{"id":2554,"date":"2026-01-07T00:50:00","date_gmt":"2026-01-06T16:50:00","guid":{"rendered":"https:\/\/ichwanchandra.com\/blog\/?p=2554"},"modified":"2026-07-20T23:25:29","modified_gmt":"2026-07-20T15:25:29","slug":"aws-solutions-architect-project-security-pillar-part-3","status":"publish","type":"post","link":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/","title":{"rendered":"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 3"},"content":{"rendered":"\n<p>In order to run the application backend in a secure way, we&#8217;ll deploy the EC2 instance inside a private subnet of the secured VPC. There will be a Bastion Host deployed in the public subnet for administrative access only. Last but not least, we&#8217;ll securely route the inbound traffic via Application Load Balancer (ALB) hosted on the public subnet.<\/p>\n\n\n\n<div style=\"height:24px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Setup EC2 Instance and Launch It in Private Subnet<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to the <strong>EC2 Dashboard<\/strong>, click <strong>Launch Instance<\/strong>\n<ul class=\"wp-block-list\">\n<li><strong>Name<\/strong>: <code>shoppingcart-app<\/code><\/li>\n\n\n\n<li><strong>AMI<\/strong>: Amazon Linux 2 or Amazon Linux 2023 (both supported)<\/li>\n\n\n\n<li><strong>Instance type<\/strong>: <code>t2.micro<\/code> (Free Tier eligible)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1012\" height=\"1244\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-31.png\" alt=\"\" class=\"wp-image-2560\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-31.png 1012w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-31-244x300.png 244w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-31-833x1024.png 833w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-31-768x944.png 768w\" sizes=\"auto, (max-width: 1012px) 100vw, 1012px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Network Settings<\/strong> section, click edit:\n<ul class=\"wp-block-list\">\n<li><strong>VPC<\/strong>: Select <code>shoppingcart-vpc<\/code><\/li>\n\n\n\n<li><strong>Subnet<\/strong>: Choose <code>private-subnet-1<\/code><\/li>\n\n\n\n<li><strong>Auto-assign public IP<\/strong>: Select <strong>Disable<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1012\" height=\"586\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-33.png\" alt=\"\" class=\"wp-image-2563\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-33.png 1012w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-33-300x174.png 300w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-33-768x445.png 768w\" sizes=\"auto, (max-width: 1012px) 100vw, 1012px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click <strong>Edit security groups<\/strong>, click <strong>Create a new security group<\/strong>\n<ul class=\"wp-block-list\">\n<li><strong>Security group name<\/strong>: <code>app-sg<\/code><\/li>\n\n\n\n<li><strong>Description<\/strong>: Allow HTTP traffic from ALB only<\/li>\n\n\n\n<li>Leave the <strong>outbound rule<\/strong> as default:<\/li>\n\n\n\n<li>Allows <strong>all outbound traffic<\/strong> (this is required for EC2 to access the internet via the NAT Gateway)<\/li>\n\n\n\n<li>Click <strong>Launch Instance<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1012\" height=\"892\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-34.png\" alt=\"\" class=\"wp-image-2564\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-34.png 1012w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-34-300x264.png 300w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-34-768x677.png 768w\" sizes=\"auto, (max-width: 1012px) 100vw, 1012px\" \/><\/figure>\n\n\n\n<div style=\"height:24px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Setup Application Load Balancer (ALB)<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to the <strong>EC2 Dashboard<\/strong> and from the left menu, click <strong>Load Balancers<\/strong>,  click <strong>Create Load Balancer<\/strong>, Select <strong>Application Load Balancer<\/strong>.\n<ul class=\"wp-block-list\">\n<li>Configure Load Balancer Basics:\n<ul class=\"wp-block-list\">\n<li><strong>Name<\/strong>: <code>shoppingcart-alb<\/code><\/li>\n\n\n\n<li><strong>Scheme<\/strong>: <strong>Internet-facing<\/strong><\/li>\n\n\n\n<li><strong>IP address type<\/strong>: IPv4<\/li>\n\n\n\n<li><strong>Network mapping<\/strong>:\n<ul class=\"wp-block-list\">\n<li><strong>VPC<\/strong>: Select <code>securecart-vpc<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Mappings (Availability Zones)<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Check <code>us-east-1a<\/code> \u2192 select <code>public-subnet-1<\/code> <\/li>\n\n\n\n<li>Check <code>us-east-1b<\/code> \u2192 select <code>public-subnet-2<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1012\" height=\"1556\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-35.png\" alt=\"\" class=\"wp-image-2565\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-35.png 1012w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-35-195x300.png 195w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-35-666x1024.png 666w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-35-768x1181.png 768w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-35-999x1536.png 999w\" sizes=\"auto, (max-width: 1012px) 100vw, 1012px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Configure Security Group:<\/strong>\n<ul class=\"wp-block-list\">\n<li>Choose <strong>Create a new security group<\/strong><\/li>\n\n\n\n<li><strong>Name<\/strong>: <code>alb-sg<\/code><\/li>\n\n\n\n<li><strong>Description<\/strong>: Allow HTTP traffic to ALB<\/li>\n\n\n\n<li><strong>VPC:<\/strong> shoppingcart-vpc<\/li>\n\n\n\n<li>Add <strong>Inbound rule<\/strong>:\n<ul class=\"wp-block-list\">\n<li><strong>Type<\/strong>: HTTP<\/li>\n\n\n\n<li><strong>Port<\/strong>: 80<\/li>\n\n\n\n<li><strong>Source<\/strong>: <code>0.0.0.0\/0<\/code> (allows public access to ALB)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Leave the <strong>Outbound rule<\/strong> as default (all traffic allowed)<\/li>\n\n\n\n<li>Click <strong>Create Security Group<\/strong> and return back to ALB configuration page<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1012\" height=\"1680\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-36.png\" alt=\"\" class=\"wp-image-2569\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-36.png 1012w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-36-181x300.png 181w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-36-617x1024.png 617w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-36-768x1275.png 768w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-36-925x1536.png 925w\" sizes=\"auto, (max-width: 1012px) 100vw, 1012px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Configure Listener and Routing:<\/strong>\n<ul class=\"wp-block-list\">\n<li><strong>Protocol<\/strong>: HTTP<\/li>\n\n\n\n<li><strong>Port<\/strong>: 80<\/li>\n\n\n\n<li><strong>Default action<\/strong>: Forward to a target group<\/li>\n\n\n\n<li>Click <strong>Create target group<\/strong>:\n<ul class=\"wp-block-list\">\n<li><strong>Name<\/strong>: <code>shoppingcart-tg<\/code><\/li>\n\n\n\n<li><strong>Target type<\/strong>: <strong>Instance<\/strong><\/li>\n\n\n\n<li><strong>Protocol<\/strong>: HTTP<\/li>\n\n\n\n<li><strong>Port<\/strong>: 80<\/li>\n\n\n\n<li><strong>VPC<\/strong>: <code>shoppingcart-vpc<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1012\" height=\"1115\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-38.png\" alt=\"\" class=\"wp-image-2572\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-38.png 1012w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-38-272x300.png 272w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-38-929x1024.png 929w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-38-768x846.png 768w\" sizes=\"auto, (max-width: 1012px) 100vw, 1012px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1012\" height=\"1660\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-37.png\" alt=\"\" class=\"wp-image-2571\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-37.png 1012w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-37-183x300.png 183w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-37-624x1024.png 624w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-37-768x1260.png 768w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-37-936x1536.png 936w\" sizes=\"auto, (max-width: 1012px) 100vw, 1012px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click <strong>Next<\/strong> <\/li>\n\n\n\n<li>Register Targets: \n<ul class=\"wp-block-list\">\n<li>On the &#8220;Register targets&#8221; page:<\/li>\n\n\n\n<li>Select your EC2 instance (<code>shoppingcart-app<\/code>)<\/li>\n\n\n\n<li>Click <strong>Include as pending below<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1012\" height=\"1115\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-39.png\" alt=\"\" class=\"wp-image-2573\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-39.png 1012w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-39-272x300.png 272w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-39-929x1024.png 929w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-39-768x846.png 768w\" sizes=\"auto, (max-width: 1012px) 100vw, 1012px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click <strong>Next<\/strong>, click <strong>Create Target Group<\/strong><\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1012\" height=\"918\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-40.png\" alt=\"\" class=\"wp-image-2574\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-40.png 