STACK · advanced

AWS Production

The grown-up deployment: infrastructure as code on AWS for apps that outgrew serverless simplicity.

  • AWS: the account underlying every resource here
  • RDS Postgres: managed relational database
  • ECS Fargate: managed container hosting
  • S3: object storage
  • CloudFront: CDN
  • SES: transactional email at scale

What this stack is for

At some point the app stops being a weekend project and starts being a thing people yell about when it is down. This stack is for that point: every piece of infrastructure defined in code, reviewed like code, and rebuildable from the repo, because the alternative is an AWS console somebody clicked together in 2024 that nobody can explain or reproduce. It is more setup than anything else on this site, and it is the setup that makes the 3am page survivable.

Components

  • AWS CDK: infrastructure as code; defines every resource below in TypeScript or Python
  • RDS Postgres: managed relational database
  • ECS Fargate: managed container hosting, no server management
  • S3: object storage for uploads and static assets
  • CloudFront: CDN in front of S3 and the app
  • SES: transactional email at AWS-native scale

How the pieces fit

  • CDK stacks define RDS, ECS Fargate, S3, CloudFront, and SES as versioned code, not console clicks
  • The app runs as a container task on ECS Fargate, talking to RDS over a private subnet
  • Static assets and uploads live in S3; CloudFront fronts both the assets and the app for caching and TLS
  • SES sends transactional email from a verified domain
  • A CI/CD pipeline builds the container image and deploys the CDK stack on merge to main
  • Secrets (DB credentials, SES keys) live in AWS Secrets Manager, not in the container image or repo

Setup outline

  1. Bootstrap the AWS account and CDK toolkit (full walkthrough coming)
  2. Define the VPC, RDS Postgres instance, and security groups in CDK (full walkthrough coming)
  3. Define the ECS Fargate service and task definition in CDK (full walkthrough coming)
  4. Define S3 + CloudFront for static assets (full walkthrough coming)
  5. Verify a sending domain in SES (full walkthrough coming)
  6. Wire the CI/CD pipeline to build, push, and deploy on merge (full walkthrough coming)

What to hand your agent

Infrastructure work punishes ambiguity harder than app work does, so be specific:

  • The full stack description above, plus the PRD and any existing infrastructure diagrams
  • The target AWS account, region, and any compliance constraints
  • The instruction to keep all secrets in Secrets Manager and reference them by ARN, never inline

Adaptation notes

  • A single EC2 instance or Lightsail can replace ECS Fargate for a lower-traffic app that still needs "real AWS"
  • Aurora Serverless can replace RDS Postgres when traffic is spiky and idle cost matters
  • Terraform is a valid substitute for CDK if the team already standardizes on it