DEV Community: marvintowett

Deploying a Highly Available Web App on AWS Using Terraform

marvintowett — Thu, 26 Mar 2026 18:57:04 +0000

Today we will be looking at deploying a cluster of web servers. To make all this possible we are going to employ the use of the following AWS technologies:

Auto Scaling Group (ASG)
Application Load Balancer
Launch Configuration

Auto Scaling Group (ASG)

Auto Scaling Group handles:

Launching a cluster of EC2 Instances
Monitoring health of each instance
Replacing failed instances
Adjusting Size of each of the cluster in response to load

Creating an ASG:
In order to create an ASG you must first create a launch configuration that specifies how to configure each EC2 instance in the ASG

This Terraform configuration creates an Auto Scaling group with a launch configuration that sets up a simple HTTP server using BusyBox. The server listens on a port defined by the server_port variable, which defaults to 8080. The security group allows incoming traffic on the specified port from any IP address.

resource "aws_launch_configuration" "example" {
    image_id = "ami-0735c191cf914754d"
    instance_type = "t2.micro"
    security_groups = [aws_security_group.instance.id]

    user_data = <<-EOF
                    #!/bin/bash
                    echo "Hello, World" > index.html
                    nohup busybox httpd -f -p ${var.server_port} &
                EOF

    // Ensure that the new launch configuration is created before the old one is destroyed            
    lifecycle {
      create_before_destroy = true
    }

}

We added lifecycle block. this ensures that when updating/creating a new EC2 instance, Terraform will first create the new instance update then delete the old instance

For this ASG to work we need to add another value subnet_ids.
This parameter specifies which subnet the EC2 instances should be deployed to the ASG.

Each subnet lives in an isolated AWS Availability Zone (AWS AZ) to ensure your instances keep running even if some of the data centres have an outage

Data Source:

In order to get the ips of each subnet we are going to use data sources.
A data sources represents a piece of read-only information that is fetched from the provider whenever you run Terraform.
Data source is used to simply query information from the providers IP.

The Syntax for using a data source:

data "<PROVIDER_NAME>_<TYPE>" "<NAME>" {
 [CONFIG ...]
}

We will go ahead and look up data for our Default VPC and then combine that with another data source aws_subnets to look upthe subnets within the VPC.

// Data sources to get the default VPC
data "aws_vpc" "default" {
    default = true
}

// Get the subnets in the default VPC
data "aws_subnets" "default" {
    filter {
        name = "vpc-id"
        values = [data.aws_vpc.default.id]
    }
}

Now we can pull the Ids out of the aws_subnets required by the ASG.

// Create an Auto Scaling group that uses the launch configuration
resource "aws_autoscaling_group" "example" {
    launch_configuration = aws_launch_configuration.example.name
    vpc_zone_identifier = data.aws_subnets.default.ids

    min_size = 2
    max_size = 10

    tag{
        key = "Name"
        value = "mk-terraform-instance"
        propagate_at_launch = true
    }

}

Deploying Load Balancer

A Load balance is a server that distributes traffic across your server while using the load balancer's IP.
we have 3 types of Load balancers:

Application Load Balancers(ALB): Best suited for load balancing of HTTP and HTTPS request
Network Load Balancers(NLB): Best suited for load balancing of TCP, UDP and TLS traffic.
Classic Load Balancer(CLB): CLB predates ALB and NLB, it loab balance's for HTTP, HTTPS, TCP and UDP.However it has fewer features than ALB and NLB.

For this example since we are deploying a simple server we will be using ALB Application Load Balancer.
To create a load balance we will use the aws_lb resource.

resource "aws_lb" "example" {
    name = "terraform-asg-example"
    load_balancer_type = "application"
    subnets = data.aws_subnets.default.ids
}

Our load balancer is configured to use all subnets.

Now we need to configure listeners to the loab balancer using the aws_lb_listener resource.

resource "aws_lb_listener" "http" {
    load_balancer_arn = aws_lb.example.arn
    port = var.http_port
    protocol = "HTTP"

    // Set up a fixed response for any requests that do not match the target group
    default_action {
        type = "fixed-response"
        fixed_response {
            content_type = "text/plain"
            message_body = "${var.status_code}: Page Not Found"
            status_code = var.status_code
        }

    }

}

The listener above is configured to listen to default port 80, use the HTTP protocol and send 404 page for request that don't match listeners rules.

