linux/amd64"}]},{"type":"text","value":" (required for Fargate, important if you are on Apple Silicon)"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"Tags and pushes the image to the ECR repository that was created in Step 2"}]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"You can verify the image landed in ECR by checking the repository in the AWS Console under "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Elastic Container Registry"}]},{"type":"text","value":"."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-wrapper"],"style":"position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1170px;"},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"a","properties":{"className":["gatsby-resp-image-link"],"href":"/static/ccbedf83ba9b3c289c5558586acd6ce0/18787/ecr-image.png","style":"display: block","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-background-image"],"style":"padding-bottom: 40.10025062656642%; position: relative; bottom: 0; left: 0; background-image: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAICAYAAAD5nd/tAAAACXBIWXMAAAsSAAALEgHS3X78AAABbElEQVQoz1VR2W6DMBDkF5oDCJeDARuwARGakiaVoirqSx/6/38z3eXo8TAa78LOzthO+fwBod8h6wGZOSOUBgdpERxLRLJGmFaIM4PCDEh1B1+U8I8VDgRfVHP9B468fuFoL4j0AF+ToOohmivS6oS0sHCjDNtDOiOQE3bMVDPvw+wfnH644v74RNWN9JOEnxRo+xEt9SMzwk00pGrIbUluS4jcIBAKsmwphcbGT2hOYOvPcKr+Bt2/wSO7bqywoy0cNaDoriLXqZkGfUFIFA7EHnEwRdbYRzmlyH/YyZsRZnwgyhsSow+EqrvAnm4QRQuPlnjk0o1JiJHopVYT9lGBHWE9O/3LHbZ/nQa5wVt44FgNEKqbzvwAsuwRpPWPONe8OMosJTKIcwtlz3AScvb7o5qscyQvtbMLWsI9HlojchIWEKqdOCZRnuGzk9Fr1uQwJFF2yC+1ocvdeMnMy2U/LfV6+Zult2KtvwF0Xd7UgKRdiwAAAABJRU5ErkJggg=='); background-size: cover; display: block;"},"children":[]},{"type":"text","value":"\n "},{"type":"element","tagName":"img","properties":{"className":["gatsby-resp-image-image"],"alt":"ECR repository with pushed image","title":"ECR repository with pushed image","src":"/static/ccbedf83ba9b3c289c5558586acd6ce0/913fc/ecr-image.png","srcSet":["/static/ccbedf83ba9b3c289c5558586acd6ce0/bc34b/ecr-image.png 293w","/static/ccbedf83ba9b3c289c5558586acd6ce0/da9f0/ecr-image.png 585w","/static/ccbedf83ba9b3c289c5558586acd6ce0/913fc/ecr-image.png 1170w","/static/ccbedf83ba9b3c289c5558586acd6ce0/18787/ecr-image.png 1197w"],"sizes":["(max-width:","1170px)","100vw,","1170px"]},"children":[]},{"type":"text","value":"\n "}]},{"type":"text","value":"\n "}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Step 4 — Start the ECS service"}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The ECS service is provisioned with "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"desired_count = 0"}]},{"type":"text","value":" so no tasks run before the image is available. Once the image is in ECR, bring the service up by setting the desired count to 1:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"div","properties":{"className":["gatsby-highlight"],"dataLanguage":"bash"},"children":[{"type":"element","tagName":"pre","properties":{"className":["language-bash"]},"children":[{"type":"element","tagName":"code","properties":{"className":["language-bash"]},"children":[{"type":"text","value":"aws ecs update-service "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"\\"}]},{"type":"text","value":"\n --cluster dev-app-cluster "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"\\"}]},{"type":"text","value":"\n --service dev-app-svc "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"\\"}]},{"type":"text","value":"\n --desired-count "},{"type":"element","tagName":"span","properties":{"className":["token","number"]},"children":[{"type":"text","value":"1"}]}]}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"ECS will schedule a Fargate task in the private subnet, pull the image from ECR, and start the container. As the task comes up, it registers its private IP with the ALB target group. Once the ALB health check on port 3000 passes, the task is marked healthy and traffic will start flowing through."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"You can watch the task come up in the AWS Console under "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"ECS → Clusters → dev-app-cluster → Tasks"}]},{"type":"text","value":"."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-wrapper"],"style":"position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1149px;"},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"a","properties":{"className":["gatsby-resp-image-link"],"href":"/static/7f4019d536c56f5519a22cdb95e98de9/24e38/ecs-task.png","style":"display: block","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-background-image"],"style":"padding-bottom: 52.21932114882506%; position: relative; bottom: 0; left: 0; background-image: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsSAAALEgHS3X78AAAB90lEQVQoz21SSZLbMAzUAyaumrEsWztJSRS1WJIX2bFnvFQmueSQ//+m02SqckkOXSAAEmg06NWH78jrT4j2CEXEqsM6N9gQoewQyRahaKCaPar+hJh+kGoEWU37Lzx5/QWxvSDtr9gYPtB7ZO2MnIiaM9ayx6YYsC5GBGqLSPBhUmIVF/+FN+0vuH/+RL+7uMA6rVB3e+zmD1TdAaukgh8K+JHEiliGEm8b4awfKxf3I+XeLnnPk8MVojkyWLhRlrR6nFFPZxTtAXE5sKh24/gsnhQ9mukCZXZY2TFFRzCXlqxzgGeT43x3F4O8YacSYVkjqgxHI7v4TyPLfJ1ppEWHrOydtfqmzYzEdGxsKNcOXkkW28O7Y2P1sgWjvIbUA0TZIaSmYUNtySJRDQozIswqLsc4PVW9RaZaxickkkvJqwGynpxWQWoZlZBMVv1MRvXfjTotuQybd+e44sjasYxY0Mas75nhjH7/7hyrkU3EwkBzMSULK00GRcvuDW1PlhyTfsaRU57t8o5fH45xwpiX8lKuR6Tl1nULkgJvxRFL88CreWKhH1hUNyzUCW/tBV/EjMDcENQ3vGRHvOo7/P4HXsTZ+Y7h4fINeju7D2zXn9tPPn5A7R5Q+yfk9EDenZGPJ2TdCYr/1iKjtmK8Qe6eEPzH1v8NSh0cs4QG/+0AAAAASUVORK5CYII='); background-size: cover; display: block;"},"children":[]},{"type":"text","value":"\n "},{"type":"element","tagName":"img","properties":{"className":["gatsby-resp-image-image"],"alt":"ECS task running in private subnet","title":"ECS task running in private subnet","src":"/static/7f4019d536c56f5519a22cdb95e98de9/24e38/ecs-task.png","srcSet":["/static/7f4019d536c56f5519a22cdb95e98de9/bc34b/ecs-task.png 293w","/static/7f4019d536c56f5519a22cdb95e98de9/da9f0/ecs-task.png 585w","/static/7f4019d536c56f5519a22cdb95e98de9/24e38/ecs-task.png 1149w"],"sizes":["(max-width:","1149px)","100vw,","1149px"]},"children":[]},{"type":"text","value":"\n "}]},{"type":"text","value":"\n "}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"AWS Resources"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Once everything is deployed, it is worth taking a look at the resources in the AWS Console to get a feel for what was provisioned and how it all connects. Here are the key ones to check."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"VPC and Subnets"}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The VPC shows the full network layout — public and private subnets spread across availability zones, the route tables, and the attached Internet Gateway. You can confirm the private subnets have no direct route to the internet, only through the NAT Gateway."