Deploying a Secure Three-Tier Book Review App on AWS

Deploy Book Review App (Three-Tier Architecture) on AWS

Ebelechukwu Lucy Okafor successfully deployed a full-stack Book Review App using a production-grade three-tier architecture on AWS. The system utilizes six subnets across two Availability Zones to ensure high availability and strict network isolation between tiers.

Why This Matters

Transitioning from local development to production-grade cloud architecture requires a shift from simple connectivity to zero-trust networking. By implementing a ‘chain of trust’ through nested security groups and private subnets, engineers can ensure that critical database and application tiers remain entirely unreachable from the public internet, significantly reducing the attack surface.

Key Insights

• High availability is achieved through a custom VPC using 6 subnets (2 public, 4 private) distributed across 2 Availability Zones.
• Network security is enforced via a ‘chain of trust’ where the RDS database tier only accepts traffic from the private App tier security group.
• Amazon RDS Multi-AZ deployment provides automatic failover, though manual database initialization via CLI is required if not specified during setup.
• Nginx functions as a reverse proxy to route traffic from the public Load Balancer to the internal Next.js server and private backend API.
• Process persistence for Node.js and Next.js is managed via PM2 to ensure automatic recovery and application uptime after instance reboots.

Working Examples

Nginx reverse proxy configuration for routing traffic between the Next.js frontend and the internal Load Balancer.

server { listen 80; server_name _; location / { proxy_pass http://localhost:3000; proxy_set_header Host $host; } location /api/ { rewrite ^/api/(.*) /$1 break; proxy_pass http://internal-alb-dns.us-east-1.elb.amazonaws.com; proxy_set_header Host $host; } }

Backend environment configuration required for database connectivity and CORS policy.

DB_HOST=your-rds-endpoint.us-east-1.rds.amazonaws.com DB_NAME=bookreview DB_USER=admin DB_PASS=your-password PORT=3001 ALLOWED_ORIGINS=http://your-public-alb-dns

Practical Applications

• Use Case: Deploying Auto Scaling Groups (ASG) with a minimum of 2 instances per tier to ensure application survival during instance failures.
• Pitfall: Truncating the ALLOWED_ORIGINS DNS string in environment variables, which results in 403 Forbidden errors during CORS preflight checks.
• Use Case: Implementing an internal Application Load Balancer to facilitate secure communication between frontend and backend tiers without internet exposure.
• Pitfall: Attempting to serve Next.js as static files via Nginx root directives instead of using a reverse proxy to the running Node.js server.

References:

• https://github.com/pravinmishraaws/book-review-app
• https://dev.to/ebelechukwu_lucyokafor/deploy-book-review-app-three-tier-architecture-on-aws-6ha