DEV Community

Cover image for Beyond the Default: Building a Cost-Optimized Hybrid AWS Architecture
Gerlie Ann Katherine Daga-as
Gerlie Ann Katherine Daga-as

Posted on

Beyond the Default: Building a Cost-Optimized Hybrid AWS Architecture

In the world of AWS, "default" settings are often the fastest way to an expensive monthly bill. Recently, a Senior DevOps Engineer dropped a strategic hint on one of my posts that challenged the standard EC2-only approach:

"Lightsail is cheaper for the public-facing interface. You don't get much CPU, but enough SSD for cache. Then connect to your EC2."

I didn’t just read the comment. I built the system myself. I used AWS Lightsail for predictable costs and EC2 for extra computing power, creating a setup that greatly reduces Data Transfer Out (DTO) costs.

The "Aha!" Moment: Fighting the $0.09/GB Trap

Most developers realize too late that AWS charges roughly $0.09 per GB for outbound data from EC2 (after the first 100GB). If your site pushes 1TB of traffic, that’s roughly a $90 bill for bandwidth alone.

That’s when the "Aha!" moment hit me: AWS Lightsail isn’t just for beginners. Its $5/month plan includes 1TB of outbound data transfer. By using Lightsail as an Nginx reverse proxy, you’re essentially buying a "bandwidth insurance policy."

The strategy: route public-facing traffic through the Lightsail “front door” and keep the connection to your EC2 backend over a Lightsail VPC peering connection. This traffic stays on AWS’s private network, keeping your costs predictable while shielding your backend from the public internet.

The Build & Technical Insights

  1. Compute Strategy: Optimized Frontend, Scalable Backend
    Frontends rarely need heavy CPU. Lightsail’s burstable CPU is perfect for an Nginx reverse proxy, while EC2 handles the heavy lifting. Use Auto Scaling Groups and instance types optimized for your workload to ensure backend performance without overpaying for the frontend.

  2. Networking: The VPC Peering Bridge

Setting up Lightsail → EC2 connectivity requires a VPC peering connection. Key detail: both route tables need manual updates:

  • Lightsail Side: Add a route for the EC2 VPC CIDR pointing to the peering connection.
  • EC2 Side: Add a route for the Lightsail VPC CIDR pointing back. This ensures traffic flows privately between Lightsail and EC2.

. Troubleshooting Masterclass: Traceroute is King

When initial curl requests timed out, I didn’t guess I traced the packets:

traceroute 172.31.x.x
Enter fullscreen mode Exit fullscreen mode

Packets left the instance but died after two hops, revealing a routing table gap rather than a misconfigured Nginx. One command saved me an hour of troubleshooting.

Production Optimizations

Web Server & Static Assets

  • OpenLiteSpeed (OLS): For WordPress or PHP apps, OLS handles concurrent users better than Apache and is more resource-efficient.
  • CloudFront: Offload static assets to a CDN. Free tier: 1TB per month for the first 12 months. Reduces load on your Lightsail proxy.

Security & Traffic Management

  • Cloudflare: DNS, WAF, and DDoS protection hide your Lightsail public IP and add resilience.
  • TLS Termination: Offload HTTPS at Cloudflare or Lightsail to reduce backend CPU usage.

Email & Notifications

  • AWS SES: Send up to 62,000 free emails/month from EC2 instances during the free tier perfect for transactional mail and app notifications.

Hardware Efficiency

  • ARM (t4g / Graviton2): ~20% better price-to-performance than x86 Intel for many workloads.
  • AMD (t3a): ~10% cheaper than Intel for x86 workloads sensitive to micro-latency.

With this setup (Cloudflare + CloudFront + Lightsail + EC2 + SES), you can run a robust, scalable stack for ~$15/month, assuming moderate traffic and efficient use of free tiers.

Production Readiness Notes

  • Monitoring & Logging: Use CloudWatch for EC2 metrics and Lightsail logs. Monitor Nginx access/error logs.
  • High Availability: Lightsail is single-AZ. For mission-critical apps, consider multi-region failover.
  • Auto Scaling: Keep EC2 backends in Auto Scaling Groups to handle traffic spikes.
  • Backup Strategy: Snapshot EC2 and Lightsail instances regularly.

Conclusion

This project proved that in DevOps, curiosity pays off. A single comment led me to a hybrid architecture that optimizes costs, improves scalability, and demonstrates professional-grade cloud engineering. Thank you sir Harith!

I’ve documented the full lab guide, including the Nginx configs and peering steps, in my GitHub repository here: aws-lightsail-nginx-lab

Top comments (0)