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-wrapper"],"style":"position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1170px;"},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"a","properties":{"className":["gatsby-resp-image-link"],"href":"/static/20108e4f55f1c061c54d575da74c597e/3389c/vpc-subnets.png","style":"display: block","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-background-image"],"style":"padding-bottom: 62.12198872373141%; position: relative; bottom: 0; left: 0; background-image: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAYAAABiDJ37AAAACXBIWXMAAAsSAAALEgHS3X78AAACAElEQVQoz4WS2XLaQBBF9e44AYQQWtC+gRYkgTFbjOPkIf//Qze3R6iCq1KVh66Znp4+c7t7tLj7BS/vEeYNnGiNxSrB0kvv/gZWUMAJ1zzLYLiJiovJ3lil3Kd/fZpW7i5Iqz2TCsysANOlz0CMen9BVu8RFS3iTQebj82dWMVkXQjcjWA4d18eYkyLyxcEGdWEOSamNwAZrA/vcJMauh0pJVHVYu4KMFWA8uUdcffGM/q8U/RXJN13aNXuCi+tYQcZJoQJcO5EaI4fyNqzKtWkVd0ZablTLRBg1hyQVBSTb1U82vTwsi2B/VkpVEDTx4xAUeXlLVZJhaU/AKVsSR57JWZS+djbpZ/DZtu0sjvxYvNJoU4F4fYCJ21g8aIV5CpBEkW99FHnqtuhelwUy37KGWib9giX0xx7OAzGU+Wl9QEO+7ggTBTmvGvHpfJDDmv7ekOw7mDS97Mau8tPaM3+ilgOvUSpG4EW5TvxRikTVVGzR3f6IKDnxEtEXF9vv5FvT2p4Mofm8Db00E8rjj96APr4MjOVPetLPE0XCKqeCTf4RacABr+MFWRq1e0A3wwbX+cWtJr/MKJCCTwCJTiagAXYHn8gECDVCOBpagyP3h8WUyWvpE//AfojkKWKwsnC/XRnNK3sTwSW/wQ+j0CWHNa7oYfFCHSUokeY+H8AbQNLR8M450UAAAAASUVORK5CYII='); background-size: cover; display: block;"},"children":[]},{"type":"text","value":"\n "},{"type":"element","tagName":"img","properties":{"className":["gatsby-resp-image-image"],"alt":"VPC and subnet layout in the AWS Console","title":"VPC and subnet layout in the AWS Console","src":"/static/20108e4f55f1c061c54d575da74c597e/913fc/vpc-subnets.png","srcSet":["/static/20108e4f55f1c061c54d575da74c597e/bc34b/vpc-subnets.png 293w","/static/20108e4f55f1c061c54d575da74c597e/da9f0/vpc-subnets.png 585w","/static/20108e4f55f1c061c54d575da74c597e/913fc/vpc-subnets.png 1170w","/static/20108e4f55f1c061c54d575da74c597e/efb0c/vpc-subnets.png 1755w","/static/20108e4f55f1c061c54d575da74c597e/3389c/vpc-subnets.png 1951w"],"sizes":["(max-width:","1170px)","100vw,","1170px"]},"children":[]},{"type":"text","value":"\n "}]},{"type":"text","value":"\n "}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Internal Application Load Balancer"}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The ALB should show as "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"internal"}]},{"type":"text","value":" with no public DNS name. Under the target group, you can see the registered ECS task IPs and their health check status. A healthy target here means traffic can flow from the VPC Link all the way to the container."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-wrapper"],"style":"position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1170px;"},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"a","properties":{"className":["gatsby-resp-image-link"],"href":"/static/06b9f74120eabbeaf6e905642841f181/1070c/alb-targets.png","style":"display: block","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-background-image"],"style":"padding-bottom: 53.92156862745098%; position: relative; bottom: 0; left: 