Lesson 10 — Enterprise EC2 Architecture

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 05 – Amazon EC2 Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand enterprise EC2 architecture principles.
Design highly available EC2 environments.
Build secure multi-tier architectures.
Understand Auto Scaling and Load Balancing.
Implement defence-in-depth.
Apply enterprise security controls.
Design resilient production workloads.

📚 Lesson Information

Estimated Time: 3 Hours

Difficulty: Intermediate

Prerequisites: Lesson 09 – Monitoring, Logging & Backup

Hands-on Lab: Yes

💼 Business Scenario

CloudNova Technologies has grown rapidly.

The platform now supports:

250,000+ registered learners
Thousands of concurrent users
Online examinations
Video streaming
AI-powered learning assistants
Student laboratories

Initially, the application ran on a single EC2 instance.

Although suitable for testing, the architecture has become a business risk.

Problems include:

Single Point of Failure
No High Availability
Limited Scalability
Difficult Maintenance
Increased Downtime Risk

The Cloud Security team has been asked to redesign the platform using AWS Well-Architected and enterprise security best practices.

🚨 Single Server Architecture

Many small organisations start with one EC2 instance.

             Internet

                 │

              EC2 Server

                 │

              Database

Problems:

❌ Single Point of Failure

❌ No redundancy

❌ Difficult maintenance

❌ Limited scalability

❌ High business risk

Enterprise Architecture Principles

CloudNova follows these design principles:

High Availability
Fault Tolerance
Scalability
Least Privilege
Defence in Depth
Infrastructure as Code
Monitoring by Default
Backup by Default
Secure by Design

CloudNova Enterprise Architecture

                          Internet
                               │
                     AWS Shield Standard
                               │
                     AWS Web Application Firewall
                               │
                     Application Load Balancer
                   ┌────────────┴────────────┐
                   │                         │
           Availability Zone A      Availability Zone B
                   │                         │
        Auto Scaling Group         Auto Scaling Group
                   │                         │
             EC2 Instance              EC2 Instance
                   │                         │
          Private Application Subnets (Multi-AZ)
                   │
          Amazon RDS (Multi-AZ)
                   │
              Amazon S3
                   │
      CloudWatch • CloudTrail • AWS Backup

This architecture removes the single point of failure and improves security and resilience.

Multi-AZ Deployment

Production workloads should span multiple Availability Zones.

Availability Zone A

↓

Application Server

↓

Availability Zone B

↓

Application Server

Benefits:

High Availability
Fault Tolerance
Maintenance without downtime
Improved resilience

Public vs Private Architecture

CloudNova separates internet-facing and internal resources.

Internet

↓

Public Subnet

↓

Application Load Balancer

↓

Private Application Subnet

↓

Amazon RDS

Application servers remain private and are never directly exposed to the Internet.

Layered Security

CloudNova implements multiple security controls.

Internet

↓

AWS Shield

↓

AWS WAF

↓

Security Groups

↓

Network ACLs

↓

IAM

↓

EC2 Hardening

↓

Application Security

If one control fails, additional layers continue to protect the environment.

Auto Scaling

Auto Scaling automatically adjusts the number of EC2 instances based on demand.

Example:

100 Users

↓

2 EC2 Instances

↓

5,000 Users

↓

8 EC2 Instances

Benefits:

High Availability
Cost Optimisation
Automatic Scaling
Improved Performance

Auto Scaling Workflow

CloudWatch Alarm

↓

High CPU

↓

Auto Scaling Policy

↓

Launch New EC2 Instance

↓

Load Balancer Registers Instance

The process is automatic and requires no manual intervention.

Application Load Balancer (ALB)

The Application Load Balancer distributes incoming traffic across multiple EC2 instances.

Application Load Balancer

      │

───────────────

│             │

EC2-01      EC2-02

Benefits:

Even traffic distribution
Health checks
SSL termination
High Availability
Simplified maintenance

Security Groups

CloudNova applies different Security Groups to each layer.

Resource	Security Group
ALB	ALB-SG
Application Servers	APP-SG
Database	DB-SG

Traffic flow:

Internet

↓

ALB-SG

↓

APP-SG

↓

DB-SG

This limits communication to only approved paths.

