Compute
| Instance type | t3.medium (2 vCPU, 4 GB RAM) |
|---|---|
| Tenancy | Default VPC tenancy |
| AMI | Amazon Linux 2023 (hardened) |
| Auto Scaling | Min 2 / Max 8, target CPU 60% |
| IMDSv2 | Required — v1 disabled |
| EBS encryption | AES-256 (AWS-managed CMK) |
| Security group | Ingress: ALB SG only, port 443. Egress: NAT GW |
Database
| Engine | PostgreSQL 16.2 |
|---|---|
| Instance class | db.t3.large (2 vCPU, 8 GB RAM) |
| Multi-AZ | Enabled — synchronous standby replica in AZ-B |
| Failover time | ~60–120 seconds |
| Encryption | At-rest (AES-256) and in-transit (TLS 1.2+) |
| Backups | Automated — 7-day retention, point-in-time recovery |
| Security group | Ingress: EC2 SG only, port 5432. No public access |
Load Balancer & WAF
| Type | Application Load Balancer (Layer 7) |
|---|---|
| Listeners | HTTPS:443 only — HTTP:80 redirected |
| TLS policy | ELBSecurityPolicy-TLS13-1-2-2021-06 |
| WAF | AWS Managed Rules: AWSManagedRulesCommonRuleSet + SQLi |
| Access logs | Enabled — S3 with 90-day retention |
| Deletion protection | Enabled |
Storage & Networking
| S3 bucket | Static assets — private, no public access block |
|---|---|
| S3 access | VPC Gateway Endpoint — traffic stays within AWS network |
| S3 encryption | SSE-S3 (AES-256) |
| VPC CIDR | 10.0.0.0/16 — /24 subnets per AZ per tier |
| Flow logs | VPC Flow Logs to CloudWatch — 30-day retention |
| NAT Gateway | One per AZ for private subnet egress |
Security Design Decisions
IMDSv2 Enforced on All Instances
IMDSv1 is trivially accessible from within an SSRF-vulnerable application — a single
HTTP request to 169.254.169.254 returns credentials. IMDSv2 requires a
session token obtained via a PUT request, which SSRF cannot perform in most
configurations. All instances in this architecture set HttpTokens = required
at the instance level, with an SCP enforcing this at the account level.
No Public Ingress to EC2 or RDS
EC2 security groups allow inbound traffic only from the ALB security group ID, not from a CIDR range. RDS security groups allow inbound only from the EC2 security group ID. This means there is no IP range that can be added to reach the database directly — the access path is ALB → EC2 → RDS only.
S3 via VPC Gateway Endpoint
S3 traffic from EC2 uses a VPC Gateway Endpoint rather than routing through the NAT Gateway or over the public internet. The bucket policy restricts access to requests originating from the VPC endpoint ID, so the bucket cannot be accessed from any other path — including from within AWS but outside the VPC.