// aws architecture · 2021 → 2026
Nothing public but the CDN
I led the platform’s move from containers on EC2 hosts behind a public load balancer to Fargate tasks that talk over , with all customer traffic entering through CloudFront and WAF. Each step shipped without a big-bang cutover.
before · ~2020
- Internet
- Public load balancer · internet-facing
- ECS on EC2 hosts · hosts to patch
- Database via VPC peering
Operator access: SSH bastion
after · 2026
- Internet
- CloudFront + WAF · the only public entry
- Internal load balancer · private
- Fargate · Service Connect · no hosts
- Database via PrivateLink
Operator access: SSO + SSM, no SSH
How it evolved: hosts to patch → no hosts at all
- ECS on EC2 hosts
- capacity autoscaling
- awsvpc networking
- Fargate rollout
- Fargate + Service Connect
# in practice
- No servers to patch: every service runs on Fargate.
- The attack surface is one CDN. WAF moved to blocking only after a 14-day shadow run showed no legitimate traffic would be stopped.
- Each service receives only the events it handles, using subscription filters generated from its code at build time.
- Dev environments share one networking stack and one database cluster, so a new environment is cheap to stand up.