0; background-image: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsSAAALEgHS3X78AAAB30lEQVQoz0VT2Y7UQAzMJ7CZ3EfnPieZDUyG2V2BVgIESLzsP/D/31CUnYR9sOy2u+2qcmIl1Yh2XhFkHU5RAScucQoLxqXGh0ntqDtxpXU7zNVc0yMc73DzEVbRP+L28g1R1sJLarhxjbSb4Oetxi5zXtogqc4IywkuY5sDBUA1fkTeXTSWvAyy5GLXXpAx4e1JQdxM170ZzbRo7r9Q3H8jGT+jIoi0ntBdbij7BVEx6F1tKNDVeJDkZlvz46wIn99gfv5F9fwH69MrTDMrUt9sdzcwJayQ3ZtpRVKOCj2mj+gDogrzXs1nXN1+wCxs1F9Rj582CXhPatJMvCKUCc2uRU1fkEI83JB1j8jbGdWwIOVjictuRkFv6jNp9moiiS5QWHJBVjZc0V+/UpMzUQ6I6xlhs+CUNLrB/5unt/dNiz0EGT74Rs1l3TUdbMpjFet3jK9vyJszYt2kUJZmmTZ8f/h+VtuHhXmHiEC8eoGT9bAiJgrS1aXs4qYUXLSV7TqcKjLkNG/XSzYsWruUS+6dhEHawt40bDUpD32KLPG8fkHNRQVciMfvs6C2ctZB+YCkI5OaTFg3ZKWIyUK8dVA46Mg0eSj0fT5wkkpzMlAYKBo5cxkBzTD/sP8xYv8A1vUvlFeFwUgAAAAASUVORK5CYII='); background-size: cover; display: block;"},"children":[]},{"type":"text","value":"\n "},{"type":"element","tagName":"img","properties":{"className":["gatsby-resp-image-image"],"alt":"Internal ALB and target group health","title":"Internal ALB and target group health","src":"/static/06b9f74120eabbeaf6e905642841f181/913fc/alb-targets.png","srcSet":["/static/06b9f74120eabbeaf6e905642841f181/bc34b/alb-targets.png 293w","/static/06b9f74120eabbeaf6e905642841f181/da9f0/alb-targets.png 585w","/static/06b9f74120eabbeaf6e905642841f181/913fc/alb-targets.png 1170w","/static/06b9f74120eabbeaf6e905642841f181/1070c/alb-targets.png 1734w"],"sizes":["(max-width:","1170px)","100vw,","1170px"]},"children":[]},{"type":"text","value":"\n "}]},{"type":"text","value":"\n "}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"ECS Cluster and Running Task"}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The ECS cluster view shows the service and the running task. Clicking into the task shows the private IP it was assigned, the container status, and a link to its CloudWatch logs. Notice that the task has no public IP — the only entry point is through the ALB."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-wrapper"],"style":"position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1149px;"},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"a","properties":{"className":["gatsby-resp-image-link"],"href":"/static/7f4019d536c56f5519a22cdb95e98de9/24e38/ecs-task.png","style":"display: block","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-background-image"],"style":"padding-bottom: 52.21932114882506%; position: relative; bottom: 0; left: 0; background-image: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsSAAALEgHS3X78AAAB90lEQVQoz21SSZLbMAzUAyaumrEsWztJSRS1WJIX2bFnvFQmueSQ//+m02SqckkOXSAAEmg06NWH78jrT4j2CEXEqsM6N9gQoewQyRahaKCaPar+hJh+kGoEWU37Lzx5/QWxvSDtr9gYPtB7ZO2MnIiaM9ayx6YYsC5GBGqLSPBhUmIVF/+FN+0vuH/+RL+7uMA6rVB3e+zmD1TdAaukgh8K+JHEiliGEm8b4awfKxf3I+XeLnnPk8MVojkyWLhRlrR6nFFPZxTtAXE5sKh24/gsnhQ9mukCZXZY2TFFRzCXlqxzgGeT43x3F4O8YacSYVkjqgxHI7v4TyPLfJ1ppEWHrOydtfqmzYzEdGxsKNcOXkkW28O7Y2P1sgWjvIbUA0TZIaSmYUNtySJRDQozIswqLsc4PVW9RaZaxickkkvJqwGynpxWQWoZlZBMVv1MRvXfjTotuQybd+e44sjasYxY0Mas75nhjH7/7hyrkU3EwkBzMSULK00GRcvuDW1PlhyTfsaRU57t8o5fH45xwpiX8lKuR6Tl1nULkgJvxRFL88CreWKhH1hUNyzUCW/tBV/EjMDcENQ3vGRHvOo7/P4HXsTZ+Y7h4fINeju7D2zXn9tPPn5A7R5Q+yfk9EDenZGPJ2TdCYr/1iKjtmK8Qe6eEPzH1v8NSh0cs4QG/+0AAAAASUVORK5CYII='); background-size: cover; display: block;"},"children":[]},{"type":"text","value":"\n "},{"type":"element","tagName":"img","properties":{"className":["gatsby-resp-image-image"],"alt":"ECS