CloudOps Inventory Platform is a cloud-native, full-stack inventory management system deployed on AWS, designed to demonstrate production-grade infrastructure architecture including secure networking, scalable compute, and managed database services.
The system follows a hardened 3-tier architecture using Next.js (frontend), Node.js/Express (application layer), and PostgreSQL on Amazon RDS, with S3-based asset storage and API Gateway-based request routing.
It emphasizes infrastructure isolation using VPC design, private subnets for data security, and EC2-based backend deployment managed via PM2 for process reliability. CI/CD is handled through AWS Amplify with GitHub integration for automated deployments.
The application follows a traditional 3-tier architecture deployed on AWS:
- Frontend Tier: Next.js application hosted on AWS Amplify for global scaling and managed CI/CD.
- Application Tier: Node.js/Express backend running on an Amazon EC2 (T2 Micro) instance within a Public Subnet.
- Database Tier: Amazon RDS (PostgreSQL) instance located in a Private Subnet for maximum security.
- Storage Tier: Amazon S3 for persistent storage of product images and assets.
- Connectivity: Amazon API Gateway acts as the secure bridge between the frontend and the backend EC2 instance, providing HTTPS termination.
The infrastructure is built within a custom Virtual Private Cloud (VPC) to ensure complete isolation and control:
- CIDR Block:
10.0.0.0/16 - Public Subnet: Hosts the EC2 backend. Associated with an Internet Gateway and a Public Route Table
- Private Subnets: Two subnets in different Availability Zones (Multi-AZ) to host the RDS database
- Security Groups:
- Public SG (EC2): Allows inbound HTTP/HTTPS and SSH for administration
- Private SG (RDS): Restricts inbound traffic strictly to the EC2 security group on Port 5432
- Deploy a PostgreSQL instance using the Free Tier template
- Configure a DB Subnet Group using the two private subnets.
- Initialize the schema using Prisma migrations from the EC2 instance
- Launch an Amazon Linux 2023 instance
- Install environment dependencies: Node.js (NVM) and Git
- Utilize PM2 (Process Manager) to ensure the Node.js server remains running after reboots or crashes.
- Create an HTTP API to route requests from the Amplify frontend to the EC2 public IP
- Enables HTTPS communication for the frontend to avoid "Mixed Content" security blocks
- Bucket created for product images with Public Access enabled specifically for the asset folder
- Configured Bucket Policies to allow
s3:GetObjectfor public image rendering
- Connected the GitHub repository to AWS Amplify
- Configured build settings to target the
/clientdirectory in the monorepo - Environmental variables mapped to the API Gateway Invoke URL
- Cloud: AWS (EC2, RDS, S3, VPC, API Gateway, Amplify)
- Backend: Node.js, Express, Prisma ORM
- Frontend: Next.js, Tailwind CSS, Redux Toolkit Query
- Database: PostgreSQL
- DevOps: Git, PM2
- Least Privilege: Security groups are scoped to specific ports and source IDs
- Data Isolation: Database is not reachable from the public internet
- Secure Secrets: Database credentials managed via
.envfiles (simulating AWS Secrets Manager behavior). - HTTPS: Encrypted transit for all user-facing data via API Gateway.
This README was generated based on the project architecture detailed in EdRoh's project tutorial.
Here I have maintained detailed documentation of the architectural challenges and infrastructure optimizations encountered during this project. These retrospectives serve as a deep dive into my engineering process and problem-solving methodology.
Focus: Environment Parity & Transpilation Logic This doc covers the investigation into a "Leaky Abstraction" where a TypeScript-based Tailwind configuration failed in the AWS Amplify headless Linux environment.
- Key Solution: Refactored configuration to CommonJS and aligned Node.js runtimes with AWS-supported LTS versions.
- Outcome: Established a deterministic build pipeline and successfully deployed a Next.js monorepo.
Focus: Cloud Economics & Infrastructure Hardening An engineering audit of the AWS Billing dashboard revealed unauthorized API usage in the N. Virginia region. This document traces that usage back to Amplify Gen 2's auto-discovery mechanisms.
- Key Solution: Implemented the
AMPLIFY_SKIP_BACKEND_BUILDflag to muzzle unnecessary backend scanning. - Outcome: Reduced build times by 15-20s, eliminated "ghost" API costs, and hardened the security surface of the build container.