1012w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-40-300x272.png 300w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-40-768x697.png 768w\" sizes=\"auto, (max-width: 1012px) 100vw, 1012px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Return back to the ALB configuration page and select the newly created target group<\/li>\n\n\n\n<li>Click <strong>Create Load Balancer<\/strong><\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1012\" height=\"1133\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-41.png\" alt=\"\" class=\"wp-image-2575\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-41.png 1012w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-41-268x300.png 268w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-41-915x1024.png 915w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-41-768x860.png 768w\" sizes=\"auto, (max-width: 1012px) 100vw, 1012px\" \/><\/figure>\n\n\n\n<p>After a couple of minutes, the ALB will be in the active status<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1009\" height=\"1073\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-42.png\" alt=\"\" class=\"wp-image-2576\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-42.png 1009w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-42-282x300.png 282w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-42-963x1024.png 963w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-42-768x817.png 768w\" sizes=\"auto, (max-width: 1009px) 100vw, 1009px\" \/><\/figure>\n\n\n\n<div style=\"height:24px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Update Security Group of EC2 to Allow Application Load Balancer (ALB)<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to the <strong>EC2 Dashboard<\/strong> and navigate to the left menu, click <strong>Security Groups<\/strong> <\/li>\n\n\n\n<li>Find and click on the security group for your EC2 instance (usually <code>app-sg<\/code>) <\/li>\n\n\n\n<li>Go to the <strong>Inbound rules<\/strong> tab, click <strong>Edit inbound rules<\/strong><\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1009\" height=\"533\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-43.png\" alt=\"\" class=\"wp-image-2578\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-43.png 1009w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-43-300x158.png 300w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-43-768x406.png 768w\" sizes=\"auto, (max-width: 1009px) 100vw, 1009px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click <strong>Add rule<\/strong>:\n<ul class=\"wp-block-list\">\n<li><strong>Type<\/strong>: HTTP<\/li>\n\n\n\n<li><strong>Port<\/strong>: 80<\/li>\n\n\n\n<li><strong>Source<\/strong>: <strong>Custom<\/strong>. In the dropdown, select <code>alb-sg<\/code> (our ALB security group)<\/li>\n\n\n\n<li>This ensures that <strong>only the ALB<\/strong> can send traffic to our EC2 instance.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1009\" height=\"945\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-44.png\" alt=\"\" class=\"wp-image-2579\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-44.png 1009w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-44-300x281.png 300w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-44-768x719.png 768w\" sizes=\"auto, (max-width: 1009px) 100vw, 1009px\" \/><\/figure>\n\n\n\n<p>Click <strong>Save rules<\/strong><\/p>\n\n\n\n<div style=\"height:24px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Setup Bastion Host in The Public Subnet<\/h2>\n\n\n\n<p>While putting the application within the EC2 deployed in the private subnet is a good security practice in the real-world case, this means we can&#8217;t SSH into EC2 instance directly. That&#8217;s why we need to setup the bastion host to allow us securely access the EC2 instance from a public subnet to do such administrative task (i.e. installing updates) before we can terminate to reduce cost and avoid exposure.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to <strong>EC2 Dashboard<\/strong>, click <strong>Launch Instance<\/strong>\n<ul class=\"wp-block-list\">\n<li>Name: <code>bastion-host<\/code><\/li>\n\n\n\n<li>Choose Amazon Linux 2023, <code>t2.micro<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Select the existing key pair: shopping-cart-app-key-pair <\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1009\" height=\"1436\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-45.png\" alt=\"\" class=\"wp-image-2583\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-45.png 1009w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-45-211x300.png 211w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-45-720x1024.png 720w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-45-768x1093.png 