Now we will need to create a new security group for our ASG since AWS does not allow any incoming or outgoing traffic by default.

resource "aws_security_group" "alb" {
    name = "mk-terraform-alb-security-group"

    // Allow incoming traffic on the HTTP port from any IP address
    ingress{
        from_port = var.http_port
        to_port = var.http_port
        protocol = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
    }

    // Allow all outbound traffic from the load balancer
    egress {
        from_port = 0
        to_port = 0
        protocol = "-1"
        cidr_blocks = ["0.0.0.0/0"]
    }
}

The next Step is now to pass this security group in the
security_group arguments of our load balance.

// Create an Application Load Balancer to distribute traffic to the instances in the Auto Scaling group
resource "aws_lb" "example" {
    name = "terraform-asg-example"
    load_balancer_type = "application"
    subnets = data.aws_subnets.default.ids
    security_groups = [aws_security_group.alb.id]

}

Next we will have to create a target group for our ASG using the aws_b_target_group resource. a target group is a part of the ASG that receives request from the load balancer. it also performs health checks on the server and sends request to healthy nodes only.

// Create a target group for the Auto Scaling group instances
resource "aws_lb_target_group" "asg" {
    name = "terraform-asg-example"
    port = var.server_port
    protocol = "HTTP"
    vpc_id = data.aws_vpc.default.id

    health_check {
        path = "/"
        protocol = "HTTP"
        matcher = "200"
        interval = 15
        timeout = 3
        healthy_threshold = 2
        unhealthy_threshold = 2
    }

}

The target groups sends request to EC2 Instance by setting target_group_arns in the aws_autoscaling_group resource.

// Create an Auto Scaling group that uses the launch configuration
resource "aws_autoscaling_group" "example" {
    launch_configuration = aws_launch_configuration.example.name
    vpc_zone_identifier = data.aws_subnets.default.ids

    target_group_arns = [aws_lb_target_group.asg.arn]
    health_check_type = "ELB"

    min_size = 2
    max_size = 10

    tag{
        key = "Name"
        value = "mk-terraform-instance"
        propagate_at_launch = true
    }

}

Note: we updated the health_check_type to "ELB" health check as it is more robust and instructs ASG to use the target group health check to determine whether an instance is healthy.

Finally, we create a listener_rule. This is the last part of the ASG we need to configure. The Listener Rule takes a request that's come in and send's those that match specific paths or hostnames to specific target_group.

// Create a listener rule that forwards traffic to the target group for the Auto Scaling group instances
resource "aws_lb_listener_rule" "asg" {
    listener_arn = aws_lb_listener.http.arn
    priority = 100

    // Forward traffic to the target group for the Auto Scaling group instances if the path is "/"
    condition {
        path_pattern {
            values = ["/"]
        }
    }

    // Forward traffic to the target group for the Auto Scaling group instances
    action {
        type = "forward"
        target_group_arn = aws_lb_target_group.asg.arn
    }
}

Mastering Basic Infrastructure with Terraform

marvintowett — Tue, 24 Mar 2026 19:05:03 +0000

Yesterday we deployed our first server. Today we level up. We will learn one of the most important principles in Terraform — and in software engineering generally — which is DRY: Don't Repeat Yourself. We will apply it by deploying a configurable web server using input variables, then take it further by deploying a clustered web server capable of handling real traffic. By the end of today we will understand what separates a toy deployment from production-ready infrastructure.

We will continue using our code from yesterday's session and improve on it. Here is our starting point:

provider "aws" {
  region = "us-west-2"
}

resource "aws_instance" "example" {
    ami          = "ami-0735c191cf914754d"
    instance_type = "t3.micro"
    vpc_security_group_ids = [aws_security_group.instance.id]

    tags = {
      Name = "mk-terraform-example"
    }

    user_data = <<-EOF
                    #!/bin/bash
                    echo "Hello, World" > index.html
                    nohup busybox httpd -f -p 8080 &
                EOF

    user_data_replace_on_change = true

}

resource "aws_security_group" "instance" {
    name  = "mk-terraform-security-group"

    ingress {
        from_port   = 8080
        to_port     = 8080
        protocol    = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
    }

}

Terraform allows you to make your code more configurables hence aligns with the DRY Principle. We achieve this by defining input variables the syntax:

variable "<variable-name>" {
 [CONFIG ...]
}

the body of a vriable contains the following parameters which are optional

description: used to document how the variable is used
default: used when no value is provided. if there is no value Terraform will prompt the user for one

There are multiple ways of providing a value for a variable i.e command line using -var option, via a file using the -var-file option, or via environment virable

type: allows you to enforce constraints on the variable
validation: allows you to dife custom validations rules for an input
sensitive: if set to true on an input it will not be logged when apply or plan are executed.

