Production Platform - AWS Free Tier

A production-grade platform built on AWS completely free using cost-optimization strategies and infrastructure best practices.

🎯 Project Goals

Build a real production platform for learning, demonstrating:

✅ Infrastructure as Code (Terraform)
✅ Cost Optimization ($0/month vs $505/year standard AWS)
✅ Kubernetes Orchestration (K3s cluster)
✅ Networking Best Practices (VPC, NAT, security groups)
✅ Security Hardening (private subnets, Session Manager, flow logs)
✅ Microservices Architecture (Go API, Worker, Redis)
✅ CI/CD Pipeline (Docker, automated deployments)
✅ Monitoring & Observability (Prometheus, Grafana, Loki)

Perfect for:

📚 Learning DevOps/SRE practices
🚀 Small production workloads

📊 Architecture Overview

┌─────────────────────────────────────────────────────┐
│ AWS VPC (10.0.0.0/16)                               │
│                                                      │
│  Public Subnet                Private Subnet        │
│  ┌─────────────┐              ┌─────────────┐      │
│  │ NAT Instance│──────────────→│ K3s Master  │      │
│  │ (t2.micro)  │              │ (t3.micro)  │      │
│  └──────┬──────┘              └──────┬──────┘      │
│         │                             │             │
│         │                     ┌───────▼──────┐      │
│         │                     │ K3s Worker   │      │
│         │                     │ (t3.micro)   │      │
│         │                     └──────┬───────┘      │
│         │                            │              │
│         │                            ▼              │
│         │                   ┌────────────────┐      │
│         │                   │ Pods:          │      │
│         │                   │ • API Service  │      │
│         │                   │ • Worker       │      │
│         │                   │ • Redis        │      │
│         │                   └────────────────┘      │
│         ▼                                           │
│   Internet Gateway                                  │
└─────────────────────────────────────────────────────┘
         │
         ▼
    Internet

💰 Cost Breakdown

Traditional AWS Setup

Component	Monthly Cost
NAT Gateway	$32.85
Bastion Host (t2.micro)	$8.47
K3s Master (t3.micro)	$7.59
K3s Worker (t3.micro)	$7.59
EBS Storage (40GB)	$4.00
TOTAL	$60.50/month

This Project (Free Tier Optimized)

Component	Monthly Cost
NAT Instance (t2.micro)	$0 (free tier)
Session Manager	$0 (no bastion)
K3s Master (t3.micro)	$0 (free tier)
K3s Worker (t3.micro)	$0 (free tier)
EBS Storage (30GB)	$0 (free tier)
TOTAL	$0/month ✅

Annual Savings: $726 💸

🚀 Quick Start

Prerequisites

# Required tools
terraform >= 1.0
aws-cli >= 2.0
kubectl >= 1.24

# AWS credentials configured
aws configure

Deploy Infrastructure

# Clone repository
git clone https://github.com/tasnimmizaoui/production-platform
cd production-platform

# Configure variables
cp infra/terraform/terraform.tfvars.example infra/terraform/terraform.tfvars
# Edit terraform.tfvars with your IP address

# Get your IP
curl ifconfig.me

# Deploy
cd infra/terraform
terraform init
terraform plan
terraform apply

Deployment time: ~15-20 minutes ⏱️

Access Your Cluster

# Get kubeconfig
terraform output kubeconfig_command | bash > ~/.kube/config

# Verify cluster
kubectl get nodes
kubectl get pods -A

# Access K3s master
aws ssm start-session --target $(terraform output -raw k3s_master_id)

📁 Project Structure

production-platform/
├── app/                          # Application code
│   ├── api-service/             # Go REST API
│   ├── worker-service/          # Background workers
│   └── frontend/                # not set up yet
│
├── infra/                       # Infrastructure as Code
│   └── terraform/
│       ├── main.tf              # Root configuration
│       ├── modules/
│       │   ├── vpc/             # VPC + NAT instance
│       │   └── k3s/             # K3s cluster
│       └── terraform.tfvars     # Your variables
│
├── k8s/                         # Kubernetes manifests
│   ├── base/                    # Base configs
│   │   ├── api/
│   │   ├── worker/
│   │   └── redis/
│   └── overlays/                # Environment overlays
│       ├── dev/
│       └── prod/
│
├── monitoring/                  # Observability stack
│   ├── prometheus/
│   ├── grafana/
│   └── loki/
│
│
├── docs/                       # Documentation
│   
│
└── scripts/                    # Helper scripts
    ├── deploy.sh
    └── test-deployment.sh

🏗️ Infrastructure Components

Phase 1: Networking ✅ COMPLETE

Phase 2: Compute ✅ COMPLETE

Phase 3: Applications 📋 NEXT

Deploy API service to K3s
Deploy worker service
Configure ingress
Test end-to-end workflow

Phase 4: CI/CD Pipeline 🚀

Phase 5: VPC Endpoints + Docker Proxy (Enterprise) 🎯

S3-backed Docker registry mirror
Zero-egress network architecture
Air-gapped cluster security
Automated image synchronization

🔐 Security Features

✅ Private Subnets - No public IPs on workloads
✅ NAT Instance - Controlled egress
✅ Security Groups - Restrictive firewall rules
✅ Network ACLs - Additional layer
✅ VPC Flow Logs - Network monitoring
✅ Session Manager - No SSH keys needed
✅ Encrypted EBS - Data at rest encryption
✅ IP Whitelisting - Access limited to your IP

📊 Key Innovations

1. NAT Instance ($32/month savings)

Instead of AWS NAT Gateway ($32.85/month), we use a t2.micro instance:

# IP forwarding + iptables
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Benefits:

$0 cost (free tier)
Full control & debugging access
Production-ready for small workloads
Learning opportunity for NAT mechanics

Trade-offs:

Single point of failure (no HA)
Manual scaling required
Limited throughput vs NAT Gateway

Real Implementation:

✅ Verified working with K3s cluster
✅ Internet access from private subnet confirmed
✅ Health monitoring configured
✅ $394/year savings vs NAT Gateway

Read Complete Implementation Guide →

2. Session Manager Access ($8/month savings)

No bastion host needed! Access instances via AWS Systems Manager:

aws ssm start-session --target i-0abc123def456

Benefits:

$0 cost
No SSH keys to manage
IAM-based authentication
Session logging

3. K3s Lightweight Kubernetes

Full Kubernetes experience with minimal overhead:

512MB RAM vs 2GB (standard K8s)
Single binary installation
Built-in storage, networking
Perfect for learning & small workloads

📚 Documentation

NAT Instance Implementation Guide - Complete NAT setup, troubleshooting, and verification
VPC Module README - Networking architecture and configuration
K3s Module README - Cluster setup and management
Production Architecture - Full stack overview

🧪 Testing

# Verify NAT instance
aws ssm start-session --target $(terraform output -raw nat_instance_id)
cat /proc/sys/net/ipv4/ip_forward  # Should be: 1

# Test K3s cluster
kubectl get nodes
kubectl get pods -A

# Test connectivity from private subnet
aws ssm start-session --target $(terraform output -raw k3s_master_id)
curl -I https://google.com  # Should work via NAT

# Run deployment tests
./scripts/test-deployment.sh

🛠️ Troubleshooting

NAT Instance Not Working

# Check source/dest check (must be false)
aws ec2 describe-instances --instance-ids <nat-id> \
  --query 'Reservations[0].Instances[0].SourceDestCheck'

# Check iptables
aws ssm start-session --target <nat-id>
sudo iptables -t nat -L -n -v

K3s Pods Not Starting

kubectl describe pod <pod-name>
kubectl logs <pod-name>
kubectl get events --sort-by=.metadata.creationTimestamp

Can't Access Internet from Private Subnet

# From private instance
ip route  
traceroute 8.8.8.8  # S

# Check NAT instance
aws ssm start-session --target <nat-id>
cat /proc/sys/net/ipv4/ip_forward  # Must be: 1
sudo iptables -t nat -L POSTROUTING -n -v  # Must show MASQUERADE rule

Complete Troubleshooting Guide →

🎓 Learning Outcomes

Terraform Skills

Module development
State management
Dependency management
Count and conditionals

AWS Networking

VPC architecture
NAT functionality
Security groups vs NACLs
VPC endpoints

Kubernetes

Cluster setup
Pod networking
Service discovery
Storage management

Linux Systems

IP forwarding
iptables/netfilter
systemd services
Shell scripting

DevOps Practices

Infrastructure as Code
Cost optimization
Security hardening
Monitoring/observability

📈 Roadmap

Phase 1: VPC networking with NAT instance
Phase 2: K3s cluster deployment (2 nodes + Redis)
Phase 3: Application deployment (API + Worker services) on local cluster
Phase 4: CI/CD pipeline (GitHub Actions + Kind testing)
Phase 5: VPC endpoints + Docker proxy (enterprise security)
Phase 6: Monitoring stack (Prometheus, Grafana, Loki)
Phase 7: Service mesh (Linkerd)
Phase 8: Auto-scaling & high availability

Current Status: Infrastructure verified and working. Ready for application deployment! 🚀

🙏 Acknowledgments

K3s - Lightweight Kubernetes by Rancher
Terraform - Infrastructure as Code by HashiCorp
AWS - Cloud infrastructure
Community - Best practices and inspiration

📄 License

MIT License - Feel free to use this project for learning and portfolio purposes.

Name		Name	Last commit message	Last commit date
Latest commit History 45 Commits
.github/workflows		.github/workflows
app		app
argocd		argocd
docs		docs
infra/terraform		infra/terraform
k8s		k8s
monitoring/prometheus		monitoring/prometheus
scripts		scripts
.gitignore		.gitignore
Makefile		Makefile
README.md		README.md
docker-compose.yaml		docker-compose.yaml

Folders and files

Latest commit

History

Repository files navigation

Production Platform - AWS Free Tier

🎯 Project Goals

📊 Architecture Overview

💰 Cost Breakdown

Traditional AWS Setup

This Project (Free Tier Optimized)

🚀 Quick Start

Prerequisites

Deploy Infrastructure

Access Your Cluster

📁 Project Structure

🏗️ Infrastructure Components

Phase 1: Networking ✅ COMPLETE

Phase 2: Compute ✅ COMPLETE

Phase 3: Applications 📋 NEXT

Phase 4: CI/CD Pipeline 🚀

Phase 5: VPC Endpoints + Docker Proxy (Enterprise) 🎯

🔐 Security Features

📊 Key Innovations

1. NAT Instance ($32/month savings)

2. Session Manager Access ($8/month savings)

3. K3s Lightweight Kubernetes

📚 Documentation

🧪 Testing

🛠️ Troubleshooting

NAT Instance Not Working

K3s Pods Not Starting

Can't Access Internet from Private Subnet

🎓 Learning Outcomes

Terraform Skills

AWS Networking

Kubernetes

Linux Systems

DevOps Practices

📈 Roadmap

🙏 Acknowledgments

📄 License

About

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Contributors

Uh oh!

Languages

Packages