AWS Architecture¶

Carbon Connect runs on AWS in the eu-north-1 (Stockholm) region using a hybrid serverless architecture with ECS Fargate for compute and managed services for data.

Architecture Diagram¶

flowchart TB
    subgraph Internet
        U[Users / Browsers]
        GH[GitHub Actions<br/>CI/CD via OIDC]
    end

    subgraph AWS["AWS eu-north-1"]
        subgraph Public["Public Subnets"]
            ALB[Application Load Balancer<br/>+ WAF]
            NAT[NAT Gateway]
        end

        subgraph Private["Private Subnets"]
            subgraph ECS["ECS Fargate Cluster"]
                API[API Service<br/>FastAPI]
                Worker[Celery Worker<br/>Fargate Spot]
                Beat[Celery Beat<br/>Scheduler]
            end
            MS[Meilisearch<br/>Search Engine]
        end

        subgraph Data["Data Subnets"]
            RDS[(RDS PostgreSQL 16<br/>+ pgvector)]
            EC[(ElastiCache<br/>Valkey Serverless)]
        end

        subgraph Storage["S3 Buckets"]
            S3D[Documents Bucket]
            S3M[Media Bucket]
        end

        subgraph Security["Security"]
            SM[Secrets Manager<br/>API Keys, DB Pass]
            IAM[IAM Roles<br/>OIDC Provider]
            KMS[KMS<br/>Encryption Keys]
        end

        subgraph Monitoring
            CW[CloudWatch<br/>Logs + Metrics]
            CI[Container Insights]
        end
    end

    U -->|HTTPS| ALB
    GH -->|OIDC| IAM
    ALB -->|Port 8000| API
    API --> RDS
    API --> EC
    API --> MS
    Worker --> RDS
    Worker --> EC
    Beat --> EC
    API --> S3D
    API --> S3M
    API --> SM
    ECS --> CW
    ECS --> CI
    Private -->|Outbound| NAT
    NAT -->|Internet| Internet

VPC Layout¶

The VPC uses a three-tier subnet architecture across three availability zones:

VPC CIDR: 10.0.0.0/16 (65,536 addresses)

Availability Zones¶

• eu-north-1a
• eu-north-1b
• eu-north-1c

NAT Gateway Strategy¶

• Development/Staging: Single NAT Gateway (cost savings)
• Production: NAT Gateway per AZ (high availability)

Service Details¶

RDS PostgreSQL¶

ElastiCache (Valkey)¶

ECS Fargate¶

API Service:

Worker Service:

Application Load Balancer¶

S3 Buckets¶

Both buckets have public access blocked and server-side encryption (AES-256).

Secrets Manager¶

The secrets module stores sensitive configuration:

Security¶

Network Security¶

• Public subnets: Only ALB and NAT Gateway
• Private subnets: ECS tasks with outbound-only internet access
• Data subnets: No internet access, only accessible from private subnets
• Security groups enforce least-privilege network access

IAM¶

• ECS task execution role: Pull images from ECR, read secrets
• ECS task role: Access S3, Secrets Manager, CloudWatch
• GitHub Actions: OIDC-based federation (no long-lived credentials)

Encryption¶

• RDS: Encrypted at rest (AES-256 via KMS)
• ElastiCache: Encryption in transit and at rest
• S3: Server-side encryption (AES-256)
• ALB: TLS 1.2+ for all HTTPS traffic

Cost Optimization¶