{"id":2613,"date":"2026-01-08T17:19:00","date_gmt":"2026-01-08T09:19:00","guid":{"rendered":"https:\/\/ichwanchandra.com\/blog\/?p=2613"},"modified":"2026-07-18T01:15:57","modified_gmt":"2026-07-17T17:15:57","slug":"aws-solutions-architect-project-security-pillar-part-4","status":"publish","type":"post","link":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/","title":{"rendered":"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 4"},"content":{"rendered":"\n<p>After deploying the EC2 (application-tier) behind the Application Load Balancer (ALB), we&#8217;ll privately deploy RDS (database-tier) and S3 (storage-tier) by following the principle of least privilege. The RDS is only accessible from private EC2 while S3 assets are not publicly accessible.<\/p>\n\n\n\n<div style=\"height:24px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Setup RDS Subnet Group<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to <strong>Aurora and RDS \u2192 Subnet groups<\/strong>\n<ul class=\"wp-block-list\">\n<li>Click <strong>Create DB subnet groupName<\/strong>: <code>shoppingcart-db-subnet-group<\/code><\/li>\n\n\n\n<li><strong>Description:<\/strong> Subnet group for private RDS<\/li>\n\n\n\n<li><strong>VPC<\/strong>: <code>shoppingcart-vpc<\/code><\/li>\n\n\n\n<li>Add <strong>Private Subnet 1<\/strong> and <strong>Private Subnet 2<\/strong><\/li>\n\n\n\n<li>Select the correct <strong>Availability Zones<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1013\" height=\"1206\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-54.png\" alt=\"\" class=\"wp-image-2620\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-54.png 1013w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-54-252x300.png 252w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-54-860x1024.png 860w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-54-768x914.png 768w\" sizes=\"auto, (max-width: 1013px) 100vw, 1013px\" \/><\/figure>\n\n\n\n<p>Next, we&#8217;ll launch RDS instance<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to <strong>RDS, click Databases, click Create database<\/strong> \n<ul class=\"wp-block-list\">\n<li>Select <strong>Standard Create<\/strong> <\/li>\n\n\n\n<li>Engine: MySQL or PostgreSQL <\/li>\n\n\n\n<li>Templates: free tier<\/li>\n\n\n\n<li>DB instance identifier: <code>shoppingcart-db<\/code> <\/li>\n\n\n\n<li>Credentials: Set a master username and password (store securely)<\/li>\n\n\n\n<li>DB instance size: Choose free-tier (<code>db.t3.micro<\/code>) if available <\/li>\n\n\n\n<li><strong>Storage<\/strong>: Use General Purpose (gp2), use default storage<\/li>\n\n\n\n<li>Connectivity:\n<ul class=\"wp-block-list\">\n<li>VPC: <code>shoppingcart-vpc<\/code><\/li>\n\n\n\n<li>Subnet Group: <code>shoppingcart-db-subnet-group<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Public Access: <strong>NO<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1013\" height=\"1363\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-55.png\" alt=\"\" class=\"wp-image-2622\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-55.png 1013w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-55-223x300.png 223w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-55-761x1024.png 761w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-55-768x1033.png 768w\" sizes=\"auto, (max-width: 1013px) 100vw, 1013px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1013\" height=\"1439\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-56.png\" alt=\"\" class=\"wp-image-2623\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-56.png 1013w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-56-211x300.png 211w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-56-721x1024.png 721w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-56-768x1091.png 768w\" sizes=\"auto, (max-width: 1013px) 100vw, 1013px\" \/><\/figure>\n\n\n\n<p>Next, we&#8217;ll create RDS security group to only allow traffic coming from EC2 which is deployed in the private subnet<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to <strong>EC2 \u2192 Security Groups \u2192 Create security group<\/strong>\n<ul class=\"wp-block-list\">\n<li>Name: <code>rds-ec2-access<\/code><\/li>\n\n\n\n<li>Description: Allow traffic only from EC2<\/li>\n\n\n\n<li>VPC: <code>shoppingcart-vpc<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Inbound rule:\n<ul class=\"wp-block-list\">\n<li>Type: <strong>MySQL\/Aurora<\/strong><\/li>\n\n\n\n<li>Source: <strong>Security group of private EC2 instance<\/strong> (You can find it in your private EC2 instance &gt; Security tab)<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Outbound rule: Allow all (default)<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1013\" height=\"1368\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-57.png\" alt=\"\" class=\"wp-image-2624\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-57.png 