cluster with running Fargate task","title":"ECS cluster with running Fargate task","src":"/static/7f4019d536c56f5519a22cdb95e98de9/24e38/ecs-task.png","srcSet":["/static/7f4019d536c56f5519a22cdb95e98de9/bc34b/ecs-task.png 293w","/static/7f4019d536c56f5519a22cdb95e98de9/da9f0/ecs-task.png 585w","/static/7f4019d536c56f5519a22cdb95e98de9/24e38/ecs-task.png 1149w"],"sizes":["(max-width:","1149px)","100vw,","1149px"]},"children":[]},{"type":"text","value":"\n "}]},{"type":"text","value":"\n "}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"API Gateway"}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The API Gateway view shows the HTTP API, the two configured routes ("},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"ANY /"}]},{"type":"text","value":" and "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"ANY /{proxy+}"}]},{"type":"text","value":"), and the VPC Link integration. The endpoint URL shown on the Stages page is the public URL that users hit to reach the app."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-wrapper"],"style":"position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1170px;"},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"a","properties":{"className":["gatsby-resp-image-link"],"href":"/static/ea7d6248f0e21f26c55d6d24a021ab74/0df9d/apigw-routes.png","style":"display: block","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-background-image"],"style":"padding-bottom: 42.721016410799365%; position: relative; bottom: 0; left: 0; background-image: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAJCAYAAAAywQxIAAAACXBIWXMAAAsSAAALEgHS3X78AAABY0lEQVQoz3VR2XLCMBDzF5QCuchl5z4INFBaeCud6f//kqp1Gko7w4NGtrPRrrTKdGfo7oiwGhGXA+K8Q5S1SMheUsJPK3JFrn/QINDN3f0vVFrt4LHIiSuswxyrjbEC+fAGz/RYRQXvBZxo+rYMNJ791LLcf5FZVkV3QMiJVht9K3Yp2J6/UJ4+EdUHpOWWU3dWNOHZNHs66e19HWa3Zg7/U3lLq8X21klEpUAXPbQImQZeTOssDnSN4+WKw/kD1fYVWfvCBoO1Wg8n+LqFCrPeWpSRRUwg1hNOtn+/Im2OWEaMI25sNDnzFoE5V2GXDTfMVc4qMB1c5iSj21wEFHTMDsXugqAY8RS2WESs0z0KZrsxLSJalhgEYl8W5VBHzR1mwWnCjDanJi7Z57bnjU9WRysSUkwg4rILyVbJ2P8FbcDsJmLC95DcTL239iTruS7vRvuuZNR7wXkxj7DwEotH7993wPRPumoOaQAAAABJRU5ErkJggg=='); background-size: cover; display: block;"},"children":[]},{"type":"text","value":"\n "},{"type":"element","tagName":"img","properties":{"className":["gatsby-resp-image-image"],"alt":"API Gateway routes and VPC Link integration","title":"API Gateway routes and VPC Link integration","src":"/static/ea7d6248f0e21f26c55d6d24a021ab74/913fc/apigw-routes.png","srcSet":["/static/ea7d6248f0e21f26c55d6d24a021ab74/bc34b/apigw-routes.png 293w","/static/ea7d6248f0e21f26c55d6d24a021ab74/da9f0/apigw-routes.png 585w","/static/ea7d6248f0e21f26c55d6d24a021ab74/913fc/apigw-routes.png 1170w","/static/ea7d6248f0e21f26c55d6d24a021ab74/efb0c/apigw-routes.png 1755w","/static/ea7d6248f0e21f26c55d6d24a021ab74/0df9d/apigw-routes.png 1889w"],"sizes":["(max-width:","1170px)","100vw,","1170px"]},"children":[]},{"type":"text","value":"\n "}]},{"type":"text","value":"\n "}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"CloudWatch Logs"}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Container output from the ECS task is streamed to CloudWatch under the log group "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"/dev-app-svc-logs"}]},{"type":"text","value":". This is where you would look to debug the app or confirm it is receiving requests."