![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=1920,fit=crop/AoPZoWn7wwcpjkWw/fy3mfe-YbNnVZgZxWcal2qv.jpg)
High Availability with Auto Scaling and Load Balancing
Overview
Highly available systems are reliable and they continue to function even if essential components fail. Auto Scaling and Elastic Load Balancing are features of the AWS that can be used separately or together for elasticity and high availability. Auto Scaling automates the process of launching and terminating the EC2 instances based on the traffic for your application. It helps ensure that you have the required number of instances available to maintain steady, predictable performance at the lowest possible cost. It provides elasticity and scalability.
On the other hand, Load Balancing automatically distributes incoming application traffic across multiple targets like EC2 instances, containers, and IP addresses. An Elastic Load Balancer can handle the varying load of your application traffic in a single Availability Zone or across multiple Availability Zones. In this project, I have used Application Load balancer which is best suited for load balancing HTTP and HTTPS traffic
Architecture
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=926,h=895,fit=crop/AoPZoWn7wwcpjkWw/highly-available-wm-dJoe91XVzwInLrNo.jpeg)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=320,fit=crop/AoPZoWn7wwcpjkWw/highly-available-wm-dJoe91XVzwInLrNo.jpeg)
Steps to create a highly available architecture with auto scaling and load balancing
Create a VPC in us-east-1 region and to design for high availability, configure VPC with 2 subnet spaces in 2 availability zones us-east-1a and us-east-1c where each availability zone is set to have 1 public subnet and 1 private subnet
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=461,h=663,fit=crop/AoPZoWn7wwcpjkWw/1.create-vpc-mxBjqMp6DDhx5aE3.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=462,fit=crop/AoPZoWn7wwcpjkWw/1.create-vpc-mxBjqMp6DDhx5aE3.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=381,h=667,fit=crop/AoPZoWn7wwcpjkWw/2.create-vpc-A3QazOzG59IlLw51.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=537,fit=crop/AoPZoWn7wwcpjkWw/2.create-vpc-A3QazOzG59IlLw51.png)
Create a NAT gateway in one of the availability zones, so that instances in the private subnet can connect to servers outside the VPC, but the services outside cannot make a connection to the instances
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=549,h=510,fit=crop/AoPZoWn7wwcpjkWw/3.create-vpc-A3Qaz2yn5jigR8r2.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=320,fit=crop/AoPZoWn7wwcpjkWw/3.create-vpc-A3Qaz2yn5jigR8r2.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=518,h=501,fit=crop/AoPZoWn7wwcpjkWw/4.created-vpc-Aq2eLWxEzahR3zzv.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=320,fit=crop/AoPZoWn7wwcpjkWw/4.created-vpc-Aq2eLWxEzahR3zzv.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=1185,h=320,fit=crop/AoPZoWn7wwcpjkWw/5.vpc-resource-map-Aq2eLWnkNWIK5kwp.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=92,fit=crop/AoPZoWn7wwcpjkWw/5.vpc-resource-map-Aq2eLWnkNWIK5kwp.png)
Launch an EC2 instance, configure with Amazon Linux AMI, t2 micro instance type in the public subnet-1 with a security group that allows SSH and HTTP traffic from any source. In the advanced settings, update the user data with an initialization script that installs a LAMP stack, web pages, AWS SDK, updates existing packages and start the web server
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=1224,h=138,fit=crop/AoPZoWn7wwcpjkWw/6.ec2-instance-mP4PjOP9Q3s2xOVM.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=37,fit=crop/AoPZoWn7wwcpjkWw/6.ec2-instance-mP4PjOP9Q3s2xOVM.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=567,h=444,fit=crop/AoPZoWn7wwcpjkWw/7.user-data-m6LP6ZDbPZij27bp.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=258,h=203,fit=crop/AoPZoWn7wwcpjkWw/7.user-data-m6LP6ZDbPZij27bp.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=989,h=581,fit=crop/AoPZoWn7wwcpjkWw/8.ec2-instance-summary-m2WBv8r9beH1kLPq.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=200,fit=crop/AoPZoWn7wwcpjkWw/8.ec2-instance-summary-m2WBv8r9beH1kLPq.png)
After the instance is launched, using public IP address, we should be able to access the web page
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=866,h=359,fit=crop/AoPZoWn7wwcpjkWw/9.web-page-with-public-ip-ALpBaeoZ5NCJR2EB.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=143,fit=crop/AoPZoWn7wwcpjkWw/9.web-page-with-public-ip-ALpBaeoZ5NCJR2EB.png)
