AWS Cloud Architecture for Java Spring Boot Developers

Learn about region, availability zone and edge location concepts in AWS global infrastructure, and see how multiple availability zones and edge caching reduce latency and improve page load times.

Explore AWS EC2, elastic computing cloud, to launch virtual machines with configurable CPU and memory via AMI, and understand on-demand, reserved, dedicated, and spot pricing.

Launch an EC2 instance in a region, select a Linux AMI and instance type, create a key pair for SSH, and configure a security group with port 22 open.

Learn to ssh into your ec2 instance from your local machine, using windows putty or linux/mac with a pem or ppk key, setting permissions to 400, and connecting as ec2-user.

Connect to an ec2 instance via the console, install and start docker, run an nginx container on port 80, and open port 80 in the security group for access.

Learn to create a custom AMI by provisioning an EC2 instance with Java, Docker, and PostgreSQL, then capture it as an AMI for quick, repeatable launches.

Security groups act as firewall rules that deny inbound traffic by default and require explicit allow rules for ports like 22 and 80, attaching to multiple EC2 instances.

Launch three EC2 instances, create app and database security groups, and enable sg-to-sg access for port 5432 to connect Postgres. Verify with Docker and Nginx, then clean up.

Learn how self-referencing security groups enable inter-service communication by using a single security group attached to multiple services, and how inbound rules reference the group’s own ID.

Use ec2 user data to run startup scripts that automatically start docker and nginx on boot. This enables a simple http service exposed via port 80.

Explore region, availability zone, and edge location terminology, and learn how EC2, auto scaling, and security groups—instance-level firewalls with default deny—enable secure, scalable deployments.

Explore amazon s3, the secure, durable object storage that uses globally unique buckets for storing any file. Learn bucket naming, pricing basics, and how s3 supports aws services and websites.

Learn the shared responsibility for securing data in AWS, focusing on preventing data breaches by properly securing S3 buckets and understanding common misconfigurations.

Create and manage an S3 bucket, upload files, and generate pre-signed URLs to securely share objects with time-limited access.

Explore configuring public access for an S3 bucket by creating a JSON bucket policy with the policy generator, granting get object permission, and applying best practices refinements.

Create a public folder, move the PNG files into it, and update the bucket policy to grant access to PNGs under public. Note that folders are UI illusions.

Explore bucket configuration, versioning, encryption, object lock, and replication in AWS S3, including server-side and customer-provided keys, ownership, and cross-region replication.

Explore real-life S3 use cases, from exporting CSVs with pre-signed, expiring links to hosting static websites for platforms like Udemy, Netflix, and Airbnb.

Explore S3, a secure, durable object store for files from 0 bytes to 5 TB, with bucket policies, encryption (KMS), versioning, and object lock.

Explore IAM identity access management and how to grant appropriate permissions across AWS resources. Use users, groups, roles, and policies to enforce least privilege and secure cross-service access.

The lecture demonstrates creating a single IAM user, testing access with sign-in, observing restricted permissions, and then creating a user group to grant appropriate AWS permissions for EC2 and S3.

Create and manage a developers user group, attach EC2 and instance connect permissions, and enforce least privilege by denying prod ssh via a custom inline policy, while using dev permissions.

Discover how to enable an EC2 instance to access S3 by creating an IAM role, attaching it, and using the AWS CLI for listing and transferring files.

Configure local AWS access by installing the AWS CLI, generating an access key and secret key, and setting credentials to enable a developer to access S3 from their machine.

In this S3 SDK demo, learn to set up a simple Maven project, create an S3 client, and perform put and get object operations to Vince Demo bucket with hello.txt.

Explore how the AWS SDK automatically discovers credentials to read and write S3 files, avoiding hardcoding, and how EC2 instance roles enable seamless access to S3.

Create an access key and configure AWS credentials to access services with the user’s permissions. If credentials are lost or stolen, deactivate or delete the key and rotate keys regularly.

Never use the AWS root account for daily tasks; enable multi-factor authentication and use an IAM admin user in an administrators group.

Manage users and service-to-service access with IAM using policies, groups, and roles for granular permissions, while applying least-privilege and securing root accounts with MFA and key rotation.

Get introduced to AWS RDS, the fully managed relational database service supporting Postgres and MySQL, with high availability through Multi-AZ and standby instances, and scalable read replicas to boost performance.

Explore creating and configuring an AWS RDS database with single and multi-az options, using Aurora Postgres or MySQL engines, including backups, encryption, and read replicas.