You can read more on this. For now let's proceed with the task at hand let's introduce our first variable. In this example we will define the default value

variable "server_port" {
    description = "The port the server will use for HTTP requests"
    type = number
    default = 8080
}

In order to use this variable we will employ the use of terraform expressions called variable reference. it follows the syntax below:

var.<VARIABLE_NAME>

resource "aws_security_group" "instance" {
    name  = "mk-terraform-security-group"

    ingress {
        from_port   = var.server_port
        to_port     = var.server_port
        protocol    = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
    }

}

Note in our User data script we also defined port 8080. We can reference the variable using and expression called an interpolation of syntax:

"${..........}"

OUTPUT VARIABLE

We if we can input for sure we can output. An output variable has the following syntax:

output "<NAME>" {
  value = <VALUE>
 [CONFIG ...]
}

The Config contains the following optional parameters:

description: allows you to document the type of data contained in the output variable
sensitive: flags if data should be shown when plan or apply are executed
depends_on: allows you to create dependency between resources that require each other.

USE CASE:
Instead of having to manually poke around the EC2 console to get the IP address of your newly created server you can provide the IP address as an output variable

output "public_ip" {
    value = aws_instance.example.public_ip
    description = "The public IP address of the web server"
}

When you run the Command terraform apply. you will see the output show up as seen in the screenshot below.

You can also use command terraform output to list all outputs without applying changes

mktowett@Kiprotichs-MacBook-Pro Day2 % terraform output
public_ip = "16.146.72.177"
mktowett@Kiprotichs-MacBook-Pro Day2 %

in the event you want a specific output you could always pass the name give to that output after the command above and it will print out the results

terraform output <output-name>

mktowett@Kiprotichs-MacBook-Pro Day2 % terraform output public_ip 
"16.146.72.177"
mktowett@Kiprotichs-MacBook-Pro Day2 %

Deploying Your First Server with Terraform

marvintowett — Tue, 24 Mar 2026 17:52:02 +0000

Terraform de is written in the HarshiCorp Configuration Language (HCL) in files with extestion .tf.HCL is a declarative language. You describe what you want and terraform will figure out how to handle it.
Terrafrom can be used to create infrastructure across a wide variety of platforms eg AWS,Google, DigitalOcean etc. In Terrafrom these are called providers.

In my previous blog i showed you how to create an EC2 instance on AWS. Today we will be looking at running a web server on our instance that can respond to HTTP request.

In this example we will get an EC2 Instance to run a script. Since its a one liner we will use busybox and plain Ubuntu 20.04 AMI. We shall run the "hello world!" script as part of the ec2 Instance's User Data

provider "aws" {
  region = "us-west-2"
}

resource "aws_instance" "example" {
    ami          = "ami-0735c191cf914754d"
    instance_type = "t3.micro"
    vpc_security_group_ids = [aws_security_group.instance.id]

    tags = {
      Name = "mk-terraform-example"
    }

    user_data = <<-EOF
                    #!/bin/bash
                    echo "Hello, World" > index.html
                    nohup busybox httpd -f -p 8080 &
                EOF

    user_data_replace_on_change = true

}

resource "aws_security_group" "instance" {
    name  = "mk-terraform-security-group"

    ingress {
        from_port   = 8080
        to_port     = 8080
        protocol    = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
    }

}

Note: user_data_replace_on_change paramater is set to true so that when User Data changes and you apply on terraform it will terminate the original instance and create a new one.

In the code above we have introduced a new resource, security group to allow the EC2 instance to receive traffic on port 8080.

resource "aws_security_group" "instance" {
    name  = "mk-terraform-security-group"

    ingress {
        from_port   = 8080
        to_port     = 8080
        protocol    = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
    }

}

The code above creates a new resource called mk-terraform-security-group. this code specifies that this group allows incoming TCP request on port 8080 from all IP ranges.

