AWS — Architecture, Services & Security
This section documents production AWS work service by service — how each piece is configured, why,
and how they compose into secure, highly available architectures. The reference architecture below is a
real design pattern: a WAF-fronted, load-balanced, auto-scaling application tier with a managed database,
monitoring, and alerting — the shape behind the high-traffic food-service platforms I run.
Reference Architecture — WAF + ELB + Auto Scaling
How traffic flows through it
- Client / Users hit the public endpoint over HTTP/HTTPS (ports 80 and 443).
- Web Application Firewall (WAF) inspects requests for attack patterns before they reach anything that matters — SQLi, XSS, bad bots — using managed rule groups with scoped overrides.
- Application Load Balancer terminates TLS (certificate from ACM) and forwards to healthy targets. Listeners: HTTPS:443 and HTTP:80, each with a default rule forwarding to a target group.
- Auto Scaling group runs the Frontend + Proxy + API tier, scaling horizontally on load. Only port 443 is open from the ALB to this tier — a security-group boundary, not a network firewall.
- MariaDB sits in a private subnet reachable only on port 3306 from the app tier. S3 holds backups and static assets.
- Monitoring & Notification — CloudWatch metrics/alarms feed SNS, which fans out alerts. This is the observability spine of the whole design.
The security story in one line: every arrow in that diagram crosses a security-group boundary,
public exposure is limited to the ALB alone, and the database is never reachable from the internet —
only from the app tier, only on 3306.
Service Reference
| # | Service | What it covers | Status |
|---|---|---|---|
| 01 | AWS Landing Zone | Multi-account foundation, Organizations, guardrails. | Planned |
| 02 | IAM | Identity, roles, policies, least-privilege access. | Planned |
| 03 | VPC | Network isolation, subnets, routing, gateways. | Planned |
| 04 | EC2 | Compute instances, AMIs, instance types. | Planned |
| 05 | EBS | Block storage, volumes, snapshots, encryption. | Planned |
| 06 | S3 | Object storage, lifecycle, replication, security. | Planned |
| 07 | ALB | Application Load Balancer, listeners, target groups. | Planned |
| 08 | Auto Scaling | Scaling policies, launch templates, health checks. | Planned |
| 09 | Route 53 | DNS, routing policies, health checks. | Planned |
| 10 | ACM | Certificate management, TLS provisioning. | Planned |
| 11 | CloudWatch | Metrics, alarms, logs, dashboards. | Planned |
| 12 | SNS | Pub/sub notifications, alert fan-out. | Planned |
| 13 | CloudTrail | API audit logging, org-wide trails. | Planned |
| 14 | EventBridge | Event routing, rules, automation triggers. | Planned |
| 15 | AWS Config | Resource compliance, config rules, drift. | Planned |
| 16 | Security Hub | Security posture aggregation, standards. | Planned |
| 17 | GuardDuty | Threat detection, anomaly findings. | Planned |
| 18 | KMS | Encryption keys, key policies, rotation. | Planned |
| 19 | Secrets Manager | Secret storage, rotation, retrieval. | Planned |
| 20 | Systems Manager | Patching, Session Manager, parameter store. | Planned |
| 21 | Backup Strategy | AWS Backup, cross-region, retention. | Planned |
| 22 | Cost Optimization | Right-sizing, savings plans, anomaly detection. | Planned |
| 23 | AWS Security Hardening | End-to-end account and workload hardening. | Ready |
Skills demonstrated across this section
VPC & network design IAM least-privilege ALB & Auto Scaling WAF tuning KMS encryption CloudWatch & SNS GuardDuty & Security Hub Cost optimization Backup & DR