Identity & Access Management

CloudNova uses IAM Roles instead of AWS Access Keys.

Example:

EC2

↓

IAM Role

↓

Amazon S3

↓

CloudWatch

↓

Systems Manager

Benefits:

Temporary credentials
Least privilege
Centralised management
Improved auditing

Secure Storage

Every EC2 instance uses:

Encrypted EBS Volumes
AWS KMS
Daily Snapshots
AWS Backup

Data remains protected even if physical storage is compromised.

Monitoring & Logging

Every production server sends information to:

CloudWatch

↓

CloudTrail

↓

AWS Backup

↓

Security Dashboard

Security teams monitor:

CPU
Memory
Disk
Failed Logins
API Activity
Backup Status

Disaster Recovery

CloudNova prepares for infrastructure failures.

Recovery strategy:

EBS Snapshot

↓

Restore Volume

↓

Launch EC2

↓

Application Online

Business continuity depends on tested backup and recovery procedures.

Enterprise Deployment Lifecycle

Infrastructure as Code

↓

Deploy Networking

↓

Deploy Security Controls

↓

Launch EC2

↓

Attach IAM Role

↓

Configure Monitoring

↓

Patch

↓

Backup

↓

Production

This standardised process ensures consistency across environments.

CloudNova Security Checklist

Every production EC2 deployment must meet these requirements.

Security Control	Required
Private Subnet	✅
IAM Role	✅
EBS Encryption	✅
Session Manager	✅
CloudWatch Agent	✅
Security Groups	✅
Auto Scaling	✅
Application Load Balancer	✅
AWS Backup	✅
CloudTrail	✅

🛠 Lab 01 — Review Enterprise Architecture

Open the AWS Console and review the following services:

Amazon EC2

↓

Load Balancers

↓

Auto Scaling Groups

↓

Target Groups

↓

Launch Templates

Understand how these services work together.

🛠 Lab 02 — Create a Launch Template

Navigate to:

EC2

↓

Launch Templates

↓

Create Launch Template

Configure:

Setting	Value
Name	CloudNova-Web-Template
AMI	CloudNova-Secure-AMI-v1
Instance Type	t3.micro
IAM Role	CloudNova-EC2-Role
Security Group	APP-SG
Storage	Encrypted GP3

Launch Templates ensure every new EC2 instance is configured consistently.

🛠 Lab 03 — Create an Auto Scaling Group

Navigate to:

EC2

↓

Auto Scaling Groups

↓

Create Auto Scaling Group

Configure:

Launch Template: CloudNova-Web-Template
VPC: CloudNova-Prod-VPC
Subnets: Private-App-A and Private-App-B

Capacity:

Setting	Value
Desired	2
Minimum	2
Maximum	6

🛠 Lab 04 — Attach an Application Load Balancer

Attach the Auto Scaling Group to an existing or new Application Load Balancer.

Verify:

Health checks are passing.
Instances register successfully with the Target Group.
Traffic is distributed across instances.

🛠 Lab 05 — Configure Scaling Policy

Create a scaling policy.

Example:

Metric

CPUUtilization

Threshold

70%

Action

Add One EC2 Instance

Create a scale-in policy when CPU utilisation falls below an appropriate threshold (for example, 30%) after sustained low usage.

🛠 Lab 06 — Verify Monitoring

Navigate to:

CloudWatch

↓

Dashboards

↓

EC2 Metrics

Review:

CPU Utilisation
Network Traffic
Auto Scaling Events
Instance Health

🛠 Lab 07 — Simulate Instance Failure

Terminate one EC2 instance from the Auto Scaling Group.

Observe:

Health check failure.
Instance termination.
Automatic replacement.
New instance registration with the Load Balancer.

This demonstrates self-healing infrastructure.