1013w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-57-222x300.png 222w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-57-758x1024.png 758w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-57-768x1037.png 768w\" sizes=\"auto, (max-width: 1013px) 100vw, 1013px\" \/><\/figure>\n\n\n\n<p>Then return back to the RDS instance configuration page  and attach the newly created security group to the RDS instance<\/p>\n\n\n\n<div style=\"height:24px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Setup Secure S3 Bucket<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Navigate to <strong>S3 Dashboard<\/strong>,  Click <strong>Create bucket<\/strong><\/li>\n\n\n\n<li><strong>Bucket name<\/strong>: <code>shoppingcart-assets<\/code>-123 (mjst globally unique)<\/li>\n\n\n\n<li><strong>Region<\/strong>: Same as your app resources (e.g., <code>us-east-1<\/code>)<\/li>\n\n\n\n<li><strong>Block Public Access<\/strong>: Keep all 4 checkboxes <strong>enabled<\/strong> (recommended)<\/li>\n\n\n\n<li><strong>Enable Encryption<\/strong>: Select <strong>SSE-S3 (Amazon S3 managed keys)<\/strong><\/li>\n\n\n\n<li>Leave all other options as default<\/li>\n\n\n\n<li>Click <strong>Create bucket<\/strong><\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1013\" height=\"1691\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-58.png\" alt=\"\" class=\"wp-image-2625\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-58.png 1013w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-58-180x300.png 180w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-58-613x1024.png 613w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-58-768x1282.png 768w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-58-920x1536.png 920w\" sizes=\"auto, (max-width: 1013px) 100vw, 1013px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1013\" height=\"883\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-59.png\" alt=\"\" class=\"wp-image-2626\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-59.png 1013w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-59-300x262.png 300w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-59-768x669.png 768w\" sizes=\"auto, (max-width: 1013px) 100vw, 1013px\" \/><\/figure>\n\n\n\n<p>To test whether the bucket is privately deployed, then we can simply upload an object and try to access it<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click on the newly created bucket <code>securecart-assets<\/code> <\/li>\n\n\n\n<li>Go to the <strong>Objects<\/strong> tab \u2192 Click <strong>Upload<\/strong> <\/li>\n\n\n\n<li>Add any test files (e.g., an image like shoppingcart-<code>logo.png<\/code>)<\/li>\n\n\n\n<li>Click upload<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1013\" height=\"622\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-60.png\" alt=\"\" class=\"wp-image-2628\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-60.png 1013w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-60-300x184.png 300w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-60-768x472.png 768w\" sizes=\"auto, (max-width: 1013px) 100vw, 1013px\" \/><\/figure>\n\n\n\n<p>Finally, let&#8217;s verify if the bucket access is private<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>After upload, click on the file name (e.g., <code>shoppingcart-logo.png<\/code>) <\/li>\n\n\n\n<li>Copy the <strong>Object URL<\/strong> <\/li>\n\n\n\n<li>Open it in a new incognito\/private browser tab <\/li>\n\n\n\n<li>We should see <strong>Access Denied<\/strong>, confirming the bucket is private<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1013\" height=\"656\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-61.png\" alt=\"\" class=\"wp-image-2630\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-61.png 1013w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-61-300x194.png 300w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-61-768x497.png 768w\" sizes=\"auto, (max-width: 1013px) 100vw, 1013px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1013\" height=\"271\" src=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-62.png\" alt=\"\" class=\"wp-image-2631\" srcset=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-62.png 1013w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-62-300x80.png 300w, https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-62-768x205.png 768w\" sizes=\"auto, (max-width: 1013px) 100vw, 1013px\" \/><\/figure>\n\n\n\n<div style=\"height:24px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Summary<\/strong><\/h2>\n\n\n\n<p>In this chapter we have setup a secured database and storage tiers to ensure static assets are securely stored and only accessible through IAM-controlled access policies or backend services.