DEV Community

Manthan Ankolekar
Manthan Ankolekar

Posted on

🚀 Deploying a Node.js CRUD App on AWS with Terraform

#node #aws #terraform #webdev

Managing cloud infrastructure manually can quickly become messy. Terraform allows us to define infrastructure as code (IaC), making deployments repeatable, version-controlled, and automated.

In this guide, we’ll build a Node.js CRUD API (with Express + MongoDB) and deploy it to AWS ECS Fargate using Terraform.

🧩 What We’re Building

  • A RESTful Todo API (CRUD endpoints with Express + MongoDB).
  • Dockerized app pushed to Amazon ECR.
  • AWS ECS Fargate service running containers in a managed VPC.
  • Application Load Balancer (ALB) to expose the service.
  • Secrets Manager for storing MongoDB credentials securely.
  • CloudWatch Logs for centralized logging.

Here’s the final architecture:

Client → ALB → ECS (Fargate Task) → MongoDB (Atlas/Local)
        ↑
      CloudWatch (logs)
Enter fullscreen mode Exit fullscreen mode

🛠️ Tech Stack

Backend

  • Node.js + Express
  • MongoDB + Mongoose
  • CORS + dotenv

Infrastructure

  • Docker (containerization)
  • Terraform (IaC)
  • AWS ECR (image registry)
  • AWS ECS Fargate (orchestration)
  • AWS ALB (load balancing)
  • AWS Secrets Manager (secure DB credentials)
  • AWS IAM + Security Groups

📁 Project Structure

Your project is split into two main parts: app code and infra code.

manthanank-nodejs-terraform/
├── server.js                 # Express entry
├── Dockerfile                # Build container
├── config/db.js              # Mongo connection
├── controllers/todoController.js
├── models/Todo.js
├── routes/todoRoutes.js
├── terraform/                # Infrastructure as Code
│   ├── vpc.tf                # VPC + networking
│   ├── ecs.tf                # ECS cluster/service
│   ├── ecr.tf                # ECR repo
│   ├── iam.tf                # IAM roles/policies
│   ├── security.tf           # Security groups
│   ├── logs.tf               # CloudWatch logs
│   ├── secrets.tf            # Secrets Manager
│   ├── variables.tf          # Config vars
│   ├── outputs.tf            # Useful outputs
│   └── provider.tf           # AWS provider setup
Enter fullscreen mode Exit fullscreen mode

📝 Step 1 — Build the Node.js API

Our CRUD endpoints live under /api/todos.
Example schema:

const todoSchema = new mongoose.Schema({
  title: { type: String, required: true, trim: true },
  description: { type: String, default: "" },
  completed: { type: Boolean, default: false },
  createdAt: { type: Date, default: Date.now },
});
Enter fullscreen mode Exit fullscreen mode

Start locally:

npm install
npm run dev
Enter fullscreen mode Exit fullscreen mode

Test:

curl http://localhost:5000/api/todos
Enter fullscreen mode Exit fullscreen mode

📦 Step 2 — Dockerize the App

Dockerfile:

FROM node:18-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
ENV PORT=5000
EXPOSE 5000
CMD ["node", "server.js"]
Enter fullscreen mode Exit fullscreen mode

Build locally:

docker build -t nodejs-todo-api .
docker run -p 5000:5000 -e MONGO_URI=your_mongo_uri nodejs-todo-api
Enter fullscreen mode Exit fullscreen mode

☁️ Step 3 — Terraform AWS Infrastructure

Initialize 

cd terraform
terraform init
Enter fullscreen mode Exit fullscreen mode

Key Resources

  • ECR — stores our container image (ecr.tf).
  • ECS Fargate Service — runs containers (ecs.tf).
  • ALB + Target Group — load balancing (ecs.tf).
  • VPC + Subnets — networking (vpc.tf).
  • IAM Roles — ECS execution permissions (iam.tf).
  • Secrets Manager — injects MONGO_URI securely (secrets.tf).
  • CloudWatch Logs — for application logs (logs.tf).

🐳 Step 4 — Push Image to ECR

  1. Create the repo: 
terraform apply -target=aws_ecr_repository.app -auto-approve
Enter fullscreen mode Exit fullscreen mode
  1. Build & push: 
AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
REGION=ap-south-1
REPO=$AWS_ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com/node-crud-app
IMAGE_TAG=v1

docker build -t node-crud-app:$IMAGE_TAG .
aws ecr get-login-password --region $REGION | \
  docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com
docker tag node-crud-app:$IMAGE_TAG $REPO:$IMAGE_TAG
docker push $REPO:$IMAGE_TAG
Enter fullscreen mode Exit fullscreen mode

🚀 Step 5 — Deploy with Terraform

Apply the full infra:

terraform apply
Enter fullscreen mode Exit fullscreen mode

Grab the output:

terraform output alb_dns
Enter fullscreen mode Exit fullscreen mode

Test:

curl http://<alb_dns>/api/todos
Enter fullscreen mode Exit fullscreen mode

🔄 Step 6 — Deploy Updates

  1. Build and push a new image with IMAGE_TAG=v2.
  2. Update variables.tf → image_tag = "v2".
  3. Run: 
terraform apply -var="image_tag=v2"
Enter fullscreen mode Exit fullscreen mode

ECS performs a rolling update behind the ALB.

📊 Monitoring & Logs

  • CloudWatch Logs: All app logs stream automatically.
  • ALB Health Checks: Ensure tasks are healthy.
  • Troubleshooting: Check ECS task logs in CloudWatch if service won’t start.

🔒 Security Best Practices

  • Use private subnets + NAT Gateway in production.
  • Restrict Secrets Manager IAM role to a single secret ARN.
  • Use immutable image tags (v1, v2) instead of latest.
  • Enable HTTPS on ALB with ACM certificates.

🎯 Conclusion

With just a few .tf files, we’ve automated provisioning of:

  • Containerized Node.js API
  • Secure AWS networking & IAM
  • Load-balanced ECS service
  • Secrets and logs managed by AWS

This approach scales to any microservice — just add more services, modules, or CI/CD pipelines.

✨ Pro tip: Next step, integrate GitHub Actions or GitLab CI to automatically build/push Docker images and run terraform apply for full CI/CD.

🔗 GitHub Repository: manthanank/nodejs-terraform
🧑‍💻 Author: Manthan Ankolekar

Top comments (0)