Explore connecting an EC2 instance to an RDS PostgreSQL database on port 5432, configure security groups for inbound Postgres access, and monitor backups, snapshots, logs, and instance resources.

Connect to the RDS Postgres instance using the endpoint, create a database and table, insert and query data, and convert to multi-az deployment or create a read replica.

This aws rds demo shows a read replica with an endpoint in the same region, where reads on the replica and writes on the primary reflect, plus a manual snapshot.

Restore a database from a snapshot in RDS, connect to the endpoint, and verify data with a customer table query. Delete the RDS instance and snapshot, and remove security groups.

Review how RDS offers a fully managed, highly available database service with automated patching, maintenance, and backups, enabling failover to a standby and support for read replicas for read-heavy workloads.

Learn how to deploy a high-availability application using an application load balancer with path-based routing, health checks, and multi-az deployment across two availability zones.

Configure aws ec2 environments by creating a security group, launching four t2 micro instances across two availability zones, and running nginx via docker to serve a simple order.html page.

Configure alb path-based routing, balance load across multiple ec2 targets, and set up health checks for both other service targets and customer service targets.

Create an application load balancer and implement path-based routing to route order and customer service targets on port 80. Secure with security groups and balance traffic across the target groups.

Configure an Alb listener on port 80 with path-based routing to order and customer service targets, set a default fixed response, and manage rule priorities (1000, 2000) for flexible routing.

demonstrates an application load balancer routing traffic to healthy targets across two availability zone instances, with health checks, path-based routing, and failover when an instance stops nginx.

Terminate EC2 instances, delete the application load balancer and target groups, and remove security groups to complete the resource cleanup.

Explore how to route traffic to multiple microservice instances using a single load balancer with listener rules that route by path, while noting manual target group setup and upcoming simplifications.

Learn how CloudFront, AWS's content delivery network, uses global edge locations to cache and deliver static content from S3, reducing latency for users worldwide.

Configure a private S3 bucket for a static website and serve content through a CloudFront distribution, using origin access control to restrict S3 access to CloudFront only.

Configure a CloudFront distribution by setting the origin (such as S3), TTL, allowed HTTP methods, and security options like HTTPS and WAF, then test with the distribution domain.

Secure S3 with origin access control (OAC) by attaching a policy that lets CloudFront read objects but not write, either automatically or by copying the policy into S3 permissions.

Configure the distribution's default route object by setting index.html in general settings, save, and deploy to all edge locations. Then test by loading the domain after five minutes.

Test CloudFront caching by refreshing the distribution to confirm cached content is served from edge locations. Latency, not distance, determines the nearest edge, so the serving location may vary.

Learn to invalidate CloudFront caches via the invalidation tab or APIs to fetch updated index.html from the origin after pushing version 2 to S3.

Learn how Route 53, the AWS DNS service, lets you buy and manage domains, create DNS records mapping to IP addresses, and request certificates via Certificate Manager.

Attach your SSL certificate to CloudFront and serve pages using your domain. Then create a simple a record in Route 53 to route the root domain to the CloudFront distribution.

Explore how CloudFront protects apps from large-scale attacks with built-in ddos protection, a web application firewall, edge ssl handshakes, geo restrictions, and lightweight edge computing.

Configure CloudFront to serve static content from an S3 origin while forwarding API calls to an Application Load Balancer via edge locations, and do not cache API responses.

learn to add alb as a second origin in a cloudfront distribution and configure api path pattern behaviors to route dynamic content to alb while serving static content from s3.

Explore why multiple path based routing exists in AWS cloud architecture for Java Spring Boot developers, using CloudFront and ALB to route API orders, API customers, or S3.

Perform resource cleanup by disabling and deleting CloudFront distributions, deleting S3 buckets and removing bucket policies, and cleaning up Route 53 hosted zones, DNS A records, and load balancers.

CloudFront uses edge locations to cache and deliver content, configure distributions with multiple origins and behaviors for each path, and protect apps with edge ssl and a web application firewall.

Explore the virtual private cloud (VPC) in AWS, an isolated network with IP ranges, subnets, and route tables for EC2, RDS, and ALB, and why architects prefer VPC for security.

Explore how a VPC spans multiple availability zones in a region, remains isolated from the public internet, and uses subnets to deploy EC2 instances and databases with controlled traffic.