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-wrapper"],"style":"position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1170px;"},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"a","properties":{"className":["gatsby-resp-image-link"],"href":"/static/00127d567e9b895759fe1d214b7a0186/598e4/cloudwatch-logs.png","style":"display: block","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"\n "},{"type":"element","tagName":"span","properties":{"className":["gatsby-resp-image-background-image"],"style":"padding-bottom: 50%; position: relative; bottom: 0; left: 0; background-image: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsSAAALEgHS3X78AAABvElEQVQoz22S6Y7TQBCE/Qiw6zuxx9eM7fGVxE6Cg8KChMQv3v9xippxAmjhxyfP1d3V1Xaa9ScS+YayPyHvzohyjajoEJc99kVrKZoJerogUyP3GnHWIkjVf3HU+gPd9Q1B3iOsZ0TVgFgd4XLv7SuEokbIhz7XJiDKap6XeAkzvEYGsRHnpIBTtRO6wycIyQS7Aqqfcbp+QUlVORFqQFJqpLxPqw57roXskFCtL48UsVg80cBlUkcfVshutkp8K1uyxQPK9sBEHXZ5Y78GcxeKrTU/kfASBS99wA5cCnJssD4hpm/errSHUdYgzjefXJ7F9FH1CwoWEfUEL9N45Tv38d59rmmFM53vuN6/o7t8RVAMtlLF4IY2qPHCZBo7qmumKxL6a9VQmW87+hdnuX3DkUPJWDkoRz6WqGiBSSCHhVNvmVBDDWcU7ESyWCIHBktr0XucYb6hpRI3LFm1sQlr7vv5s1X5VKiPKwc02mT7qv+TxCj9CycfVqTzHeE82ikbP8yAIg7D/CLWQ6pUw+ZhYqZNBL0PqpFelg8vNxzVLdDLDVGvrX8v/Lc+BOlvPobC8lybe8vj/D2/AHR3GO8dMChkAAAAAElFTkSuQmCC'); background-size: cover; display: block;"},"children":[]},{"type":"text","value":"\n "},{"type":"element","tagName":"img","properties":{"className":["gatsby-resp-image-image"],"alt":"CloudWatch log group for the ECS task","title":"CloudWatch log group for the ECS task","src":"/static/00127d567e9b895759fe1d214b7a0186/913fc/cloudwatch-logs.png","srcSet":["/static/00127d567e9b895759fe1d214b7a0186/bc34b/cloudwatch-logs.png 293w","/static/00127d567e9b895759fe1d214b7a0186/da9f0/cloudwatch-logs.png 585w","/static/00127d567e9b895759fe1d214b7a0186/913fc/cloudwatch-logs.png 1170w","/static/00127d567e9b895759fe1d214b7a0186/598e4/cloudwatch-logs.png 1230w"],"sizes":["(max-width:","1170px)","100vw,","1170px"]},"children":[]},{"type":"text","value":"\n "}]},{"type":"text","value":"\n "}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"Testing the Setup"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"With everything deployed and the ECS task healthy, it is time to verify the end-to-end flow works as expected. There are a few things worth testing here — not just that the app loads, but that the private networking is actually working the way it should."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Step 1 — Get the API Gateway URL"}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The public entry point is the API Gateway endpoint URL. Grab it from the Terraform output after "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"make 2-deploy-infra"}]},{"type":"text","value":", or find it in the AWS Console under "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"API Gateway → your API → Stages → $default"}]},{"type":"text","value":"."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"It will look like:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"div","properties":{"className":["gatsby-highlight"],"dataLanguage":"text"},"children":[{"type":"element","tagName":"pre","properties":{"className":["language-text"]},"children":[{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"https://