Create an IAM instance profile for Systems Manager by attaching AmazonSSMManagedInstanceCore policy and assign it to the EC2 instance. The web server will later use this IAM role to connect to the RDS
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=848,h=565,fit=crop/AoPZoWn7wwcpjkWw/10.iam-role-for-ssm-dJoe1ZzyNJsB3KXN.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=216,fit=crop/AoPZoWn7wwcpjkWw/10.iam-role-for-ssm-dJoe1ZzyNJsB3KXN.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=532,h=607,fit=crop/AoPZoWn7wwcpjkWw/11.iam-ssm-permissions-m2WBv8xZZEuOejjX.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=360,fit=crop/AoPZoWn7wwcpjkWw/11.iam-ssm-permissions-m2WBv8xZZEuOejjX.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=776,h=360,fit=crop/AoPZoWn7wwcpjkWw/12.ssm-role-to-instance-AoPZOWVX5OUDb008.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=149,fit=crop/AoPZoWn7wwcpjkWw/12.ssm-role-to-instance-AoPZOWVX5OUDb008.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=772,h=384,fit=crop/AoPZoWn7wwcpjkWw/13.session-manager-connect-YD082lMPL6iPWV81.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=168,fit=crop/AoPZoWn7wwcpjkWw/13.session-manager-connect-YD082lMPL6iPWV81.png)
Create an Amazon Machine Image (AMI) using the EC2 instance created earlier. After the image is created, it automatically terminates the EC2 instance that was launched initially. This newly created AMI will be used when configuring the Auto Scaling Group to automatically launch the instances
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=779,h=497,fit=crop/AoPZoWn7wwcpjkWw/14.created-ami-YbNnKBjlzLsee0Xk.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=207,fit=crop/AoPZoWn7wwcpjkWw/14.created-ami-YbNnKBjlzLsee0Xk.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=884,h=225,fit=crop/AoPZoWn7wwcpjkWw/15.original-instance-terminated-dOqlLaQGB8hxnLg2.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=91,fit=crop/AoPZoWn7wwcpjkWw/15.original-instance-terminated-dOqlLaQGB8hxnLg2.png)
Create target group, configure and set up the Application Load Balancer to handle load balancing HTTP requests
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=1165,h=236,fit=crop/AoPZoWn7wwcpjkWw/16.target-group-YrD1jJ0ZrzhgM7yR.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=68,fit=crop/AoPZoWn7wwcpjkWw/16.target-group-YrD1jJ0ZrzhgM7yR.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=1171,h=298,fit=crop/AoPZoWn7wwcpjkWw/17.alb-dJoe1bo8yOTQXwBo.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=85,fit=crop/AoPZoWn7wwcpjkWw/17.alb-dJoe1bo8yOTQXwBo.png)
Now that the ALB is created, the instances must be placed behind the load balancer. But, to configure and launch the EC2 with Auto Scaling Group, launch template must be created to use
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=629,h=480,fit=crop/AoPZoWn7wwcpjkWw/18.launch-template-dWxeNOapWntzjPEO.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=240,fit=crop/AoPZoWn7wwcpjkWw/18.launch-template-dWxeNOapWntzjPEO.png)
Create a security group and add an inbound rule by selecting ALB security group that was created earlier. This configuration will only allow HTTP traffic coming from the ALB. Now, create a launch template with the AMI that was created before and with the ASG security group that will allow HTTP traffic
Create an Auto Scaling Group with the launch template created earlier, set the auto-scaling desired capacity and minimum capacity to 2 instances and maximum capacity to 4 instances
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=1207,h=227,fit=crop/AoPZoWn7wwcpjkWw/19.asg-mjEP3GPRbKCrv0P5.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=63,fit=crop/AoPZoWn7wwcpjkWw/19.asg-mjEP3GPRbKCrv0P5.png)
With the Auto Scaling Group configured, the desired number of EC2 instances are now automatically launched
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=1129,h=213,fit=crop/AoPZoWn7wwcpjkWw/20.instances-created-Awvjz9rXGGSpNWZK.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=61,fit=crop/AoPZoWn7wwcpjkWw/20.instances-created-Awvjz9rXGGSpNWZK.png)
Verify the load balancer by copying and pasting the load balancer DNS name in the web browser and find that the traffic is distributed among both the availability zones us-east-1a and us-east-1c. Test this by refreshing the browser multiple times