768w\" sizes=\"auto, (max-width: 1009px) 100vw, 1009px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Configure Network Settings:\n<ul class=\"wp-block-list\">\n<li><strong>VPC:<\/strong> <code>shoppingcart-vpc<\/code><\/li>\n\n\n\n<li><strong>Subnet<\/strong>: <code>public-subnet-1<\/code><\/li>\n\n\n\n<li><strong>Auto-assign Public IP<\/strong>: Enable (default)<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Create security group:\n<ul class=\"wp-block-list\">\n<li>Name: <code>bastion-sg<\/code><\/li>\n\n\n\n<li>Inbound Rule:\n<ul class=\"wp-block-list\">\n<li><strong>Type<\/strong>: SSH<\/li>\n\n\n\n<li><strong>Port<\/strong>: 22<\/li>\n\n\n\n<li><strong>Source<\/strong>: <code>My IP<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Outbound Rule: Leave as <strong>Allow all<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1009\" height=\"1023\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-47.png\" alt=\"\" class=\"wp-image-2585\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-47.png 1009w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-47-296x300.png 296w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-47-768x779.png 768w\" sizes=\"auto, (max-width: 1009px) 100vw, 1009px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>In order to allow only the bastion host to connect to our private EC2 instance, we need to Update App EC2 Security Group to Allow SSH from Bastion\n<ul class=\"wp-block-list\">\n<li>Go to <strong>EC2 Dashboard, <\/strong>click<strong> Security Groups<\/strong><\/li>\n\n\n\n<li>Find <code>app-sg<\/code> and click on it<\/li>\n\n\n\n<li>Go to <strong>Inbound rules<\/strong>, click <strong>Edit inbound rules<\/strong><\/li>\n\n\n\n<li>Add:\n<ul class=\"wp-block-list\">\n<li><strong>Type<\/strong>: SSH <\/li>\n\n\n\n<li><strong>Port<\/strong>: 22 <\/li>\n\n\n\n<li><strong>Source<\/strong>: <strong>Custom<\/strong>, Select <code>bastion-sg<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1009\" height=\"1271\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-48.png\" alt=\"\" class=\"wp-image-2587\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-48.png 1009w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-48-238x300.png 238w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-48-813x1024.png 813w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-48-768x967.png 768w\" sizes=\"auto, (max-width: 1009px) 100vw, 1009px\" \/><\/figure>\n\n\n\n<div style=\"height:24px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: SSH into App EC2 via Bastion Host<\/h2>\n\n\n\n<p>In this step we will try to connect to the EC2 application via bastion host by using the .pem key.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Upload the .pem key to the bastion host by using this command from terminal<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>scp -i ~\/&lt;filepath&gt;\/&lt;key_filename&gt;.pem ~\/&lt;filepath&gt;\/&lt;key_filename&gt;.pem ec2-user@&lt;Bastion_Public_IP&gt;:\/home\/ec2-user\/<\/code><\/pre>\n\n\n\n<p>Please replace the &lt;filepath&gt; and &lt;key_filename&gt; with the filepath and filename of our own local machine.<\/p>\n\n\n\n<p>Once we copied the .pem file to bastion host instance, we can connect to the bastion host using below command<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh -i ~\/&lt;filepath&gt;\/&lt;key_filename&gt;.pem ec2-user@&lt;Bastion_Public_IP&gt;<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"722\" height=\"226\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-49.png\" alt=\"\" class=\"wp-image-2590\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-49.png 722w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-49-300x94.png 300w\" sizes=\"auto, (max-width: 722px) 100vw, 722px\" \/><\/figure>\n\n\n\n<p>Once we connected inside the bastion host, run the following command to connect to the EC2 instance (shoppingcart-app)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>chmod 400 &lt;key_filename&gt;.pem\nssh -i &lt;key_filename&gt;.pem ec2-user@&lt;Private_IP_of_app_instance&gt;<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"722\" height=\"342\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-50.png\" alt=\"\" class=\"wp-image-2592\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-50.png 722w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-50-300x142.png 300w\" sizes=\"auto, (max-width: 722px) 100vw, 722px\" \/><\/figure>\n\n\n\n<p>To find the private IP of the app instance, go to EC2 dashboard, select the EC2 instance and find the private IP value.