💻 AWS CLI Lab

Describe Launch Templates

aws ec2 describe-launch-templates

Describe Auto Scaling Groups

aws autoscaling describe-auto-scaling-groups

Describe Load Balancers

aws elbv2 describe-load-balancers

Describe Target Groups

aws elbv2 describe-target-groups

Describe Target Health

aws elbv2 describe-target-health \
    --target-group-arn arn:aws:elasticloadbalancing:region:account-id:targetgroup/target-group-name/xxxxxxxx

Describe Scaling Activities

aws autoscaling describe-scaling-activities

✅ Verification

Verify:

✔ EC2 instances deployed across multiple Availability Zones.

✔ Auto Scaling Group operational.

✔ Launch Template configured.

✔ Application Load Balancer distributing traffic.

✔ Security Groups applied correctly.

✔ IAM Roles attached.

✔ CloudWatch monitoring enabled.

✔ CloudTrail recording API activity.

✔ AWS Backup configured.

🔍 Troubleshooting

Problem

Auto Scaling does not launch new instances.

Check:

Launch Template configuration.
Service quotas.
Scaling policy thresholds.
IAM permissions.

Problem

Load Balancer reports unhealthy targets.

Verify:

Health check path.
Security Group rules.
Application service is running.
Target Group configuration.

Problem

Instances fail to register.

Review:

VPC and subnet configuration.
Route tables.
Security Groups.
Target Group settings.

Problem

Traffic only reaches one instance.

Check:

Target registration.
Health check status.
Availability Zone configuration.
Auto Scaling Group health.

🏢 Enterprise Best Practices

CloudNova standards:

Never deploy production workloads on a single EC2 instance.
Use multiple Availability Zones for high availability.
Place application servers in Private Subnets.
Use Launch Templates for consistent deployments.
Configure Auto Scaling based on demand.
Protect internet-facing applications with AWS WAF and AWS Shield.
Apply least privilege IAM Roles.
Encrypt all EBS volumes.
Monitor infrastructure continuously.
Test disaster recovery procedures regularly.

🚫 Common Mistakes

❌ Running production on a single EC2 instance.

❌ Deploying application servers with Public IP addresses.

❌ Using manual server builds instead of Launch Templates.

❌ Ignoring Load Balancer health checks.

❌ Not testing Auto Scaling events.

❌ Forgetting monitoring and backup.

❌ Applying overly permissive Security Groups.

🧪 DIY Challenge

Design a production-ready architecture for CloudNova.

Requirements:

Two Availability Zones
Application Load Balancer
Auto Scaling Group
Two private application subnets
Amazon RDS Multi-AZ
IAM Roles
Session Manager
CloudWatch
CloudTrail
AWS Backup
Encrypted EBS volumes

Tasks:

Draw the architecture diagram.
Create a Launch Template.
Configure an Auto Scaling Group.
Attach an Application Load Balancer.
Create CloudWatch Alarms for scaling.
Test Auto Scaling by increasing CPU load or simulating instance failure.
Verify that traffic continues without interruption.

Capture screenshots of:

Launch Template
Auto Scaling Group
Application Load Balancer
Target Group
CloudWatch Dashboard
Scaling Activities
AWS CLI outputs

📊 Knowledge Check

Why is a single EC2 instance unsuitable for most production workloads?
What is the purpose of an Application Load Balancer?
How does Auto Scaling improve availability?
Why are Private Subnets recommended for application servers?
What is the purpose of a Launch Template?
How do Security Groups protect a multi-tier architecture?
What AWS services help monitor enterprise EC2 environments?
How do backups support disaster recovery?
What happens when an instance in an Auto Scaling Group becomes unhealthy?
Which architectural principles make CloudNova’s environment resilient and secure?

💡 Key Takeaways

After completing this lesson, you should understand:

Enterprise EC2 environments are designed for high availability, scalability and resilience rather than relying on individual servers.
Application Load Balancers, Auto Scaling Groups and Multi-AZ deployments work together to eliminate single points of failure.
Security is implemented in layers using IAM Roles, Security Groups, encrypted storage, monitoring and backup services.
Standardised deployment through Launch Templates and automated scaling improves operational consistency and reduces manual effort.
A well-designed enterprise architecture enables CloudNova to deliver secure, reliable and scalable services while supporting business continuity.

🚀 Next Lesson

➡️ Lesson 11 — Enterprise Build Project