Ravindra BagaleCourses & study guides मराठी

Chapter 46: Terraform 3-Tier Architecture Multi-AZ with ALBs Auto Scaling Bastion NAT and RDS

By Last updated:

Chala mitrano, aaj sagla mothha project. Don zone, public aani private subnet, NAT gateway, bastion, internet-facing aani internal load balancer, web aani app che vegle Auto Scaling group, aani RDS standby sobat read replica. Interview madhe ha prashna nakki yeto. Picture samjla tar code saral aahe. Ani shevti destroy visru naka.

What you will learn in this chapter

  • Draw a multi-AZ 3-tier design with four subnet layers
  • Build public, private web, private app and DB subnets with IGW, NAT and route tables
  • Chain six security groups and a bastion
  • Run web and app tiers in separate Auto Scaling groups behind external and internal ALBs
  • Create a Multi-AZ RDS standby and a read replica
  • Test end to end and destroy

Concepts in this chapter

  1. 46.1Multi-AZ 3-tier architecture: the picture and the file layout
  2. 46.2VPC, public and private subnets, internet gateway, NAT gateways and route tables
  3. 46.3Security group chain for all tiers and the bastion
  4. 46.4Bastion jump server in the public subnet
  5. 46.5Internet-facing ALB and web tier Auto Scaling group
  6. 46.6Internal ALB and app tier Auto Scaling group
  7. 46.7DB subnet group, Multi-AZ RDS standby and read replica
  8. 46.8Outputs, apply, test end to end and destroy

The chapter recap is at the end of the last concept page.

Practice Tasks

About this scenario

Suppose we are on the DevOps team at Netflix, the video streaming company, working from Los Gatos. Emily Carter leads the team, and we look after the recommendations service. Costs are counted in USD. In the tasks below we do real DevOps jobs on this project using what this lesson teaches. Netflix is a real company, but this project, the people, servers, IP addresses and numbers are made up for practice.

0 / 12

Easy S3 bucket resource

Why: Buckets in code are reviewed and never forgotten.

What to do: Write a resource aws_s3_bucket named logs with bucket = "netflix-logs" and tags { Team = "devops" }.

How:
  1. Write the block type (resource, variable, output, module...) and its labels in quotes.
  2. Open { and write each argument as name = value.
  3. Put text values in double quotes; numbers and true/false without quotes.
  4. Close every block with } and click Check answer.

Easy Output a value

Why: Outputs hand values to scripts and other modules.

What to do: Write output "web_ip" with value = aws_instance.web.public_ip.

How:
  1. Write the block type (resource, variable, output, module...) and its labels in quotes.
  2. Open { and write each argument as name = value.
  3. Put text values in double quotes; numbers and true/false without quotes.
  4. Close every block with } and click Check answer.

Easy Provider block

Why: The provider tells Terraform which cloud and region to talk to.

What to do: Write a provider "aws" block with region = "us-west-2".

How:
  1. Write the block type (resource, variable, output, module...) and its labels in quotes.
  2. Open { and write each argument as name = value.
  3. Put text values in double quotes; numbers and true/false without quotes.
  4. Close every block with } and click Check answer.

Easy Connect to an EC2 server

Why: SSH with a key file is the standard way to log in to a Linux EC2 instance.

What to do: Log in to the server 13.10.20.5 as ec2-user using the key netflix-key.pem.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Click Check answer.

Easy Name the practice

Why: IaC is the base of repeatable cloud setups.

What to do: Netflix describes its servers, networks and databases in text files kept in Git and creates them with a tool. What is this called (three-letter short form)?

How:
  1. Write down the facts or numbers the task gives you.
  2. Work it out step by step.
  3. Type only the final answer (one word or number) in the box.
  4. Click Check answer.

Medium EC2 instance using a variable

Why: Referencing var.* avoids hard-coding sizes.

What to do: Write resource aws_instance "web" with ami = "ami-0abcdef1234567890", instance_type = var.instance_type and tags Name = "recommendations".

How:
  1. Write the block type (resource, variable, output, module...) and its labels in quotes.
  2. Open { and write each argument as name = value.
  3. Put text values in double quotes; numbers and true/false without quotes.
  4. Close every block with } and click Check answer.

Medium Pin the provider version

Why: Pinning stops a new provider release from breaking your plan.

What to do: Write a terraform block with required_providers aws = { source = "hashicorp/aws", version = "~> 5.0" }.

How:
  1. Write the block type (resource, variable, output, module...) and its labels in quotes.
  2. Open { and write each argument as name = value.
  3. Put text values in double quotes; numbers and true/false without quotes.
  4. Close every block with } and click Check answer.

Medium Apply the saved plan

Why: No surprise changes: only the reviewed plan runs.

What to do: Apply the saved plan file netflix.tfplan.

How:
  1. Read the task and pick the tool it needs (git, docker, kubectl, terraform, ansible...).
  2. Write the tool name, then the sub-command (the action word).
  3. Add the flags the task needs, each followed by its value.
  4. Add names, files or paths at the end, then click Check answer.

Hard Security group for HTTPS

Why: Opening only 443 keeps the attack surface small.

What to do: Write resource aws_security_group "web" with name = "web-sg" and one ingress block: from_port = 443, to_port = 443, protocol = "tcp", cidr_blocks = ["0.0.0.0/0"].

How:
  1. Write the block type (resource, variable, output, module...) and its labels in quotes.
  2. Open { and write each argument as name = value.
  3. Put text values in double quotes; numbers and true/false without quotes.
  4. Close every block with } and click Check answer.

Hard Create several copies with count

Why: count builds N identical resources from one block.

What to do: Write resource aws_instance "worker" with count = 2, ami = "ami-0abcdef1234567890", instance_type = "t3.small" and tags Name = "worker-${count.index}".

How:
  1. Write the block type (resource, variable, output, module...) and its labels in quotes.
  2. Open { and write each argument as name = value.
  3. Put text values in double quotes; numbers and true/false without quotes.
  4. Close every block with } and click Check answer.

Hard Call a module

Why: Modules package a tested pattern, like a VPC, for reuse.

What to do: Write module "vpc" with source = "terraform-aws-modules/vpc/aws", version = "5.8.1", name = "netflix-vpc" and cidr = "10.0.0.0/16".

How:
  1. Write the block type (resource, variable, output, module...) and its labels in quotes.
  2. Open { and write each argument as name = value.
  3. Put text values in double quotes; numbers and true/false without quotes.
  4. Close every block with } and click Check answer.

Hard Remote state in S3

Why: Shared remote state with locking stops two people breaking each other.

What to do: Write a terraform block with backend "s3": bucket = "netflix-tfstate", key = "prod/terraform.tfstate", region = "us-west-2", dynamodb_table = "tf-lock".

How:
  1. Write the block type (resource, variable, output, module...) and its labels in quotes.
  2. Open { and write each argument as name = value.
  3. Put text values in double quotes; numbers and true/false without quotes.
  4. Close every block with } and click Check answer.

See all DevOps practice tasks in the Task Hub →

Ravi Sir's Cards: 19 revision, interview and comparison cards for this chapter · मराठी cards