<\/p>\n\n\n\n<div style=\"height:24px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6: Install Node.JS on EC2 Instance (shoppingcart-app)<\/h2>\n\n\n\n<p>Once connected inside the EC2 instance (shoppingcart-app), let&#8217;s install Node.JS by using following command:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -o- https:\/\/raw.githubusercontent.com\/nvm-sh\/nvm\/v0.40.4\/install.sh | bash\nexport NVM_DIR=\"$HOME\/.nvm\"\nsource \"$NVM_DIR\/nvm.sh\"\nnvm install 24\nnvm use 24<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"962\" height=\"642\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-51.png\" alt=\"\" class=\"wp-image-2596\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-51.png 962w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-51-300x200.png 300w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-51-768x513.png 768w\" sizes=\"auto, (max-width: 962px) 100vw, 962px\" \/><\/figure>\n\n\n\n<p>Create the application:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir shoppingcart &amp;&amp; cd shoppingcart\nmkdir public\n\ncat &lt;&lt;EOF &gt; public\/index.html\n&lt;!DOCTYPE html&gt;\n&lt;html&gt;\n&lt;head&gt;&lt;title&gt;ShoppingCart&lt;\/title&gt;&lt;\/head&gt;\n&lt;body&gt;&lt;h1&gt;Welcome to ShoppingCart Production&lt;\/h1&gt;&lt;p&gt;This is the secured demo page served by the EC2 on the private subnet&lt;\/p&gt;&lt;\/body&gt;\n&lt;\/html&gt;\nEOF\n\ncat &lt;&lt;EOF &gt; server.js\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\nconst server = http.createServer((req, res) =&gt; {\n  const filePath = path.join(__dirname, 'public', req.url === '\/' ? 'index.html' : req.url);\n  fs.readFile(filePath, (err, content) =&gt; {\n    if (err) {\n      res.writeHead(404); res.end('Not Found');\n    } else {\n      res.writeHead(200); res.end(content);\n    }\n  });\n});\nserver.listen(80, '0.0.0.0\/0');\nEOF<\/code><\/pre>\n\n\n\n<p>Get the full path to Node.js and copy the output<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;ec2-user@ip-172-31-18-36 shoppingcart]$ which node\n~\/.nvm\/versions\/node\/v24.16.0\/bin\/node<\/code><\/pre>\n\n\n\n<p>Start the application<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Get the full path to Node.js\nwhich node\n\n# Copy the output path (e.g., \/home\/ec2-ser\/.nvm\/versions\/node\/v24.16.0\/bin\/node) Please adjust the node version on your own installation\n\n# Start the server using the full path (&amp; makes sure the task runs on background to keep terminal functional for operations)\nsudo \/home\/ec2-user\/.nvm\/versions\/node\/v24.16.0\/bin\/node server.js &amp;<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"962\" height=\"102\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-52.png\" alt=\"\" class=\"wp-image-2600\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-52.png 962w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-52-300x32.png 300w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-52-768x81.png 768w\" sizes=\"auto, (max-width: 962px) 100vw, 962px\" \/><\/figure>\n\n\n\n<p>Finally, test the application via the ALB<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to <strong>EC2 Dashboard, <\/strong>from left-side menu click<strong> Load Balancers<\/strong> \n<ul class=\"wp-block-list\">\n<li>Copy the <strong>DNS name<\/strong> of our ALB (i.e. <code>shoppingcart-alb-521118827.us-east-1.elb.amazonaws.com<\/code>) <\/li>\n\n\n\n<li>And paste it into our browser. We should see the message served by the application on EC2<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"860\" height=\"195\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-53.png\" alt=\"\" class=\"wp-image-2603\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-53.png 860w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-53-300x68.png 300w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-53-768x174.png 768w\" sizes=\"auto, (max-width: 860px) 100vw, 860px\" \/><\/figure>\n\n\n\n<div style=\"height:24px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Summary: Re-architecture for Secure Prod Deployment<\/strong><\/h2>\n\n\n\n<p>As per demonstrated in this part, the EC2 instance is placed inside a <strong>private subnet<\/strong>, which means it doesn\u2019t have a public IP and can\u2019t be accessed directly from the internet. However, we can still access the app from your browser using the <strong>ALB DNS URL<\/strong>. That\u2019s because the <strong>Application Load Balancer is in a public subnet<\/strong>, and it securely forwards traffic to the EC2 instance inside the private subnet.<\/p>\n\n\n\n<p>This setup shows how real-world architectures use <strong>public ALBs to expose apps<\/strong>, while keeping backend resources like EC2 and RDS <strong>isolated for security<\/strong>.