Dynamic site with ALB, ECS and RDS

Comments

• ECS tasks run in private subnets and only the ALB is exposed. RDS has no public access either.
• ACM appears only in the text of step 2. The certificate is used by CloudFront and must be created in us-east-1, as in diagram 1.
• CloudFront uses two behaviors: one for dynamic paths, which go to the ALB, and one for static files, which go to S3.
• Fargate removes server management, but you pay for the vCPU and memory of each task.

Information flow

1. Amazon Route 53

   The user resolves the domain with Route 53.

2. Amazon CloudFront

   CloudFront receives the request over HTTPS with the ACM certificate and picks the origin based on the behavior.

3. Application Load Balancer

   Dynamic requests reach the ALB, which only sends traffic to healthy targets.

4. Amazon ECS (Fargate)

   The ALB distributes traffic to ECS tasks in private subnets.

5. Amazon RDS

   The tasks read and write data in Amazon RDS.

6. Amazon S3

   CSS, JS and images are served from S3 through CloudFront.