Project: Build a Reels Video Upload App with Amazon S3, EC2 and RDS MySQL

By Ravindra Bagale, trainer · LinkedIn · Last updated: 22 October 2026

1. The story: a reels app for a college fest

A college fest wants students to upload 30-second reels. Hundreds of videos, each 20 to 80 MB, and everyone watching on phones. If videos sit on the EC2 disk, the disk fills up, a second server cannot see them, and losing the instance loses the fest.

So: big files to S3, small facts (who, caption, size, key) to MySQL, and the app on EC2 just connects them.

2. Architecture

Why do we need this?

Each part does the job it is best at. Databases are bad at storing big binary files; S3 is bad at queries like "latest 20 reels by user 7".

What is it?

3. Two ways to upload

Why do we need this?

An 80 MB video through your server uses its CPU, memory and bandwidth twice (in and out). A pre-signed PUT sends it straight to S3.

What is it?

4. Database schema

CREATE DATABASE reels CHARACTER SET utf8mb4;
USE reels;
CREATE TABLE users (
  id INT AUTO_INCREMENT PRIMARY KEY,
  username VARCHAR(50) NOT NULL UNIQUE,
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);
CREATE TABLE reels (
  id BIGINT AUTO_INCREMENT PRIMARY KEY,
  user_id INT NOT NULL,
  s3_key VARCHAR(512) NOT NULL UNIQUE,
  caption VARCHAR(300),
  duration_sec SMALLINT,
  size_bytes BIGINT NOT NULL,
  content_type VARCHAR(50) DEFAULT 'video/mp4',
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
  FOREIGN KEY (user_id) REFERENCES users(id),
  INDEX idx_user_created (user_id, created_at)
);
INSERT INTO users (username) VALUES ('ravi'), ('asha');

Why store the key and not the full URL? The domain may change (S3 → CloudFront → custom domain). The key never changes; build the URL when reading.

5. Node.js app (main)

// app.js  -  npm i express mysql2 @aws-sdk/client-s3 @aws-sdk/s3-request-presigner uuid
const express = require('express');
const mysql = require('mysql2/promise');
const { S3Client, PutObjectCommand, GetObjectCommand, HeadObjectCommand } = require('@aws-sdk/client-s3');
const { getSignedUrl } = require('@aws-sdk/s3-request-presigner');
const { v4: uuid } = require('uuid');

const BUCKET = process.env.BUCKET;            // reels-app-media
const CDN = process.env.CDN_DOMAIN || '';      // dxxxx.cloudfront.net (optional)
const s3 = new S3Client({ region: 'ap-south-1' }); // creds come from the EC2 role
const db = mysql.createPool({ host: process.env.DB_HOST, user: 'app',
  password: process.env.DB_PASS, database: 'reels' });
const app = express();
app.use(express.json());
app.use(express.static('public'));

app.post('/api/upload-url', async (req, res) => {
  const { userId, type, size } = req.body;
  if (type !== 'video/mp4' || size > 100 * 1024 * 1024) return res.status(400).json({ error: 'mp4 up to 100 MB' });
  const key = `reels/u${userId}/${uuid()}.mp4`;
  const url = await getSignedUrl(s3, new PutObjectCommand({ Bucket: BUCKET, Key: key,
    ContentType: type, ContentLength: size }), { expiresIn: 300 });
  res.json({ key, url });
});

app.post('/api/reels', async (req, res) => {
  const { userId, key, caption, duration } = req.body;
  if (!key.startsWith(`reels/u${userId}/`)) return res.status(403).end();
  const head = await s3.send(new HeadObjectCommand({ Bucket: BUCKET, Key: key })); // 404 if missing
  await db.execute('INSERT INTO reels (user_id,s3_key,caption,duration_sec,size_bytes) VALUES (?,?,?,?,?)',
    [userId, key, caption, duration, head.ContentLength]);
  res.status(201).json({ ok: true });
});

app.get('/api/reels', async (req, res) => {
  const [rows] = await db.query('SELECT r.id,u.username,r.s3_key,r.caption,r.duration_sec,r.size_bytes,r.created_at FROM reels r JOIN users u ON u.id=r.user_id ORDER BY r.created_at DESC LIMIT 20');
  for (const r of rows) r.url = CDN ? `https://${CDN}/${r.s3_key}`
    : await getSignedUrl(s3, new GetObjectCommand({ Bucket: BUCKET, Key: r.s3_key }), { expiresIn: 900 });
  res.json(rows);
});

app.listen(3000, () => console.log('reels on :3000'));