<\/p>\n\n\n\n<p>In <a href=\"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/\" data-type=\"post\" data-id=\"2613\">part 4<\/a>, we&#8217;ll securely deploy RDS as the data layer and S3 as the storage layer of the application<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In order to run the application backend in a secure way, we&#8217;ll deploy the EC2 instance inside a private subnet of the secured VPC. There will be a Bastion Host deployed in the public subnet for administrative access only. Last but not least, we&#8217;ll securely route the inbound traffic via Application Load Balancer (ALB) hosted on the public subnet.<\/p>\n","protected":false},"author":1,"featured_media":2650,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,10,85,75],"tags":[],"class_list":["post-2554","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-backend","category-cloud","category-projects","category-system-design"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 3 - Ichwan Chandra<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 3 - Ichwan Chandra\" \/>\n<meta property=\"og:description\" content=\"In order to run the application backend in a secure way, we&#039;ll deploy the EC2 instance inside a private subnet of the secured VPC. There will be a Bastion Host deployed in the public subnet for administrative access only. Last but not least, we&#039;ll securely route the inbound traffic via Application Load Balancer (ALB) hosted on the public subnet.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/\" \/>\n<meta property=\"og:site_name\" content=\"Ichwan Chandra\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-06T16:50:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-20T15:25:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/06\/aws-solutions-architect-project-security-pillar-part-3-1024x572.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"572\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Ichwan Chandra\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ichwan Chandra\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-3\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-3\\\/\"},\"author\":{\"name\":\"Ichwan Chandra\",\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/#\\\/schema\\\/person\\\/2fa69a7a1008a3369584752194b063d5\"},\"headline\":\"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 3\",\"datePublished\":\"2026-01-06T16:50:00+00:00\",\"dateModified\":\"2026-07-20T15:25:29+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-3\\\/\"},\"wordCount\":931,\"image\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-3\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/aws-solutions-architect-project-security-pillar-part-3.png\",\"articleSection\":[\"Backend\",\"Cloud\",\"Projects\",\"System Design\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-3\\\/\",\"url\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-3\\\/\",\"name\":\"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 3 - Ichwan Chandra\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-3\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-3\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/aws-solutions-architect-project-security-pillar-part-3.png\",\"datePublished\":\"2026-01-06T16:50:00+00:00\",\"dateModified\":\"2026-07-20T15:25:29+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/#\\\/schema\\\/person\\\/2fa69a7a1008a3369584752194b063d5\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-3\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-3\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-3\\\/#primaryimage\",\"url\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/aws-solutions-architect-project-security-pillar-part-3.png\",\"contentUrl\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/aws-solutions-architect-project-security-pillar-part-3.png\",\"width\":1376,\"height\":768,\"caption\":\"aws solutions architect project on security pillar - part 3\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-3\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 3\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/\",\"name\":\"Ichwan Chandra\",\"description\":\"In a lifelong learning mode\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/#\\\/schema\\\/person\\\/2fa69a7a1008a3369584752194b063d5\",\"name\":\"Ichwan Chandra\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8d8d64c76e361108ee058442df7c49c539eefd1d1e5a3e8dbcc9d70289e0bbf2?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8d8d64c76e361108ee058442df7c49c539eefd1d1e5a3e8dbcc9d70289e0bbf2?