At the outset of designing the Notes application stack deployment, we described a security model that should result in a highly secure deployment. Are we the kind of security experts that can design a secure deployment infrastructure on the back of a napkin? Probably not. But the team at AWS does employ engineers with security expertise. When we turned to AWS EC2 for deployment, we learned it offered a wide range of security tools we hadn’t considered in the original plan, and we ended up with a different deployment model.
In this section, let’s review what we did and also review some additional tools available on AWS.
The AWS Virtual Private Cloud (VPC) contains many ways to implement security features, and we used a few of them:
- Security Groups act as a firewall with strict controls over the traffic that can enter or leave the things protected by a Security Group. Security Groups are attached to every infrastructure element we used, and in most cases, we configured them to allow only the absolutely necessary traffic.
- We ensured the database instances were created within the VPC, rather than hosted on the public internet. This hides the databases from public access.
While we did not implement the originally envisioned segmentation, there are enough barriers surrounding Notes that it should be relatively safe.
In reviewing the AWS VPC security documentation, there are a few other facilities that are worth exploring.
In this section, you’ve had a chance to review the security of the application that was deployed to AWS ECS. While we did a fairly good job, there is more that can be done to exploit tools offered by AWS to beef up the internal security of the application.
With that, it’s time to close out this chapter.
Source: Herron David (2020), Node.js Web Development: Server-side web development made easy with Node 14 using practical examples, Packt Publishing.