Cloud

AWS Production Deployment Guide

Deploy production applications on AWS with EC2, RDS, S3, CloudFront, Lambda, VPC design, and enterprise security configurations.

What you'll learn

Design a production VPC with public, private, and data subnets
Deploy EC2 instances with auto-scaling and load balancing
Set up RDS PostgreSQL with Multi-AZ and automated backups
Configure S3 with CloudFront CDN for static assets
Implement IAM roles with least-privilege policies
Set up CloudWatch monitoring and alerting
Use Lambda for serverless background jobs

VPC Design

Bash

1# 3-tier VPC: public → app → data
2# CIDR: 10.0.0.0/16
3
4# Public subnets (ALB, NAT Gateway)
510.0.0.0/24  us-east-1a
610.0.1.0/24  us-east-1b
7
8# Private app subnets (EC2, ECS)
910.0.10.0/24 us-east-1a
1010.0.11.0/24 us-east-1b
11
12# Data subnets (RDS, ElastiCache)
1310.0.20.0/24 us-east-1a
1410.0.21.0/24 us-east-1b
15
16# Create with AWS CLI
17aws ec2 create-vpc --cidr-block 10.0.0.0/16   --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=prod-vpc}]'
18
19# Enable DNS
20aws ec2 modify-vpc-attribute --vpc-id vpc-xxx --enable-dns-hostnames
21aws ec2 modify-vpc-attribute --vpc-id vpc-xxx --enable-dns-support

EC2 & Auto Scaling

Bash

1# Launch Template
2aws ec2 create-launch-template   --launch-template-name prod-web   --launch-template-data '{
3    "ImageId": "ami-0c02fb55956c7d316",
4    "InstanceType": "t3.medium",
5    "SecurityGroupIds": ["sg-web"],
6    "IamInstanceProfile": {"Name": "ec2-web-role"},
7    "UserData": "BASE64_ENCODED_USERDATA"
8  }'
9
10# Auto Scaling Group
11aws autoscaling create-auto-scaling-group   --auto-scaling-group-name prod-web-asg   --launch-template LaunchTemplateName=prod-web,Version='$Latest'   --min-size 2 --max-size 10 --desired-capacity 3   --vpc-zone-identifier "subnet-app-1a,subnet-app-1b"   --target-group-arns arn:aws:elasticloadbalancing:...:targetgroup/prod-web/...
12
13# Target Tracking Scaling Policy — 70% CPU
14aws autoscaling put-scaling-policy   --policy-name cpu-tracking   --auto-scaling-group-name prod-web-asg   --policy-type TargetTrackingScaling   --target-tracking-configuration '{"PredefinedMetricSpecification":{"PredefinedMetricType":"ASGAverageCPUUtilization"},"TargetValue":70}'

RDS PostgreSQL

Bash

1# Create RDS instance with Multi-AZ
2aws rds create-db-instance   --db-instance-identifier prod-postgres   --db-instance-class db.t3.medium   --engine postgres   --engine-version 16.2   --master-username dbadmin   --master-user-password "$(aws secretsmanager get-secret-value --secret-id prod/db/password --query SecretString --output text)"   --allocated-storage 100   --storage-type gp3   --multi-az   --backup-retention-period 7   --deletion-protection   --db-subnet-group-name prod-data-subnets   --vpc-security-group-ids sg-database   --no-publicly-accessible
3
4# Retrieve endpoint
5aws rds describe-db-instances   --db-instance-identifier prod-postgres   --query 'DBInstances[0].Endpoint.Address' --output text

S3 & CloudFront

Bash

1# Create private S3 bucket
2aws s3api create-bucket --bucket prod-myapp-assets --region us-east-1
3aws s3api put-public-access-block --bucket prod-myapp-assets   --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
4
5# CloudFront distribution with OAC
6aws cloudfront create-distribution --distribution-config '{
7  "Origins": {
8    "Quantity": 1,
9    "Items": [{
10      "Id": "s3-origin",
11      "DomainName": "prod-myapp-assets.s3.amazonaws.com",
12      "S3OriginConfig": {"OriginAccessIdentity": ""}
13    }]
14  },
15  "DefaultCacheBehavior": {
16    "ViewerProtocolPolicy": "redirect-to-https",
17    "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6"
18  },
19  "Comment": "prod-assets", "Enabled": true
20}'

IAM & Security

JSON

1# Least-privilege EC2 role — can read from S3 and fetch secrets only
2{
3  "Version": "2012-10-17",
4  "Statement": [
5    {
6      "Effect": "Allow",
7      "Action": ["s3:GetObject"],
8      "Resource": "arn:aws:s3:::prod-myapp-assets/*"
9    },
10    {
11      "Effect": "Allow",
12      "Action": ["secretsmanager:GetSecretValue"],
13      "Resource": "arn:aws:secretsmanager:us-east-1:123456789:secret:prod/*"
14    }
15  ]
16}

Monitoring

Enable CloudWatch Container Insights for ECS or detailed EC2 metrics.
Set alarms on CPU > 80%, memory > 85%, RDS connections > 80% of max, and 5xx error rate.
Use CloudWatch Logs Insights to query structured application logs.
Enable AWS Config to detect configuration drift from your security baseline.
Enable GuardDuty for threat detection across the account.

Lambda Functions

Bash

1# Deploy a Node.js Lambda
2zip -r function.zip index.js node_modules/
3
4aws lambda create-function   --function-name prod-email-sender   --runtime nodejs20.x   --role arn:aws:iam::123456789:role/lambda-exec-role   --handler index.handler   --zip-file fileb://function.zip   --timeout 30   --memory-size 256   --environment Variables='{SMTP_SECRET=prod/smtp}'
5
6# Trigger via EventBridge (cron)
7aws events put-rule --name daily-report --schedule-expression "cron(0 8 * * ? *)"
8aws lambda add-permission --function-name prod-email-sender   --statement-id eventbridge-invoke --action lambda:InvokeFunction   --principal events.amazonaws.com   --source-arn arn:aws:events:us-east-1:123456789:rule/daily-report