🧱 Architecture Overview
The deployed architecture consists of:
🌐 Web Tier
EC2 instance in a public subnet
Accessible via public DNS
Runs a Flask application
Uses Security Groups to restrict inbound access
🗄️ Database Tier
MySQL RDS instance
Hosted in private subnets
No direct internet access
Accepts traffic only from web tier security group
🔐 Secrets Management
Database username & password generated dynamically
Stored securely in AWS Secrets Manager
Retrieved by EC2 during boot via user data
🧩 Terraform Module Design
This project is built using custom Terraform modules, a critical real-world practice.
Modules used:
VPC module
VPC
Public & private subnets
Internet Gateway
NAT Gateway
Route tables
Security Group module
Web SG (HTTP access)
DB SG (MySQL access only from web SG)
Secrets module
Random password generation
Secrets Manager storage
RDS module
MySQL instance
Private subnet placement
Credentials injected from Secrets Manager
The root module orchestrates everything by passing outputs between modules.
🔐 Secure Credential Handling (Critical)
One of the most important lessons in Day 22:
_
❌ No credentials in Terraform code
❌ No credentials in variables.tf
❌ No credentials in user data scripts
✅ Password generated using random_password
✅ Stored in AWS Secrets Manager
✅ Retrieved securely at runtime_
This is mandatory in real production environments.
⚙️ Application Deployment with User Data
The EC2 instance uses user data to:
Install system dependencies
Install Python and Flask
Fetch database credentials from Secrets Manager
Configure environment variables
Start the Flask application automatically
Result:
Infrastructure and application deploy together — fully automated.
🔄 Terraform Workflow Used
Standard, production-safe workflow:
terraform init
terraform plan
terraform apply
Notes:
RDS provisioning takes time — expected behavior
Outputs expose application endpoint safely
Infrastructure must be destroyed after testing to avoid costs
Top comments (0)