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8d8d64c76e361108ee058442df7c49c539eefd1d1e5a3e8dbcc9d70289e0bbf2?s=96&d=retro&r=g\",\"caption\":\"Ichwan Chandra\"},\"sameAs\":[\"https:\\\/\\\/ichwanchandra.com\\\/blog\"],\"url\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/author\\\/isuchan193\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 3 - Ichwan Chandra","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/","og_locale":"en_US","og_type":"article","og_title":"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 3 - Ichwan Chandra","og_description":"In order to run the application backend in a secure way, we'll deploy the EC2 instance inside a private subnet of the secured VPC. There will be a Bastion Host deployed in the public subnet for administrative access only. Last but not least, we'll securely route the inbound traffic via Application Load Balancer (ALB) hosted on the public subnet.","og_url":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/","og_site_name":"Ichwan Chandra","article_published_time":"2026-01-06T16:50:00+00:00","article_modified_time":"2026-07-20T15:25:29+00:00","og_image":[{"width":1024,"height":572,"url":"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/06\/aws-solutions-architect-project-security-pillar-part-3-1024x572.png","type":"image\/png"}],"author":"Ichwan Chandra","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Ichwan Chandra","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/#article","isPartOf":{"@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/"},"author":{"name":"Ichwan Chandra","@id":"https:\/\/ichwanchandra.com\/blog\/#\/schema\/person\/2fa69a7a1008a3369584752194b063d5"},"headline":"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 3","datePublished":"2026-01-06T16:50:00+00:00","dateModified":"2026-07-20T15:25:29+00:00","mainEntityOfPage":{"@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/"},"wordCount":931,"image":{"@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/#primaryimage"},"thumbnailUrl":"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/06\/aws-solutions-architect-project-security-pillar-part-3.png","articleSection":["Backend","Cloud","Projects","System Design"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/","url":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/","name":"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 3 - Ichwan Chandra","isPartOf":{"@id":"https:\/\/ichwanchandra.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/#primaryimage"},"image":{"@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/#primaryimage"},"thumbnailUrl":"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/06\/aws-solutions-architect-project-security-pillar-part-3.png","datePublished":"2026-01-06T16:50:00+00:00","dateModified":"2026-07-20T15:25:29+00:00","author":{"@id":"https:\/\/ichwanchandra.com\/blog\/#\/schema\/person\/2fa69a7a1008a3369584752194b063d5"},"breadcrumb":{"@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/#primaryimage","url":"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/06\/aws-solutions-architect-project-security-pillar-part-3.png","contentUrl":"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/06\/aws-solutions-architect-project-security-pillar-part-3.png","width":1376,"height":768,"caption":"aws solutions architect project on security pillar - part 3"},{"@type":"BreadcrumbList","@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-3\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/ichwanchandra.com\/blog\/"},{"@type":"ListItem","position":2,"name":"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 3"}]},{"@type":"WebSite","@id":"https:\/\/ichwanchandra.com\/blog\/#website","url":"https:\/\/ichwanchandra.com\/blog\/","name":"Ichwan Chandra","description":"In a lifelong learning mode","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ichwanchandra.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/ichwanchandra.com\/blog\/#\/schema\/person\/2fa69a7a1008a3369584752194b063d5","name":"Ichwan Chandra","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/8d8d64c76e361108ee058442df7c49c539eefd1d1e5a3e8dbcc9d70289e0bbf2?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/8d8d64c76e361108ee058442df7c49c539eefd1d1e5a3e8dbcc9d70289e0bbf2?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8d8d64c76e361108ee058442df7c49c539eefd1d1e5a3e8dbcc9d70289e0bbf2?s=96&d=retro&r=g","caption":"Ichwan Chandra"},"sameAs":["https:\/\/ichwanchandra.com\/blog"],"url":"https:\/\/ichwanchandra.com\/blog\/author\/isuchan193\/"}]}},"_links":{"self":[{"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/posts\/2554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/comments?post=2554"}],"version-history":[{"count":28,"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/posts\/2554\/revisions"}],"predecessor-version":[{"id":2816,"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/posts\/2554\/revisions\/2816"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/media\/2650"}],"wp:attachment":[{"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/media?parent=2554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/categories?post=2554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/tags?post=2554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}