<\/p>\n\n\n\n<p>In the last part, we&#8217;ll enable the AWS WAF to strengthen the application-layer security<\/p>\n","protected":false},"excerpt":{"rendered":"<p>After deploying the EC2 (application-tier) behind the Application Load Balancer (ALB), we&#8217;ll privately deploy RDS (database-tier) and S3 (storage-tier) by following the principle of least privilege. The RDS is only accessible from private EC2 while S3 assets are not publicly accessible.<\/p>\n","protected":false},"author":1,"featured_media":2649,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,10,85,75],"tags":[],"class_list":["post-2613","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-backend","category-cloud","category-projects","category-system-design"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 4 - Ichwan Chandra<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 4 - Ichwan Chandra\" \/>\n<meta property=\"og:description\" content=\"After deploying the EC2 (application-tier) behind the Application Load Balancer (ALB), we&#039;ll privately deploy RDS (database-tier) and S3 (storage-tier) by following the principle of least privilege. The RDS is only accessible from private EC2 while S3 assets are not publicly accessible.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/\" \/>\n<meta property=\"og:site_name\" content=\"Ichwan Chandra\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-08T09:19:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-17T17:15:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/06\/aws-solutions-architect-project-security-pillar-part-4-1024x572.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"572\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Ichwan Chandra\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ichwan Chandra\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-4\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-4\\\/\"},\"author\":{\"name\":\"Ichwan Chandra\",\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/#\\\/schema\\\/person\\\/2fa69a7a1008a3369584752194b063d5\"},\"headline\":\"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 4\",\"datePublished\":\"2026-01-08T09:19:00+00:00\",\"dateModified\":\"2026-07-17T17:15:57+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-4\\\/\"},\"wordCount\":414,\"image\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-4\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/aws-solutions-architect-project-security-pillar-part-4.png\",\"articleSection\":[\"Backend\",\"Cloud\",\"Projects\",\"System Design\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-4\\\/\",\"url\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-4\\\/\",\"name\":\"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 4 - Ichwan Chandra\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-4\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-4\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/aws-solutions-architect-project-security-pillar-part-4.png\",\"datePublished\":\"2026-01-08T09:19:00+00:00\",\"dateModified\":\"2026-07-17T17:15:57+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/#\\\/schema\\\/person\\\/2fa69a7a1008a3369584752194b063d5\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-4\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-4\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-4\\\/#primaryimage\",\"url\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/aws-solutions-architect-project-security-pillar-part-4.png\",\"contentUrl\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/aws-solutions-architect-project-security-pillar-part-4.png\",\"width\":1376,\"height\":768,\"caption\":\"aws solutions architect project on security pillar - part 4\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/aws-solutions-architect-project-security-pillar-part-4\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 4\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/\",\"name\":\"Ichwan Chandra\",\"description\":\"In a lifelong learning mode\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/#\\\/schema\\\/person\\\/2fa69a7a1008a3369584752194b063d5\",\"name\":\"Ichwan Chandra\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8d8d64c76e361108ee058442df7c49c539eefd1d1e5a3e8dbcc9d70289e0bbf2?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8d8d64c76e361108ee058442df7c49c539eefd1d1e5a3e8dbcc9d70289e0bbf2?