Deploying a Highly Available Web Application and Bastion Host in AWS

​

Overview

​

Lab Details

1. This lab walks you through the steps to deploy a highly available Web application and use Bastion host to control the access to underlying private instances.
2. Duration: 90 minutes
3. AWS Region: US East (N. Virginia) us-east-1

​

Introduction

​

Bastion Host

• A bastion host is a system that is exposed to the internet.
• In terms of security, Bastion is the only server that is exposed to the internet and should be highly protective to malicious attacks.
• A Bastion host is also known as a Jump Box. It is a computer that acts like a proxy server and that allows the client machine to connect to the remote server.
• It usually resides outside the firewall.
• The Bastion server filters the incoming traffic and prevents unwanted connections entering the network thus acting as a gateway to maintain the security of bastion hosts, all unnecessary software, daemons.

​

High Availability

• Consider your application is running on a single EC2 instance. If the traffic to your application increases and you need further resources, we can launch multiple EC2 instances from an already running server and then use Elastic Load Balancing to distribute the traffic to your application among the newly-created servers.
• We can also eliminate the Fault tolerance in your application by placing the servers ( EC2 instances) across different availability zones.
• In the event of Failure of one Availability zone, your application will serve or handle the traffic from another availability zone.
• High Availability and fault tolerance can be achieved using Elastic Load balancers.

​

Elastic Load Balancer

• Load Balancer is a service that allows you to distribute the incoming application or network traffic across multiple targets (such as Amazon EC2 instances, containers, and IP addresses) in multiple Availability Zones.
• AWS currently offers three types of load balancers:
• Application Load Balancer is best suited for load balancing of HTTP and HTTPS traffic.
• Network Load Balancer is used to distribute the traffic or load using TCP/UDP protocols.
• Classic Load Balancer provides basic load balancing across multiple Amazon EC2 instances.

​

Architecture Diagram

​

Task Details

1. Sign into the AWS Management Console.
2. Check Cloudformation stack is created
3. Create a Bastion Server
4. Creating a Security Group for the Load Balancer
5. Steps to create Web-servers
6. Create a Target Group
7. Create a Load Balancer
8. Connecting to web server via Bastion
9. Checking the health of the load balancer
10. Test case for High Availability

​

Launching Lab Environment

1. To launch the lab environment, Click on the Start Lab button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with IAM user name, Password, Access Key, and Secret Access Key.

​

Lab guide

​

Lab Steps

​

Task 1: Sign in to AWS Management Console

1. Click on the Open Console button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
   • Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
   • Now copy your User Name and Password in the Lab Console to the IAM Username and Password in AWS Console and click on the Sign in button.
3. Once Signed In to the AWS Management Console, Make the default AWS Region as US East (N. Virginia) us-east-1.

Note : If you face any issues, please go through FAQs and Troubleshooting for Labs.

​

Task 2: Check CloudFormation stack is created

1. Make sure you are in the US East (N. Virginia) us-east-1 Region.
2. Navigate to the Management & Governance section and locate the Services button. Once you click on the Services button, then select CloudFormation
3. Under CloudFormation stacks, you will be able to see a stack getting created.
4. Now wait until the Stack status changes to CREATE_COMPLETE and please refresh the stack page to view the latest status.

​

Task 3: Create a Bastion Server

1. Make sure you are in the US East (N. Virginia) us-east-1 Region.
2. Navigate to EC2 by clicking on the Services menu at the top, then click on EC2 in the Compute section.
3. Navigate to Instances on the left panel and click on Launch Instances
4. Name : Enter Bastion-Server

5. For Amazon Machine Image (AMI): Make sure that the selected machine is Amazon Linux AMI 2023.

6. Instance Type: Select t2.micro
7. For Key pair: Select Create a new key pair
   • Key pair name: BastionKey
   • Key pair type: RSA
   • Private key file format: .pem
8. Select Create key pair Button.
9. In Network Settings Click on Edit:

• VPC : Select Bastion-VPC
• Subnet : Select Public Subnet 1
• Auto-assign public IP: Enable
• Select Create new Security group
• Security group name : Enter Bastion-SG
• Description : Enter Security group for Bastion-server
• To add SSH:
  • Choose Type  : SSH
  • Source : Anywhere

10. Keep Rest thing Default and Click on Launch Instance Button.
11. Select View all Instances to View Instance you Created
12. Launch Status: Your instances are now launching, navigate to Instances and wait for 1-2 minutes (until the Bastion-server’s status changes from pending to running).