Browser side (public/index.html), the important part:

const f = document.querySelector('#file').files[0];
const r = await fetch('/api/upload-url', {method:'POST', headers:{'Content-Type':'application/json'},
  body: JSON.stringify({userId:1, type:f.type, size:f.size})}).then(x => x.json());
await fetch(r.url, {method:'PUT', headers:{'Content-Type':f.type}, body:f});   // straight to S3
await fetch('/api/reels', {method:'POST', headers:{'Content-Type':'application/json'},
  body: JSON.stringify({userId:1, key:r.key, caption:cap.value, duration:30})});

6. Flask and PHP versions

# app.py  -  pip install flask boto3 pymysql
import os, uuid, boto3, pymysql
from flask import Flask, request, jsonify
s3 = boto3.client("s3", region_name="ap-south-1")
B = os.environ["BUCKET"]
db = lambda: pymysql.connect(host=os.environ["DB_HOST"], user="app", password=os.environ["DB_PASS"], database="reels")
app = Flask(__name__)

@app.post("/api/upload-url")
def upload_url():
    j = request.json
    if j["type"] != "video/mp4" or j["size"] > 100*1024*1024: return {"error": "mp4 up to 100 MB"}, 400
    key = f"reels/u{j['userId']}/{uuid.uuid4()}.mp4"
    url = s3.generate_presigned_url("put_object", Params={"Bucket": B, "Key": key, "ContentType": j["type"]}, ExpiresIn=300)
    return {"key": key, "url": url}

@app.post("/api/reels")
def save():
    j = request.json
    size = s3.head_object(Bucket=B, Key=j["key"])["ContentLength"]
    with db() as c, c.cursor() as cur:
        cur.execute("INSERT INTO reels (user_id,s3_key,caption,duration_sec,size_bytes) VALUES (%s,%s,%s,%s,%s)",
                    (j["userId"], j["key"], j["caption"], j["duration"], size)); c.commit()
    return {"ok": True}, 201

<?php // upload-url.php  -  composer require aws/aws-sdk-php
require 'vendor/autoload.php';
$s3 = new Aws\S3\S3Client(['region' => 'ap-south-1', 'version' => 'latest']);
$in = json_decode(file_get_contents('php://input'), true);
$key = sprintf('reels/u%d/%s.mp4', $in['userId'], bin2hex(random_bytes(16)));
$cmd = $s3->getCommand('PutObject', ['Bucket' => getenv('BUCKET'), 'Key' => $key, 'ContentType' => 'video/mp4']);
$url = (string) $s3->createPresignedRequest($cmd, '+5 minutes')->getUri();
header('Content-Type: application/json');
echo json_encode(['key' => $key, 'url' => $url]);

7. IAM role, bucket CORS and endpoint

{"Version":"2012-10-17","Statement":[{"Effect":"Allow",
 "Action":["s3:PutObject","s3:GetObject"],"Resource":"arn:aws:s3:::reels-app-media/reels/*"},
 {"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::reels-app-media/backups/*"}]}

[{"AllowedOrigins":["http://YOUR-EC2-PUBLIC-DNS:3000"],"AllowedMethods":["PUT","GET"],
  "AllowedHeaders":["*"],"ExposeHeaders":["ETag"],"MaxAgeSeconds":3000}]

Why CORS: the page is on your domain but the PUT goes to s3.amazonaws.com. Without CORS the browser blocks it. Why HeadObject needs only s3:GetObject: HEAD is authorised by GetObject.

8. Build it: full lab

How to do it (step by step)

Part A: S3, IAM, network

1. Region ap-south-1. Create bucket yourname-reels-media: BPA on, ACLs disabled, versioning Enable, SSE-S3.
2. Bucket › Permissions › CORS › paste the CORS JSON (origin = your EC2 address later; use * while testing).
3. IAM › Policies › Create: the JSON above (with your bucket), name reels-s3-policy.
4. IAM › Roles › Create: EC2, attach reels-s3-policy, name reels-ec2-role.
5. VPC › Security groups: reels-web (22 from My IP, 3000 from 0.0.0.0/0) and reels-db (3306 from reels-web).
6. VPC › Endpoints › Create: AWS services, com.amazonaws.ap-south-1.s3, type Gateway, default VPC, select its route tables.

