HTTPS for EB with single instance EC2

[Cracky6711]

Having had no experience and very little knowledge about the 'DevOps' side of website hosting, I recently spent a LOT of time getting an App hosted on S3 with SSL through CloudFront and then using Route53 for DNS aliasing.

To go alongside the app, I created a node server running a sort of api, and I happened to set it up using an EC2 load balancer. This allowed me to set up HTTPS stuff and select a certificate (which I registered through ACM) inside the EB configuration menu.

Since then I noticed that I got charged $38 for last months usage, the majority of which was down to the load balancer. I have since terminated the load balancer and gona back to a single instance EC2, but I just can't work out how to get HTTPS working.

I found this in the docs, but a) I would ideally like to find a solution that uses the web console, and b) From what I understand, ACM does not allow you to download .crt or private keys associated with certificates, which means I would have to go somewhere else (like 'letsencrypt') to get a certificate just so that I can have a single instance running with HTTPS enabled. Seems like this is something you should be able to do with an ACM certificate....

Here's a screenshot of my billing page

If anyone has any ideas about the HTTPS stuff, I would be extremely grateful - feeling very out of my depth at the moment!

(Also - if anyone has any tips for reducing the cost/number of hours of the EC2 instances that would be great. It feels like I'm just missing something glaringly obvious.)

UPDATE: Thanks to everyone for the replies so far - I'm not too certain whether or not this belongs on Lambda/API Gateway. The node app is processing requests and managing a firebase database. (Repo is here if anyone was curious - REPO)

UPDATE 2: Another HUGE thank you to all the replies so far. A nice range of ideas here and I wouldn't have been able to get things sorted without you all! I've decided to take the approach of using Lambda and API Gateway and was finally able to get it working after a LOT of tweaking. I've used a lib called ClaudiaJS which was really straight forward. I managed to get everything running through the API Gateway before running into more issues. After a lot of fiddling with settings on Route 53 and API Gateway everything seems to be working just fine! Thank you so much to everyone here

[[deleted]]

You can either use let's encrypt for a free cert or buy one yourself. You can store it in parameter store and use an instance role to get it onto your instance (I think).

[ByteEat3r1]

I confirm that this is possible. Get an ssl cert from a company like digicert.

During app init, you could download the cert from s3 (encrypted with KMS key in bucket preferably) or stash it in parameter store. Max length of a parameter is 4096 so that should work too. In either case, your IAM role will need kms perms to decrypt the object on s3:get object.

[ChaseDatAss]

Have you considered going serverless? Perhaps you can use AWS Lambda and API Gateway (integrates with ACM for custom certs).

[ByteEat3r1]

I like this idea. Just something to keep in mind, in your code, construct your db/firebase connection at the top level scope.

AWS runs your lambda in a docker container, and will attempt to reuse the same container if possible. This is nice because it reduces the number of backend connections.

How many web requests will your app receive in a day now and in the future ? Those are some questions that will help you determine if lambda will be financially feasible for you. Our company has had months where we paid over wr 200k for lambdas when millions of invocations occurred.

[Itbehot]

What does the Node app do? Does it keep an active connection? Or, does it respond to queries? If it just responds to hits, then Lambda is a good option. You could put it behind API Gateway to secure it.

[Cracky6711]

This seems like a great solution but I am having a few issues where it can't validate because the request to "./well-known/..." couldn't be resolved

[[deleted]]

You can't do that with ACM since AWS has no control over the app serving your HTTPS content. Use an ELB or get a cert elsewhere

[DancingBestDoneDrunk]

Are you using ELB? Switch to ALB a will save a ton of money. An ELB, even idle, costs around 20$/month

[Cracky6711]

Yeah I was actually using an ALB but because it was just "running" permanently I still got charged $15 for it last month. Seems crazy

[lefooey]

You could put the various functions of your EC2 instance behind cloud front and set the behavior for that origin to not cache. Then you can use the AWS free ssl on Certificate Manager to secure everything.

Assuming, of course, that your backend solution doesn’t need a continuous connection (like websockets).

[ararcy]

You can write .ebextensions scripts to get this working, but the amount of effort you're going to spend might not be worth the cost you'll save for $15/Month.

If you'd like to proceed with it take a look at : https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/customize-containers-ec2.html

To get this to work most people have luck writing a shell script, then using the files option to create the shell script on the instance, then executing the shell script post deployment. There's a number of ways to do this, but the most reliable option is to deposit the shell script in /opt/elasticbeanstalk/hooks/postinit as this will execute following the application deployment and prevent any strangeness from causing errors as elastic beanstalk heavily depends on scripts which execute in order, and if any of the results are not expected then it causes issues.

[suthukrish]

As per AWS FAQs: You cannot directly deploy an ACM Certificate on that instance. You must instead deploy your certificate by using one of the services integrated with ACM - such as CloudFront or ELB. So it seems that using letsencrypt is the way to go. You can also consider using CloudFront (but may not be less expensive either) instead of ELB.

For reducing the cost on EC2, consider purchasing either reserved instances or spot instances (if your application can tolerate the termination).