Running a Secure Web Server on AWS EC2

Overview

This article seeks to describe how to run a sophisticated web server on AWS using Infrastructure-as-a-Service (IaaS) architecture.

The Architecture

Set up a Virtual Private Cloud (VPC). This cloud local network will contain two public subnets and two private subnets. Create an AWS Elastic Compute Cloud (EC2) instance running Ubuntu 20.04 LTS, and configure the security groups to allow your local machine to connect to it via SSH. Download and save the key pair. This machine will be used as a Bastion Host from which you can securely connect to the web server. Then launch another EC2 instance running Ubuntu 20.04 LTS in one of the private subnets. Download and save the key pair. This instance will host the web server. Launching the instance in a private subnet will give the web server some level of security, since it will only be reachable to only hosts/devices within the same Virtual Private Cloud (VPC). Be sure to configure the security group of this instance to allow SSH traffic from the Bastion Host.

Prerequisite Software

Copy the command to connect to your bastion host from the AWS console and run the command in your local Linux shell.

Once connected to the Bastion EC2, run the following command to copy the downloaded server key pair file to the bastion host. This will allow you to connect to the web server host.

scp -i "~/path-to-key/keypair.pem" /part-to-key/keypair.pem  ubuntu@<dns-of-ec2>:~/.

Then copy the command to connect to your bastion host from the AWS console and run the command:

Once you gain access to the web server instance, run the following commands to install NGINX server on it:

sudo apt update
sudo apt install nginx
sudo ufw allow 'Nginx HTTP'
systemctl status nginx

Output

Run the following command to see the server IP address:
curl -4 icanhazip.com

Verify that the sever is up and running by pasting the IP in your web browser.