manoop madhu

Posted on Jan 5

Building a Production-Ready AWS ALB + Auto Scaling Architecture Using Terraform

#terraform #devops #architecture #aws

As part of my hands-on learning in AWS an
Terraform, I built a production-style web architecture that follows real-world cloud and DevOps best practices.

Instead of exposing EC2 instances directly to the internet, this project uses an Application Load Balancer (ALB) in public subnets and Auto Scaling Group (ASG)–managed EC2 instances running in private subnets, with outbound internet access provided via a NAT Gateway.

The entire infrastructure is provisioned using Terraform (Infrastructure as Code).

🔗 GitHub Repository:
https://github.com/manoop98/terraform-aws-alb-asg-nginx

Key design principles

✅ Only the ALB is public

✅ EC2 instances live in private subnets

✅ Auto Scaling Group ensures availability

✅ NAT Gateway enables outbound access securely

✅ Fully automated using Terraform

This architecture closely mirrors what is commonly used in production AWS environments.

Tech Stack

AWS

VPC

EC2

Application Load Balancer

Auto Scaling Group

Internet Gateway

NAT Gateway

Terraform – Infrastructure as Code

Docker – Application runtime

Nginx – Demo web server

Project Structure
terraform-aws-alb-asg-nginx/
├── alb.tf
├── asg.tf
├── network.tf
├── provider.tf
├── security_groups.tf
├── vpc.tf
├── userdata.sh
├── outputs.tf
├── .gitignore
└── README.md

How It Works
1️⃣ Networking Layer

A custom VPC is created with:

Two public subnets

Two private subnets

An Internet Gateway is attached to the VPC

Public subnets route traffic to the Internet Gateway

Private subnets route outbound traffic through a NAT Gateway

2️⃣ Application Load Balancer

The ALB is deployed in public subnets

Listens on HTTP (port 80)

Forwards traffic to a Target Group on port 8000

3️⃣ Auto Scaling Group

EC2 instances are launched using a Launch Template

Instances are placed only in private subnets

ASG automatically registers instances with the target group

Health checks are handled by the ALB

4️⃣ EC2 User Data & Application

Each EC2 instance runs a simple Dockerized Nginx server using user data:

!/bin/bash

yum update -y
yum install docker -y
systemctl start docker
systemctl enable docker

docker run -d -p 8000:80 nginx

This ensures:

Instances are ready immediately after launch

Target group health checks pass

ALB traffic works without manual intervention

Key Challenges & Learnings

This project was not just about writing Terraform — it involved real troubleshooting, which was the most valuable part.

Some key learnings:

AMI IDs are region-specific
→ Solved by using a dynamic AMI data source

ALB requires an Internet Gateway
→ Public subnets must have a route to IGW

Private EC2 instances need NAT Gateway
→ Without NAT, Docker pulls and updates fail

Not all Docker images serve content by default
→ Switched to Nginx for predictable behavior

Target group health checks are critical
→ Correct ports and paths are essential

These are the same challenges faced in real-world production environments.

Final Result

After terraform apply, the output provides an ALB DNS name.
Opening it in a browser displays the Nginx welcome page, served from EC2 instances running in private subnets.

✔ Secure
✔ Scalable
✔ Highly available
✔ Fully automated

Why This Project Matters

This project helped me gain hands-on experience with:

AWS networking fundamentals

Secure cloud architecture design

Auto Scaling and Load Balancing

Terraform best practices

Debugging real infrastructure issues

It reflects how modern DevOps teams build and manage cloud infrastructure.

Source Code

🔗 GitHub Repository:
https://github.com/manoop98/terraform-aws-alb-asg-nginx

Conclusion

Building this project significantly improved my understanding of AWS infrastructure and Terraform.
It reinforced the importance of security-first design, automation, and incremental validation.

If you’re learning AWS or Terraform, I highly recommend building something similar — the lessons learned are invaluable.