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=731,h=359,fit=crop/AoPZoWn7wwcpjkWw/21.verify-load-balancer-AMqaO8lPXbC5XJ26.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=161,fit=crop/AoPZoWn7wwcpjkWw/21.verify-load-balancer-AMqaO8lPXbC5XJ26.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=749,h=318,fit=crop/AoPZoWn7wwcpjkWw/22.verify-load-balancer-2-mp83xJW9p6I4yb75.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=142,fit=crop/AoPZoWn7wwcpjkWw/22.verify-load-balancer-2-mp83xJW9p6I4yb75.png)
Increase CPU load using load test on the web servers which makes CPU utilization bring up to 100% after which the Auto Scaling Group starts launching 2 more instances which makes it the maximum capacity, and terminates 2 instances once the load is decreased
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=743,h=339,fit=crop/AoPZoWn7wwcpjkWw/23.after-load-test-dOqlLZ8lOjS8qNER.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=311,h=139,fit=crop/AoPZoWn7wwcpjkWw/23.after-load-test-dOqlLZ8lOjS8qNER.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=984,h=440,fit=crop/AoPZoWn7wwcpjkWw/24.activity-asg-mv05vPP8Nwc0PNGM.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=315,h=142,fit=crop/AoPZoWn7wwcpjkWw/24.activity-asg-mv05vPP8Nwc0PNGM.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=1149,h=274,fit=crop/AoPZoWn7wwcpjkWw/25.maximum-instances-launched-A1a17zpl1ltRDWPp.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=79,fit=crop/AoPZoWn7wwcpjkWw/25.maximum-instances-launched-A1a17zpl1ltRDWPp.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=1224,h=216,fit=crop/AoPZoWn7wwcpjkWw/26.back-to-desired-minimum-dJoe1PQ7EPUVwLa9.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=60,fit=crop/AoPZoWn7wwcpjkWw/26.back-to-desired-minimum-dJoe1PQ7EPUVwLa9.png)
Create a security group for RDS instance by configuring it with the security group of Auto Scaling Group so that, only the web servers with the Auto Scaling Group can access the RDS instances
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=914,h=431,fit=crop/AoPZoWn7wwcpjkWw/27.sg-for-rds-mnlna4xEw8f6V7zd.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=158,fit=crop/AoPZoWn7wwcpjkWw/27.sg-for-rds-mnlna4xEw8f6V7zd.png)
Create an RDS instance with the database engine as Amazon Aurora (MySQL compatible edition). Specify administrator information to identify the RDS instances and choose the instance configuration to be db.r5.large. Select VPC to be the one that was created for this project, choose the security group that was created for the RDS instance
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=1111,h=304,fit=crop/AoPZoWn7wwcpjkWw/28.rds-instance-Yle214p0EyH9gjvw.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=96,fit=crop/AoPZoWn7wwcpjkWw/28.rds-instance-Yle214p0EyH9gjvw.png)
Store RDS credentials in AWS Secrets Manager, because the web server created initially contains a sample code that generates a simple address book to RDS. A secret is created that contains data connection information. The web server will later be given the appropriate permission to retrieve the secret
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=538,h=322,fit=crop/AoPZoWn7wwcpjkWw/29.secret-mp83x4EKyyfbx56E.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=284,h=162,fit=crop/AoPZoWn7wwcpjkWw/29.secret-mp83x4EKyyfbx56E.png)
Create a policy that allows the web server to read a secret and attach this policy to the role that was created initially which is assigned to the web server (SSM-InstanceProfile)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=889,h=539,fit=crop/AoPZoWn7wwcpjkWw/30.ssm-read-secrets-policy-dOqlLZRvVZc20gNq.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=328,h=199,fit=crop/AoPZoWn7wwcpjkWw/30.ssm-read-secrets-policy-dOqlLZRvVZc20gNq.png)
Now that we have given the web server all the necessary permissions, when connected to the web server using DNS name of the load balancer, we should be able to access RDS database and also add, edit contacts in the address book
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=700,h=371,fit=crop/AoPZoWn7wwcpjkWw/31.database-table-successfully-created-YKb1B8574GIBo4y2.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=316,h=167,fit=crop/AoPZoWn7wwcpjkWw/31.database-table-successfully-created-YKb1B8574GIBo4y2.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=707,h=469,fit=crop/AoPZoWn7wwcpjkWw/32.able-to-edit-table-dWxeNLXR8yfxlPM0.png)
![](https://assets.zyrosite.com/cdn-cgi/image/format=auto,w=305,h=202,fit=crop/AoPZoWn7wwcpjkWw/32.able-to-edit-table-dWxeNLXR8yfxlPM0.png)
With this, we have now built a web service with guaranteed high availability