Live Project: Mitrano Reels

About this part

This part brings everything together in one real project: Mitrano Reels, a small Instagram-reel-style app running on AWS.

You build it step by step. The web app runs on a LEMP stack on EC2. Uploaded videos go to S3. User and post data live in an RDS MySQL database. The server reaches S3 through an IAM role instead of stored access keys. The front end is a vertical, swipe-to-scroll reel feed made with CSS scroll-snap.

Each choice is also a security lesson. The IAM role means no secret key is sitting in a config file waiting to leak. Keeping the database private means it cannot be reached from the internet. Least-privilege policies mean the app can upload only to its own bucket.

Example: imagine you are a junior engineer asked to deploy a short-video feature for a regional news app. The architecture in this chapter is a clean starting point you can explain in an interview, box by box.

By the end you will have a working app, a diagram you understand completely, and a list of the security decisions behind it.

Why this design carries over. The project uses PHP, but the same layout (web tier on EC2, files in object storage, data in a managed database, an IAM role instead of keys) is used for Spring Boot, Django, Node.js and .NET apps, and on Azure and Google Cloud too.

After this part you will be able to

1. Draw and explain a three-tier AWS architecture.
2. Use an IAM role instead of access keys on EC2.
3. Upload and serve videos from S3 safely.
4. Explain each security decision in an interview.

A real-world picture

Suppose we are a junior engineer at ShareChat-style short-video company (sample data). The product team wants uploads up to 60 seconds. You let the app create a presigned upload URL, so the phone uploads straight to S3, and the EC2 server never handles big files. Globally, reel-style feeds at Instagram and YouTube Shorts made this pattern very common. Everyday analogy: a courier counter that hands you a sealed, numbered bag. You fill it yourself, and only that bag is accepted.

Beginner questions I get in class

Q. Can I use this project in my portfolio?
Yes. Add an architecture diagram and a list of the security decisions. Interviewers like that.

Q. Why an IAM role and not access keys?
Roles give temporary credentials automatically. Keys can leak from code or config.

Q. What if videos are large?
Use presigned uploads and, later, a CDN like CloudFront.

Key terms

• Three-tier: Web, application and data layers, each with its own access rules.
• IAM role: An identity an EC2 instance can use without stored keys.
• Least privilege: Only the permissions a task really needs.
• Scroll-snap: A CSS feature that makes the reel feed stop cleanly on each video.
• Presigned upload: The phone uploads straight to S3 with a temporary URL.

Mini case study

Suppose we are a junior analyst at Tata Consultancy Services, asked to review a new web server on AWS before launch (with the client's written approval). The checklist from this part becomes a short report: what you checked, what you found (for example "port 22 open to 0.0.0.0/0" or "directory listing on"), the evidence (a command and its output), and the fix. Clear, evidence-based reports like this are how defenders work every day.