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8d8d64c76e361108ee058442df7c49c539eefd1d1e5a3e8dbcc9d70289e0bbf2?s=96&d=retro&r=g\",\"caption\":\"Ichwan Chandra\"},\"sameAs\":[\"https:\\\/\\\/ichwanchandra.com\\\/blog\"],\"url\":\"https:\\\/\\\/ichwanchandra.com\\\/blog\\\/author\\\/isuchan193\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 4 - Ichwan Chandra","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/","og_locale":"en_US","og_type":"article","og_title":"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 4 - Ichwan Chandra","og_description":"After deploying the EC2 (application-tier) behind the Application Load Balancer (ALB), we'll privately deploy RDS (database-tier) and S3 (storage-tier) by following the principle of least privilege. The RDS is only accessible from private EC2 while S3 assets are not publicly accessible.","og_url":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/","og_site_name":"Ichwan Chandra","article_published_time":"2026-01-08T09:19:00+00:00","article_modified_time":"2026-07-17T17:15:57+00:00","og_image":[{"width":1024,"height":572,"url":"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/06\/aws-solutions-architect-project-security-pillar-part-4-1024x572.png","type":"image\/png"}],"author":"Ichwan Chandra","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Ichwan Chandra","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/#article","isPartOf":{"@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/"},"author":{"name":"Ichwan Chandra","@id":"https:\/\/ichwanchandra.com\/blog\/#\/schema\/person\/2fa69a7a1008a3369584752194b063d5"},"headline":"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 4","datePublished":"2026-01-08T09:19:00+00:00","dateModified":"2026-07-17T17:15:57+00:00","mainEntityOfPage":{"@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/"},"wordCount":414,"image":{"@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/#primaryimage"},"thumbnailUrl":"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/06\/aws-solutions-architect-project-security-pillar-part-4.png","articleSection":["Backend","Cloud","Projects","System Design"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/","url":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/","name":"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 4 - Ichwan Chandra","isPartOf":{"@id":"https:\/\/ichwanchandra.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/#primaryimage"},"image":{"@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/#primaryimage"},"thumbnailUrl":"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/06\/aws-solutions-architect-project-security-pillar-part-4.png","datePublished":"2026-01-08T09:19:00+00:00","dateModified":"2026-07-17T17:15:57+00:00","author":{"@id":"https:\/\/ichwanchandra.com\/blog\/#\/schema\/person\/2fa69a7a1008a3369584752194b063d5"},"breadcrumb":{"@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/#primaryimage","url":"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/06\/aws-solutions-architect-project-security-pillar-part-4.png","contentUrl":"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/06\/aws-solutions-architect-project-security-pillar-part-4.png","width":1376,"height":768,"caption":"aws solutions architect project on security pillar - part 4"},{"@type":"BreadcrumbList","@id":"https:\/\/ichwanchandra.com\/blog\/aws-solutions-architect-project-security-pillar-part-4\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/ichwanchandra.com\/blog\/"},{"@type":"ListItem","position":2,"name":"AWS Solutions Architect Project (Security Pillar) \u2013 Secure Application Deployment \u2013 Part 4"}]},{"@type":"WebSite","@id":"https:\/\/ichwanchandra.com\/blog\/#website","url":"https:\/\/ichwanchandra.com\/blog\/","name":"Ichwan Chandra","description":"In a lifelong learning mode","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ichwanchandra.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/ichwanchandra.com\/blog\/#\/schema\/person\/2fa69a7a1008a3369584752194b063d5","name":"Ichwan Chandra","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/8d8d64c76e361108ee058442df7c49c539eefd1d1e5a3e8dbcc9d70289e0bbf2?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/8d8d64c76e361108ee058442df7c49c539eefd1d1e5a3e8dbcc9d70289e0bbf2?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8d8d64c76e361108ee058442df7c49c539eefd1d1e5a3e8dbcc9d70289e0bbf2?s=96&d=retro&r=g","caption":"Ichwan Chandra"},"sameAs":["https:\/\/ichwanchandra.com\/blog"],"url":"https:\/\/ichwanchandra.com\/blog\/author\/isuchan193\/"}]}},"_links":{"self":[{"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/posts\/2613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/comments?post=2613"}],"version-history":[{"count":13,"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/posts\/2613\/revisions"}],"predecessor-version":[{"id":2794,"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/posts\/2613\/revisions\/2794"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/media\/2649"}],"wp:attachment":[{"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/media?parent=2613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/categories?post=2613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ichwanchandra.com\/blog\/wp-json\/wp\/v2\/tags?post=2613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}