Part B: RDS and EC2

1. RDS › Create database: MySQL 8.0, Free tier, identifier reels-db, master admin, db.t3.micro or db.t4g.micro, 20 GB gp3, Public access No, SG reels-db.
2. EC2 › Launch: Amazon Linux 2023, t3.micro, SG reels-web, IAM instance profile reels-ec2-role.
3. SSH in. sudo dnf install -y nodejs mariadb105.
4. Check the role: aws sts get-caller-identity. Expected: an ARN with assumed-role/reels-ec2-role.
5. mysql -h <rds-endpoint> -u admin -p, paste the schema, then CREATE USER 'app'@'%' IDENTIFIED BY 'StrongPass#1'; GRANT SELECT,INSERT ON reels.* TO 'app'@'%';
6. mkdir reels && cd reels && npm init -y && npm i express mysql2 @aws-sdk/client-s3 @aws-sdk/s3-request-presigner uuid, create app.js and public/index.html.
7. BUCKET=yourname-reels-media DB_HOST=<rds-endpoint> DB_PASS='StrongPass#1' node app.js. Expected: reels on :3000.

Part C: test

1. Open http://EC2-PUBLIC-IP:3000, pick a small mp4, add a caption, upload.
2. Browser DevTools › Network: the PUT goes to yourname-reels-media.s3.ap-south-1.amazonaws.com with status 200.
3. aws s3 ls s3://yourname-reels-media/reels/ --recursive. Expected: reels/u1/<uuid>.mp4.
4. SELECT s3_key,caption,size_bytes,created_at FROM reels.reels; shows the row.
5. curl -s localhost:3000/api/reels: each item has a pre-signed url. Open it: the video plays. After 15 minutes it returns AccessDenied.
6. Optional: CloudFront with OAC on this bucket (as in the static website chapter), then restart with CDN_DOMAIN=dxxxx.cloudfront.net. Why: cached playback for many viewers.

9. Backups with cron

Why do we need this?

Logs fill the EC2 disk, and a database without an off-server copy is a risk. S3 with a lifecycle rule is a cheap backup target.

How to do it (step by step)

# /home/ec2-user/backup.sh
#!/bin/bash
set -e
D=$(date +%F)
mysqldump -h "$DB_HOST" -u admin -p"$DB_ADMIN_PASS" --single-transaction reels | gzip > /tmp/reels-$D.sql.gz
aws s3 cp /tmp/reels-$D.sql.gz s3://yourname-reels-media/backups/mysql/ --storage-class STANDARD_IA
aws s3 sync /var/log/reels/ s3://yourname-reels-media/backups/logs/$(hostname)/
rm -f /tmp/reels-$D.sql.gz

# crontab -e   (2:30 AM every day)
30 2 * * * DB_HOST=... DB_ADMIN_PASS=... /home/ec2-user/backup.sh >> /var/log/reels-backup.log 2>&1

On AL2023 install cron first: sudo dnf install -y cronie && sudo systemctl enable --now crond. Better: keep the password in Secrets Manager or ~/.my.cnf (chmod 600), not in crontab. Add a lifecycle rule on backups/: Glacier Instant after 30 days, expire after 365.

10. S3 event notifications

Why do we need this?

When a reel arrives you may want to alert moderators or make a thumbnail, without the app polling S3.

What is it?

Bucket › Properties › Event notifications › Create: name new-reel, prefix reels/, suffix .mp4, event All object create events, destination SNS topic (email moderators) or a Lambda function. The SNS topic or Lambda must have a resource policy allowing s3.amazonaws.com; the console adds it for Lambda. For many targets and filters, send events to EventBridge instead.

# Lambda (Python) - logs each new reel
def handler(event, context):
    for r in event["Records"]:
        print(r["s3"]["bucket"]["name"], r["s3"]["object"]["key"], r["s3"]["object"]["size"])

11. Cleanup

1. Delete the event notification, Lambda/SNS topic, CloudFront distribution (disable first).
2. Terminate the EC2 instance. Delete RDS reels-db (skip final snapshot for a lab).
3. S3 › bucket › Empty (all versions), then Delete.
4. Delete the VPC endpoint, security groups reels-web and reels-db, role reels-ec2-role and policy reels-s3-policy.

12. Interview questions

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.