This chapter covers the role of the ALB and its three components — listeners, target groups, and health checks — the design decision to release with HTTP only for now, and the implementation of the ALB security group and the S3 bucket for access logs.
DNS の名前解決の流れを、リゾルバからルート・TLD・権威サーバーへ辿る手順として解説します。ゾーンと委任の仕組み、TTL とキャッシュの関係、いわゆる「浸透」が何を指しているのかを扱います。
Organizes the relationships among ECS clusters, task definitions, tasks, and services, and builds the execution role and task role needed to run containers under the Fargate launch type, along with an ECR repository and log collection via CloudWatch Logs. Verifies that the foundation works using a one-off run-task.
This chapter completes the ECS service setup left unfinished in Chapter 8. We publish the web and api services behind the ALB using host-based routing, and cover everything from DB connection info injection via Secrets Manager and added S3 access permissions to rolling updates with a circuit breaker and Auto Scaling.
Learn the syntax and evaluation order of IAM policy JSON and the relationship between roles and trust policies, then create a dedicated IAM user and group for Terraform execution to move off administrator-equivalent credentials.
A hub for the domain that collects notes on building and running infrastructure, including Docker, AWS, Terraform, and CI/CD. It currently holds a series on AWS design and its Terraform implementation.
This is the final chapter of the series. It brings together the cost information scattered across earlier chapters into a single map and shows cost-reduction patterns for the development environment. It then covers the teardown procedure for safely ending the learning infrastructure, along with the next steps left out of scope for this series.
Defines the functional and non-functional requirements for the fictional task management SaaS "Tasuku" used throughout this series, and explains the overall architecture built with VPC, Route 53, S3, ALB, ECS, RDS, and IAM, along with the build order based on resource dependencies.
This is the top page of a series that designs and builds, with Terraform, the production environment of the fictional task management SaaS "Tasuku," centered on seven AWS services: VPC, Route 53, S3, ALB, ECS, RDS, and IAM.
This chapter organizes the operational tasks RDS handles as a managed service versus the design decisions Tasuku owns, covering instance class, storage, and Multi-AZ selection, master password integration with Secrets Manager, and completing the security group chain. It closes with a connectivity check using run-task and psql.
Covers the basics of Route 53 hosted zones and DNS delegation, how ACM's DNS validation works, adding a port 443 listener, and redirecting port 80 to HTTPS.
This chapter covers the four principles of S3 bucket design, the chicken-and-egg problem that arises when moving Terraform state to S3, implementing the bucket for attachments, and the path for S3 access through a VPC endpoint.
We run an end-to-end connectivity check on the Tasuku infrastructure built through Chapter 10, and standardize the ECS deployment tag strategy. We then refactor the Terraform code from a single-environment flat structure into a module + envs/dev,prod structure.
With a minimal Terraform configuration, learn HCL syntax, provider version pinning, and the concept of state, and create an AWS Budgets budget alert as your first apply.
Covers VPC CIDR design, a 3-tier subnet layout spanning two Availability Zones, and the cost trade-offs of redundant NAT Gateways.