​

Task 4: Creating a Security Group for the Load Balancer

1. Navigate to the Ec2 Dashboard, scroll down to Security Groups in left menu and click on Create security group.
2. Configure the security group as follows:

• Security group name: Enter LoadBalancer-SG
• Description: Enter Security group for the Load balancer
• VPC: Select Bastion-VPC (remove the default VPC)
• Click on Inbound Rules and add the port as follows:
• Type : Select HTTP
• Source: Select Anywhere-IPv4

3. Leave everything as default and click on Create Security Group.
4. The security group for the load balancer will be created.

​

Task 5: Creating Web-servers

Note: As part of AWS best practices, the web servers should reside in private subnets. We have created a private subnet and NAT gateway. The private subnet is attached to a route table to route traffic via NAT gateway to the internet. Please select the private subnet while launching web servers in the next section.

1. Make sure you are in the US East (N. Virginia) us-east-1 Region.
2. Navigate to Instances and Click on Launch Instances.
3. Name : Enter Web-server-1
4. For Amazon Machine Image (AMI): Make sure that the selected machine is Amazon Linux AMI 2023.
5. Instance Type: Select t2.micro.
6. For Key pair: Select Create a new key pair Button
   • Key pair name: WebKey
   • Key pair type: RSA
   • Private key file format: .pem
7. Select Create key pair Button.
8. In Network Settings Click on Edit:
   • VPC : Select Bastion-VPC
   • Subnet : Select Private Subnet 1
   • Select Create new Security group
   • Security group name : Enter web-server-SG
   • Description : Enter Security group for web servers
   • On port 22, we choose the Bastion-SG security group as its source to allow SSH connection to web servers from only the bastion server by restricting the public SSH connection. Type bastion in source and select the Bastion-SG.
   • On port 80, choose the LoadBalancer-SG as its source to serve the traffic coming through the load balancer. Type Load in source and select  LoadBalancer-SG.
   • To add SSH:
     • Choose Type    : SSH
     • Source : Custom and Select Bastion-SG
   • To add HTTP: Click on Add security group rule
     • Choose Type  : HTTP
     • Source : Custom and Select LoadBalancer-SG
9. Click on Advanced Details and under the User data: section, enter the following script:

#!/bin/bash
sudo su
dnf update -y
dnf install httpd -y
systemctl start httpd
systemctl enable httpd
echo "REQUEST HANDLING BY SERVER 1" > /var/www/html/index.html

10. Keep everything as default and click on Launch Instance button. Select View all Instances to View Instance you Created
11. Launch Status: Your instances are now launching,Navigate to Instances and wait for 1-2 minutes (until the Bastion-server’s status changes from pending to running).
12. After a few minutes, you will see the new instance named web-server-1 running along with the Bastion-server created in the earlier step.
13. Repeat the above steps from Step1 to create Web-server-2. You need 2 instances for this lab.
14. For key, select WebKey
15. In Network Settings Click on Edit:
    • VPC : Select Bastion-VPC
    • Subnet : Select Private Subnet 2
    • Security group : Select existing security group
    • Select web-server-SG
16. Click on  Advanced Details and under the User data: section, enter the following script:
    #!/bin/bash
    sudo su
    dnf update -y
    dnf install httpd -y
    systemctl start httpd
    systemctl enable httpd
    echo "REQUEST HANDLING BY SERVER 2" > /var/www/html/index.html
    
17. Keep Rest thing Default and Click on Launch Instance Button. Select View all Instances to View Instance you Created.
18. Now you will see three servers running namely Bastion-server, Web-server-1, and Web-server-2.

​

Task 6: Creating a Target Group

1. In the left side menu, scroll down to the bottom and click on Target Groups under Load Balancing
2. Click on the Create Target Group
3. Under Basic Configuration:
   • Under settings :
     • Choose a target type : Select Instances
     • Target group name : Enter web-app-TG
     • Protocol : HTTP
     • Port  : 80
     • VPC : Select Bastion-VPC
     • Protocol version: Select HTTP1
     • Health check protocol : Select HTTP (default)
     • Path : Enter /index.html
4. Click on Advanced health check settings to expand it:
   • Healthy threshold: Enter 3
   • Unhealthy threshold: 2 (Default)
   • Timeout: 5 seconds (Default)
   • Interval: Enter 6 seconds
   • Success codes: 200 (Default)
   
5. Click on Next
6. Register Targets :
   • Under Instances, select the two web-server EC2 instances which you created in the above step and click on Include as pending below.
7. Review targets:
   • Review everything and click on Create Target Group
8. You have successfully created a target group.