Explore how the internet gateway provides two-way internet connectivity for a default VPC's public subnets, enabling EC2 instances to host nginx and reach external sites like google.com.

Explain attaching the internet gateway, launching an EC2 instance, and using public versus private IPs to enable SSH and private network communication.

Design a secure aws vpc with private subnets across multiple availability zones, using public subnets only for application load balancer and cloudfront, to keep apps hidden from the internet.

Explore CIDR notation and its role in defining IP blocks for VPCs and subnets, enabling resource allocation, traffic control, and security group and network ACL configurations for EC2.

Delete the default VPC to avoid confusion, then create a custom VPC with two availability zones, two public and four private subnets, tag resources, CIDR blocks, and an internet gateway.

Identify and manage route tables to control traffic within a VPC, distinguishing public and private subnets by routes to an internet gateway and local communication rules.

Explore the challenges of private subnets in a VPC, where instances with public IPs still cannot be accessed from the internet or reach external APIs, and learn fixes.

Use a bastion host setup to SSH into a private subnet instance via a public subnet, configuring a key pair and security groups for secure access.

Learn how a nat gateway in a public subnet lets private subnet instances access the internet, with one nat gateway per availability zone.

Learn to use a network access control list (NACL) to deny traffic by configuring inbound rules and rule numbers to block IPs; security groups only have allow rules.

Explore AWS's shared responsibility model, showing which security duties AWS handles: region, availability zones, edge, and data center security, and which duties customers manage, like encryption and firewall configuration.

Clarifies the need for multiple path based routing by contrasting CloudFront edge routing with ALB path rules inside the VPC, highlighting edge security and caching versus internal load balancing.

Plan for rest of the course by building and deploying a microservices app with Spring Boot and Postgres, using VPC, public ALB, private subnets, RDS, S3 CloudFront, and security controls.

Terminate unused instances, delete the nat gateway, release the elastic IP, delete the VPC, and recreate the default VPC to complete resource cleanup.

Configure a multi-az vpc with public subnets for front-end and private subnets for back-end apps, using nat gateways and bastion hosts to secure traffic.

Design a two-microservice Netflix-like app with movie and customer services, exposing get and patch endpoints and DTOs, to demonstrate AWS cloud-native microservices communication and recommendations.

Set up the movie service project with spring initializer, pick maven or gradle, java 21, add web, data jpa, postgres, actuator, and test containers, then generate and import into ide.

Create a movie domain with an enum genre stored as string, a movie entity and repository, and a movie dto with a mapper to convert entities for presentation.

Build a movie service with a repository, service, and controller to fetch all movies and filter by genre using DTO mapping and REST endpoints.

Set up integration tests with test containers and service connection annotation to auto-create a Postgres container; initialize a movie table with init db sql script in AWS CI/CD using ECR.

Develops integration tests for the movie service using test rest template with random port, asserting get all movies, get by genre, and health checks via actuator.

Start the movie service app using a test container to run Postgres locally, enabling quick testing of the api by visiting localhost:8080/api/movies and filtering by action.

Create a dockerfile for movie service using the public ecr registry and eclipse chemerin 21 jre alpine image, package with mvn clean package, run java -jar app.jar on port 8080.

Create a customer service with a table (id, name, favorite genre) and an api returning customer data and recommended movies from movie service, plus patch endpoint to update favorite genre.

Design a customer service layer with an entity, dto, and repository in Java Spring Boot, including id, name, and favorite genre, plus a dto mapper and a journal update request.

Explain how to handle missing customers with a customer not found exception, controller advice, and a problem detail response returning 404 not found in a Spring Boot API.

Create a movie client in the customer service that uses a rest client injected by Spring to fetch movies by genre from the movie service api. Configure a base url via a configuration bean and print debug logs.

Fetch a customer by id, return a customer DTO, get recommendations for their favorite genre from a movie client, map to a DTO, and support updates via patch.

Conduct an integration test for the customer service with a Postgres container and init db sql creating a customer table, while mocking the movie service with Marketo for ci/cd.

Design integration tests for the customer service with actuator checks using a mocked movie client, validating get by id returns a customer with two recommended movies, and patch genre updates.

Run end-to-end tests locally by starting Postgres with docker compose and launching movie and customer services, then verify postman requests for list and genre filters, customer updates, and not-found errors.

Discusses how frontend work fits with backend microservices and production infrastructure, including integration tests, API details known to the frontend team, cloud considerations, and GitHub reference.