After creating the security group, we passed the ID of the security group into the vpc_security_group_ids.

vpc_security_group_ids = [aws_security_group.instance.id]

resource "aws_instance" "example" {
    ami          = "ami-0735c191cf914754d"
    instance_type = "t3.micro"
    vpc_security_group_ids = [aws_security_group.instance.id]

    tags = {
      Name = "mk-terraform-example"
    }

    user_data = <<-EOF
                    #!/bin/bash
                    echo "Hello, World" > index.html
                    nohup busybox httpd -f -p 8080 &
                EOF

    user_data_replace_on_change = true

}

Terraform: Enviroment Setup

marvintowett — Thu, 19 Mar 2026 16:51:29 +0000

Today is day 2 of the 30 Day Challenge actually day 3 of the challenge i seem to have slacked a bit but we are here for the task: Environment setup.
In todays task we are going to cover the following:

Set Up AWS Account
Install and Configure the AWS CLI
Install Terraform
Connect Terraform to AWS

These are our matching orders and we are going to tackle them one after the other ensuring that i show you each and every step while explaining exactly what is happening as simple as i can get.

SETUP AWS ACCOUNT

In order to create this account you will need to have:

valid email address
phone number for verification
credit or debit card (for this series we will not exceed the free tier. best believe we will not fall prey to AWS charges only if you follow my guide step by step -- also terraform address resource creation and management to mitigate running unused resource that may be forgotten in the event of clickOps)

REGISTRATION STEPS

Go to AWS Sign-Up page: visit url https://aws.amazon.com and click Create AWS Account
Enter Root Email and Account Name
Verify Your Email
Set a Strong Root Password
Enter Contact Information
Verify Your Identity
Choose a Support Plan

INSTALL AND CONFIGURE AWS CLI

In order for terraform to authenticate it use's AWS CLI's credentials. Below are the steps to configure it.

Install AWS CLI

macOS

# Using Homebrew 
brew install awscli

# Verify installation
aws --version

Linux (ubuntu/Debian)

# Download and install 
curl 'https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip' -o 'awscliv2.zip' unzip awscliv2.zip sudo ./aws/install

 # Verify 
 aws --version

Windows

Download the MSI installer from https://aws.amazon.com/cli/ and run the installer, then verify in

aws --version

CONFIGURE AWS CLI

We shall head over to AWS and navigate to IAM.
Here we shall navigate to Users.
Where we are going to click on Create user

Enter a username and select checkbox - Provide user access to the AWS Management Console
You will then proceed to Set Permissions
Select Attach policies directly
In the Permissions Policies add AdministratorAccess

Click Create User and you will be given a password that you will need to save to be used later on.

CREATE ACCESS KEYS

Select you created user in the Users list
Click Create access key in the Summary box or Select Security credentials and scroll to Access Keys
Select Command Line Interface under use case

add description and confirm
you will be shown the in the next view Access key and Secret Access key that you will save.

CONFIGURE AWS CLI

Run command below to configure CLI

  aws configure

You will be prompted with the following

AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE 
AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY 
Default region name [None]: us-east-1 
Default output format [None]: json

Verify configs

aws sts get-caller-identity

Note: your credentials will be stored in two files on your machines

~/.aws/credentials — stores your keys
~/.aws/config — stores region and output format

INSTALL TERRAFORM

Once you have successfully installed and configured AWS CLI we will proceed with the start of the show Terraform.
In order to install terraform run the commands below

macOS

brew tap hashicorp/tap
brew install hashicorp/tap/terraform

Linux

sudo apt-get update && sudo apt-get install -y gnupg software-properties-common

wget -O- https://apt.releases.hashicorp.com/gpg | \
  gpg --dearmor | \
  sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] \
  https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
  sudo tee /etc/apt/sources.list.d/hashicorp.list

sudo apt update && sudo apt install terraform

Windows - use chocolatey (recommended)

choco install terraform

Confirm installation:

terraform -version

You should see something like: 
 Terraform v1.7.5 on linux_amd64

CONNECT TERRAFORM TO AWS

First of all you are almost done this is where the magic happens. Connecting Terraform to AWS.
We are going to create an EC2 instance on amazon using terrafrom.

Create a new project on visual studio.
Create a file called main.tf and add the following code

    provider "aws" {
     region = "us-west-2"
    }

    resource "aws_instance" "name-example" {
        ami = "ami-0735c191cf914754d"   
        instance_type = "t3.micro"

    }

The above code creates a simple instance of a linux box in the region us-west-s.
Note: different regions have different resource id so if you change the region you will need to search the corresponding ami

The table below shows the command you need to run to initialize and create an instance on AWS

Command	Description
`terraform init`	Initialize a working directory
`terraform plan`	Preview changes before applying
`terraform apply`	Apply the infrastructure changes
`terraform destroy`	Tear down all managed resources
`terraform fmt`	Format your `.tf` files
`terraform validate`	Check config for errors

Now we you head over to AWS you will see you instance initalized and running

Just like that you have created your first instance programatically!

i'll see you on Day 3