In the first two episodes of this series, we learned how to build a VPC with public and private subnets. We did a deep dive on NAT, or network address translation, and then setup a software-only VPN for secure access to the private subnets.
Now, it's time to put everything together and earn our cloud networking black belt.
This week on Mobycast, Jon and Chris conclude their three-part series on how to incorporate private subnets for your cloud network. We finish by explaining step-by-step how to move an existing ECS application onto our new private subnets. Now... go build, ninja!
-> https://glow.fm/mobycast <-
- We describe the existing application, which is a typical two-tier web application, with a web service fronted by an Application Load Balancer (ALB) and database hosted on MySQL using RDS.
- The current application is containerized and running under ECS.
- Everything (the load balancer, ECS cluster, RDS instance) is running on public subnets.
- The goal is to leave only the ALB public-facing, with all other resources protected on private subnets.
- There are two phases to moving the application to private subnets. First, we need to move the ECS cluster to private subnets. Then, we can move the RDS instance to private subnets.
- We detail step-by-step two deployment approaches for moving our ECS cluster to private subnets, both of which involve zero downtime.
- Rolling deployment, which updates the existing cluster in-place.
- Blue/green deployment, which creates a new cluster to replace the existing one.
- We discuss the steps on moving the database instance to private subnets, including application downtime considerations.
- As a bonus, we explain how to add encryption-at-rest to the RDS instance during the migration.
- VPC with Public and Private Subnets (NAT)
- Changing the Launch Configuration for an Auto Scaling Group
- Add Encryption to an Unencrypted RDS DB Instance
- Amazon ECS-optimized AMIs
What is Mobycast?
A Podcast About Cloud Native Software Development, AWS, and Distributed Systems