DEV Community

manny300
manny300

Posted on

I Built a Secure, Decoupled E-Commerce Architecture on AWS Using Only Free-Tier Resources

#aws #devops #automation #cloudengineering

Monolithic application deployments mix public web traffic with internal database storage, creating a single point of failure and unnecessarily expanding the attack surface. To solve this, I designed and deployed a multi-tier PrestaShop e-commerce architecture on AWS. It decouples the application layer from the database layer, restricts network traffic using the Principle of Least Privilege, and remains entirely within AWS Free-Tier constraints.

What You Will Need

  • An AWS Account (Free-Tier eligible)
  • Basic understanding of Linux terminal commands
  • An SSH key pair for secure access

1. Database Provisioning (Amazon RDS)

I prioritized the creation of a managed relational database to establish a secure and isolated data backend before configuring the application frontend.

I accessed the RDS Console to initialize a new MySQL 8.0 instance. I selected the db.t3.micro instance class under the Free-tier template to maintain cost compliance. Most importantly, I disabled public accessibility. The database must remain internal to the VPC. A public-facing database is an unnecessary risk.

2. Application Server Provisioning (Amazon EC2)

For the web host, I launched a new Ubuntu 26.04 LTS instance via the EC2 Dashboard. I selected the t3.micro instance type to ensure Free-Tier eligibility. I also generated a new RSA Key Pair to authenticate via secure shell.

3. Security Group Configuration

This is where the architecture becomes secure. Simply putting resources in a VPC is not enough; you must define explicit traffic rules.

For the EC2 Security Group, I defined inbound rules to permit SSH (Port 22) access only from my personal IP address. I allowed global HTTP (Port 80) access so the storefront is accessible to the public.

For the RDS Security Group, I encapsulated the database by allowing traffic on Port 3306 only if it originates from the EC2 instance's specific Security Group ID. This establishes a secure, private link between the tiers. The database will drop any traffic that does not come directly from the web server.

4. Troubleshooting SSH Key Permissions

When I first attempted to connect to the EC2 instance, macOS blocked the connection with a WARNING: UNPROTECTED PRIVATE KEY FILE! error because the downloaded key had 0644 permissions (readable by anyone). SSH requires private keys to be strictly secured.

I fixed this by restricting the file permissions so only my user account could read it:

chmod 400 ~/.ssh/prestashop-key.pem
ssh -i ~/.ssh/prestashop-key.pem ubuntu@100.62.104.71
Enter fullscreen mode Exit fullscreen mode

5. Server Configuration & Dependency Installation

Once connected, I updated the package manager and prepared to install Apache and PHP 8.1. Because I used a newer Ubuntu release (26.04), the standard ppa:ondrej/php repository was obsolete and returned a 404 error.

I resolved this by removing the broken repository and securely adding the canonical SURY repository via its GPG key:

# 1. Update the system
sudo apt update && sudo apt upgrade -y

# 2. Install prerequisites and add the new PHP GPG key and repository
sudo apt install -y apt-transport-https lsb-release ca-certificates curl apache2
sudo curl -sSLo /usr/share/keyrings/deb.sury.org-php.gpg https://packages.sury.org/php/apt.gpg
sudo sh -c 'echo "deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list'

# 3. Update the package list and install PHP 8.1 with required extensions
sudo apt update
sudo apt install php8.1 libapache2-mod-php8.1 php8.1-mysql php8.1-curl php8.1-xml php8.1-gd php8.1-mbstring php8.1-intl php8.1-zip -y

# 4. Enable Apache rewrite module and restart
sudo a2enmod rewrite
sudo systemctl restart apache2
Enter fullscreen mode Exit fullscreen mode

I activated the Apache rewrite module (a2enmod rewrite) to facilitate search engine friendly URL structures for the e-commerce platform.

6. PrestaShop Installation & Database Connection

With the environment ready, I pulled the latest PrestaShop release directly onto the server using wget and deployed the installation files to the /var/www/html/ web root.

sudo chown -R www-data:www-data /var/www/html/
sudo chmod -R 755 /var/www/html/
Enter fullscreen mode Exit fullscreen mode

I modified the folder ownership to the www-data user and applied 755 permissions. This ensures the application has the proper write access to function, without exposing the files to broader system access.

I then initiated the web-based installation wizard via the public DNS. During the initial setup, I encountered a "Database Server is not found" error. I quickly realized two things:

  1. I could not use 127.0.0.1 (localhost) because this violates the decoupled architecture; the database is not on the same server.
  2. I had to use the exact RDS Endpoint URL and ensure the RDS Security Group accurately referenced the EC2 Security Group ID.

After providing the correct remote RDS endpoint and credentials, the connection succeeded.

Once the installation completed, I removed the /install directory to harden security and prevent malicious re-installation.

The PrestaShop environment successfully transitioned to a live state:

What I Would Improve in a v2

  • Automate the provisioning process using declarative Infrastructure as Code (Terraform) instead of relying on manual AWS Console configuration.
  • Place the RDS instance into a dedicated private subnet with no internet gateway route to provide an even stronger network boundary.
  • Implement an Application Load Balancer (ALB) in front of the EC2 instance to allow for HTTPS termination and future horizontal scaling.

Key Takeaways

  • Decoupling stateful data from stateless compute is the foundation of a resilient architecture.
  • The Principle of Least Privilege applies directly to network traffic. Restricting database access to a specific application security group is a baseline requirement.
  • When working with modern Linux distributions, legacy package repositories often break. Knowing how to manually manage GPG keys and sources lists is a critical debugging skill.

What Is Next

Follow me for more content about Cloud Engineering and DevOps. Follow along on my Dev.to profile and my github profile if you want to see how it goes.

Top comments (0)