Project Overview
In this lab, a DevOps engineer orchestrates the entire lifecycle of a professional product website. The developer supplies the source code, which is versioned in GitHub. The engineer constructs a production‑grade AWS environment, configures a continuous integration pipeline in GitHub Actions, and delivers containerized workloads to Amazon ECS. The final application is reachable at a custom domain and displays the product’s name.
Application Development
The application must contain a responsive homepage, product branding, and multiple content sections. After local development, the code is committed to a private GitHub repository. The repository serves as the single source of truth and triggers automated pipelines.
AWS Infrastructure Architecture
A dedicated VPC (10.0.0.0/16) hosts four subnets: two public and two private, each in a different AZ for high availability.
- Public Subnet – us‑east‑1a
- Public Subnet – us‑east‑1b
- Private Subnet – us‑east‑1a
- Private Subnet – us‑east‑1b
The networking stack includes:
- Internet Gateway connected to the public subnets
- Route tables directing inbound traffic through an Application Load Balancer
- NAT Gateways or instances in public subnets for outbound access from private workloads
- Security groups limiting inbound to ALB and outbound to the internet only
Compute resources are provisioned in Amazon ECS (Fargate launch type). A task definition references a Docker image stored in an Amazon ECR repository. The ECS service registers the task with the ALB target group, ensuring traffic routing and health checks.
Continuous Integration with GitHub Actions
The CI workflow activates on every push to the main branch. Key stages include:
- Checkout – repository source is fetched.
- Dependency Installation – Node.js, npm, or other runtime packages are installed.
- Unit & Integration Tests – automated test suites run to validate functionality.
- Static Analysis – SonarQube evaluates code quality and detects defects.
- Docker Build – an image is constructed from the Dockerfile.
- Security Scan – Trivy inspects the image for known vulnerabilities.
- Credential Authentication – AWS IAM credentials stored as GitHub secrets allow the action to interact with AWS.
- Image Push – the validated image is uploaded to ECR.
Is this application safe and ready to deploy?
Only upon passing all steps does the image become available for deployment.
Secure Container Deployment
Once the image resides in ECR, the deployment stage can be triggered manually or automatically via a CD pipeline (e.g., GitHub Actions, CodePipeline, or GitLab Auto DevOps). The ECS service pulls the latest image, performs rolling updates, and exposes the application through the ALB. IAM roles enforce the principle of least privilege, ensuring the ECS task can only access necessary AWS resources.
Monitoring and logging are enabled through Amazon CloudWatch and X‑Ray, providing visibility into performance and tracing of requests across services.
By following this structured approach, teams achieve repeatable, secure, and scalable deployments for any professional product website.
Leave a Reply