​

Task 7: Creating a load balancer

1. In the EC2 console, navigate to Load Balancer in the left side panel.
2. Click on Create Load Balancer at the top left to create a new load balancer for our web servers.
3. On the next screen, choose Create under Application Load balancer  since we are testing the high availability of the web app.
4. The next few screens will require some custom configurations. If a field is not mentioned, leave it as default or empty.
   • Scroll down to Basic Configuration:
     • Load balancer name : Enter Web-application-LB
     • Scheme : Choose internet-facing
     • IP address type : Select IPv4
5. Network mapping:
   • VPC: Select Bastion-VPC
   • Mappings: Make sure you select the two Public Subnets in the Availability zone i.e us-east-1a and us-east-1b.
6. Security groups:
   • Remove the default security group and Select LoadBalancer-SG from the drop-down menu.
7. Listeners and routing:
   • Protocol : HTTP
   • Port  : 80 Default action(forward to): Select the target group web-app-TG from the drop-down menu.
8. Now scroll down and click on Create Load Balancer button.
9. You have successfully created an application load balancer.
10. Please wait for 3-4 minutes to see this ALB change to Active state.

​

Task 8: Connecting to web server via Bastion

2. To SSH into web servers via Bastion server, we need the web server key that we used to launch the previous web servers (web-serverkey).
3. Open the web-serverkey file on your local system and then copy the text content.
4. Navigate to the Bastion server and create a file named web-serverkey.pem using below command.

nano web-serverkey.pem

5. Paste the content and save it by click CTRL+X then Y and press Enter to save your private key.
6. Make sure you have changed the permission of the key file to 400. You can change the permission using below command

chmod 400 web-serverkey.pem

7. Now you can log into the web servers using the private key copied to the bastion server with the help of below commands.

Note: You don’t have a public IPs for the web servers since we created them in a private subnet.

• Syntax : ssh -i web-serverkey.pem  ec2-user@<Web-server-1 private IP>
• Example: ssh -i web-serverkey.pem  ec2-user@172.31.101.237

​

Task 9: Checking the health of the load balancer

1. Navigate to  Target Groups under the Load Balancers
2. Select the target group you created and then click on Targets to see the Status of the attached targets.
3. It should show Healthy for the Load Balancer to work properly. You may need to wait for 2-5 minutes before the load balancer’s status updates to “Healthy”
4. Now navigate to  Load Balancers and select the load balancer that you created earlier. Under Details, copy the DNS name and paste it into the browser.
   • Example: DNS URL: Web-application-LB-1317306189.us-east-1.elb.amazonaws.com
5. Refresh the browser a couple of times to see the requests being served from both servers. Seeing output similar to REQUEST HANDLING BY SERVER 1 &  REQUEST HANDLING BY SERVER 2 implies that load is shared between the two web servers via Application Load Balancer.
6. Now we have successfully created a bastion server, two web servers and an Application Load balancer, registered the targets to the load balancer and tested the working of Load Balancer.

​

Task 10: Test case for High Availability

1. To check for high availability, we will make one of the instances unhealthy and test whether we get response from the other server.
2. If your instance is shown as Unhealthy then it’s status would be one of the following:

• stopping
• stopped
• terminating
• Terminated

3. Navigate to the EC2 dashboard and select Web-server-1. Click on Instance state and then click on Stop instance. Click Stop to confirm.
4. Navigate to Target groups and click on web-app-TG. Here you will find the status of Web-server-1 (which should be unhealthy because it is unused).
5. Navigate to Load balancers—>Description—>DNS name. Copy the DNS name and paste it into your browser. You should see the response “REQUEST HANDLING BY SERVER 2” FROM WEB-SERVER-2**.**
6. If you refresh a few times, you will continue to see the response only from Web-server-2
7. Repeat step 3 by stopping Web-server-2 and starting Web-server-1 back up. This time you should see the response “REQUEST HANDLING BY SERVER 1” from Web-server-1.

   Do You Know ? In addition to SSH and RDP access, a bastion server can be configured to support other secure remote access protocols such as HTTPS, allowing for flexible and secure management of resources.

8. Once the lab steps are completed, please click on the Validation button on the left side panel.

​

Completion and Conclusion

1. We have launched a Bastion server and two web-servers. We were able to SSH into the servers via Bastion Server successfully.
2. We launched an Application Load Balancer and associated our web servers with the load balancer.
3. We tested the load sharing between web servers.
4. We successfully tested the high availability of the web application by making one of the web servers unhealthy.

​

End Lab

1. Sign out of the AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps, click on End Lab from the IP Lab Portal dashboard.

​

What gets checked

• Launch an EC2 Instance — Check whether an EC2 Instance is launched or not.
• Launch EC2 AMI type Amazon Linux — Check whether the EC2 instance is launched using an Amazon AMI.
• Create a Application Load Balancer — Check if given type of Load Balancer is created or not.
• Invoke Load Balancer DNS — Check whether the Elastic Load Balancer DNS URL is accessible from the internet or not.
• Create ELB Target Group — Check if given type of Load Balancer is created or not.

​

Related help

• FAQs and Troubleshooting
• SSH into EC2 Instance