How karimrabiee/aws-secure-scalable-web-application-architecture works
Nimbus Store is a Flask storefront deployed on private, two-AZ AWS infrastructure. A user browses products and places orders through the web tier; the application reads products and writes orders in RDS. Terraform defines the platform, while the documented guarded GitHub Actions flow delivers infrastructure changes. Relationships among sampled application components are supported by source excerpts; most AWS wiring and delivery details are documented in the README rather than sampled Terraform or workflow source.
Main entry points: dev/main.tf Dev and prod stacks · app.py Web entry · compute/main.tf Private app tier · db.py Database access
Components 16
Storefront
- Storefront UI
terraform/modules/compute/app-src/templates - Order client
terraform/modules/compute/app-src/static/js/app.js - Web entry
terraform/modules/compute/app-src/app.py - Database access
terraform/modules/compute/app-src/db.py
AWS platform
- Application load balancer
terraform/modules/alb/main.tf - Private app tier
terraform/modules/compute/main.tf - VPC networking
terraform/modules/networking/main.tf - RDS MySQL
terraform/modules/database/main.tf
Security and operations
- AWS WAF
terraform/modules/waf/main.tf - Secrets Manager
terraform/modules/security-services/main.tf - IAM and security groups
terraform/modules/security/main.tf - Alarms and logs
terraform/modules/monitoring/main.tf
Infrastructure delivery
- GitHub Actions
.github/workflows/terraform-deploy.yml - AWS OIDC role
terraform/modules/security/main.tf - Dev and prod stacks
terraform/environments/dev/main.tf
Other components
- Shopper
Connections 22
- Shopper → AWS WAF: requests storefront
README.md - AWS WAF → Application load balancer: filters traffic
README.md - Application load balancer → Private app tier: routes requests
README.md - Private app tier → Web entry: serves Flask
README.md - Web entry → Storefront UI: renders pages
terraform/modules/compute/app-src/app.py - Storefront UI → Order client: loads client
README.md - Order client → Web entry: posts orders
terraform/modules/compute/app-src/static/js/app.js - Web entry → Database access: calls data access
terraform/modules/compute/app-src/app.py - Database access → RDS MySQL: reads and writes
README.md - Database access → Secrets Manager: retrieves credentials
terraform/modules/compute/app-src/db.py - Dev and prod stacks → VPC networking: configures network
README.md - Dev and prod stacks → Application load balancer: configures ingress
README.md - Dev and prod stacks → Private app tier: configures app tier
README.md - Dev and prod stacks → RDS MySQL: configures database
README.md - Dev and prod stacks → AWS WAF: configures protection
README.md - Dev and prod stacks → IAM and security groups: configures access
README.md - Dev and prod stacks → Alarms and logs: configures observability
README.md - Private app tier → Secrets Manager: reads secret
README.md - Alarms and logs → RDS MySQL: observes services
README.md - Alarms and logs → GitHub Actions: alerts through SNS
README.md - GitHub Actions → AWS OIDC role: authenticates with OIDC
README.md - GitHub Actions → Dev and prod stacks: plans and applies
README.md