VPC-based Virtual Server DMZ Web Service
VPC-based Virtual Server DMZ Web Service
Overview
In the past, building a web hosting infrastructure that provides high availability and scalability in a legacy environment required the installation of complex solutions. Additionally, to ensure stability, it was inevitable to calculate capacity for peak times, which had a negative impact on services and costs due to increased lead times and operating expenses.
Samsung Cloud Platform provides a customer-dedicated network configuration that can communicate with the internet immediately after setup, along with a web service based on computing products that excel in scalability and stability, allowing for the rapid provision of the necessary web service infrastructure.
This document aims to provide a detailed explanation of the VPC-based Virtual Server DMZ web service architecture on Samsung Cloud Platform.
Architecture Diagram
- Set the domain name to be opened externally in the DNS service and link it to the Load Balancer’s service IP.
- The Load Balancer service IP is assigned in the VPC, which allows internet access.
- The Load Balancer can distribute web request traffic to multiple VM Auto Scaling groups, enhancing service stability.
- Relational databases can be configured in duplicate to increase availability or use DBaaS to enable duplication options.
- DBaaS allows selecting from various relational database engines.
- Utilizing the NoSQL database service together can reduce response times for frequent requests by using it as a cache for relational databases.
- The WAF service protects web servers from attack traffic such as XSS or SQL injection.
- Additionally, using the DDoS Protection service allows for automatic response to external DDoS attacks.
- Object Storage can be used to store static content like images or videos or as a backup for databases.
Use Cases
Providing Public Web Services through VPC
Public web services that can connect to the internet can be configured using the Public IP feature provided by VPC.
- Public IP can be easily registered with a domain name using the DNS service.
Securing Web Security through Service-Type Security Solutions and Security Group Application
To secure the security of web servers open to the internet, service-type security solutions like WAF and DDoS Protection can be configured.
- WAF services monitor website traffic to detect and block attacks.
- DDoS Protection services detect and block DDoS attacks that overwhelm web servers with traffic.
Along with this, security groups can be set up with minimal permission policies to protect infrastructure from external attacks.
Pre-requisites
None
Limitations
DDoS Protection - Separate service requests are required for service application and policy requests.
Considerations
Security
When configuring security policies, separate security policies can be applied by distinguishing between Load Balancer and internal infrastructure security groups that require direct external access.
Firewall services can set allowed rules by subnet, or Security Group services can set allowed rules by Virtual Server, controlling unnecessary host network access.
Serverless
In the future, consideration can be given to transitioning to serverless web applications using Cloud Functions and API Gateway services.
Related Services
This is a list of Samsung Cloud Platform services related to the functions or configurations described in this guide. Please refer to them when selecting and designing services.
| Service Group | Service | Detailed Description |
|---|---|---|
| Compute | Virtual Server | Virtual server optimized for cloud computing |
| Compute | VM Auto-Scaling | Service that automatically scales resources up or down according to demand |
| Database | MySQL | Service that easily creates and manages MySQL, a small but powerful open-source relational database |
| Database | CacheStore | Key-value in-memory data store with fast data processing capabilities |
| Networking | Load Balancer | Service that automatically distributes server traffic |
| Networking | DNS | Service that easily sets up and manages domains |
| Networking | VPC | Service that provides an independent virtual network in a cloud environment |
| Networking | Security Group | Virtual firewall that controls VM traffic |
| Networking | Firewall | Service that provides a firewall for VPC and internet, customer network connection traffic |
| Storage | Object Storage | Object storage convenient for data storage and search |