Deploying a Flask-based Intrusion Detection System to AWS ECS with CI/CD

Introduction

In this post, I’ll Walk you through the process of deploying an intrusion detection system on AWS

NOTE: This project assumes you already have an active AWS account and configured your account credentials (access keys) to your code editor and this project will incur some costs in your console

Project Overview

Objectives

The objectives of this project is as follows:

• Containerize the application with Docker


• Push the container image to ECR


• Create a VPC, two private subnets and two public subnets


• Create VPC endpoints for the private subnets to access ECR


• Deploy an Application Load Balancer and target group in the public subnets for the ECS Service


• Create a Task definition for the ECS service


• Create an ECS cluster and an ECS service with fargate launch type in the private subnets.


• Create a hosted zone in route 53 and point it to the ALB's DNS name

Project Architecture

Create a VPC and its Subnets

Take a note of the Region, as this is where all the resources will be deployed

Step 1: Create a new VPC

• Go to the VPC console and create a new VPC


• Specify CIDR block (e.g. 10.0.0.0/16)

Step 2: Create an Internet Gateway (IGW) for the VPC

In the VPC console, select the Intergate Gateway tab and create the internet gateway. Once the IGW is created attach it to your VPC

NOTE: the ECS cluster will be deployed on the private subnet and the Application Load Balancer will be in the public subnet and will access the ECS cluster in the private subnet

Step 4: Update the Route tables

• Create route tables for the public and private subnets and associate the route tables to the public and private subnets respectively. (Ensure the VPC in use is selected for the both of them.)


• For the public subnets route table, add to route to direct all outbound traffic 0.0.0.0/0 through the internet Gateway.


• The private subnet will not route outbound traffic for now.

• Name the endpoint and search for the ECR api endpoint under services com.amazonaws.us-east-1.ecr.api
  


• Select the VPC we've been using, this will bring up the subnets option where the availability zones our private subnets are in will be selected and then finally select our private subnets and the default security group.

Create Application Load Balancer

• On the left of the EC2 console, select the load balancer and select create load balancer.


• Select Create Application Load Balancer, this will be an internet-facing load balancer. give the ALB a name.


• In the network mapping section select the Created VPC and the public subnets in the two availability zones.


• In the Listeners and Routing section, select the created target group. The ALB will listen on port:80 and forward to the target group.


• Create the ALB.

Create Task definitions

Go to the ECS console and select task definitions.

Step 1:

• Name the task definition family


• Leave the default infrastructure requirements as is, but you can change the vCPU and memory based on your descretion.
  
  

Step 2: For Container 1

• Give a name


• Go to your ECR and copy the URI of the docker image we pushed in earlier sections of this project and come back to the container 1 section of the task definitions we're creating and paste it in the Image URI for the container.


• For the Port mappings set it to 5000, as this was the port we exposed in our docker container and give it a name.
  NOTE: It is very important the port mappings is the same as the exposed docker port
  



• Add environment variables
  
  This will be important in the CI/CD section of this project. But will be skipped for now.




• Go ahead and skip the remaining sections and create the task definition

Create a Fargate cluster and service

Create security group for the ECS service

• Go to the security group on the left and select create security group. give the security a name and description.


• Add an inbound rule on port range 5000 and source will be the Application Load Balancers security group.

Step 1: Create Cluster

• Go to the clusters tab and select create cluster, this will bring you to the cluster configuration page. Name the cluster and ensure only the AWS Fargate(Serverless) is selected under the infrastructure tab and then create the cluster.

This will lead you to a new page where you'll specify the configuration of the Fargate service.

• Scroll past the Environment section and move to the Deployment Configuration. Here, specify the task definition family, which will automatically select the revision as well.

• Select Create Hosted Zone


• Enter your domain name and give a description. Leave the type as Public Hosted Zone and select create Hosted Zone.

• The default record type that is there is the A record, which will be used.


• Toggle the alias switch

• Under choose endpoint, select the Alias to Application and Classical Load Balancer
  


• Next, choose the region you launched your Load Balancer in. In this case its us-east-1, Ensure it's your on region.


• Choose your load balancer from the drop-down menu.


• Create record.

This assumes you have your domain name with AWS

CONGRATULATIONS!!

If you followed the Steps to the T, you should have a full functioning web-app that is accessible through your domain-name.

This was a very exciting project as I worked with VPC's, private and public subnets, VPC endpoints, ECS services, ECR, Target groups, security groups and Application load Balancer as they all came together to create this web-app.