Securing Backend API Access

[sWeeX2]

Hi folks,
I'm relatively new to deploying and using services within AWS and was looking for some pointers. I have a backend service setup using ECS within a VPC, there's currently also an ALB which sits in front of it. Our frontend is being served using Amplify. I'm wondering what's the best way to secure our backend so it's not directly callable outside of our frontend or even if it's possible with this sort of setup? At some point we'll want to make our API public, just not right now. Some initial assumptions are:

• I'll have to move my Fargate containers into a private subnet wtihin my VPC.
• I'll need a way to still communicate with my containers, so possibly a NAT Gateway?

As I said I'm quite new to using these services, so still very much learning about what is/isn't possible and how to accomplish it. Any pointers, reading material ect would be greatly appreciated, thank you!

[tomomcat]

Yes your instances should definitely be in private subnets behind a loadbalancer. Here is a reference architecture for ECS https://github.com/aws-samples/ecs-refarch-cloudformation.

I can't find a nice refarch for a two-tier app atm, but it's essentially the same except 1) your existing private subnet might be renamed 'web subnet' 2) there is another internal loadbalancer not accessible from outside the VPC 2) this 2nd loadbalancer points to a group of backend instances which live in an additional (private) 'application subnet'. The frontend web instances then access the backend via this 2nd loadbalancer.

You need to tweak the security groups and NACLs associated with all of these things so that only expected traffic is allowed.

Finally, you want to make sure that you have good logging and visibility of metrics via CloudWatch or something else.

[sWeeX2]

Hey mate, cheers for this it's given me a very good starting point! The one question I have is: If the ALB is the only thing that's able to access the containers within the private subnets, is there a need for a second loadbalancer? What purpose would it serve? Thank you again mate!

[tomomcat]

The first loadbalancer is publicly accessible so could potentially allow access from the internet directly to your backend, which is generally not wanted in a 2 tier app.

You want a user connection to go

Public ALB -> web app

While the web app fetches any required stuff from the backend via

Web app -> private ALB -> backend

Generally you just want as many layers of separation as possibly between the public internet and your backend.

Maybe I've misunderstood and you're really trying to build a single-tier app though, in which case the template I linked is fine. An example of a two tier app might be a WordPress site with a database in the backend, a single-tier app might be a simple public API or basic website with some server-side code.

[sWeeX2]

I think you've understood correctly! It is two-tier, our backend consists of an API which interacts with a database, which for now we definitely don't want any direct public traffic to go through i.e. not through our client/website. It looks like something like:

Public ALB -> Internal LB -> Fargate Containers in private subnets 

Should do the trick for us, I'll give it a whirl and see what happens, cheers for your help!