Deploy Node.js applications on AWS using EC2, RDS, and managed services with security best practices. Apply when setting up AWS infrastructure, configuring databases, managing security, or optimizing costs.
apm install @thamjiahe/aws-cloud-infrastructure
[](https://apm-p1ls2dz87-atlamors-projects.vercel.app/packages/@thamjiahe/aws-cloud-infrastructure)---
name: "AWS Cloud Infrastructure"
description: "Deploy Node.js applications on AWS using EC2, RDS, and managed services with security best practices. Apply when setting up AWS infrastructure, configuring databases, managing security, or optimizing costs."
allowed-tools: Read, Write, Edit, Bash
version: 1.1.0
updated: 2026-01-15
compatibility: Claude Opus 4.5, Claude Code v2.x
---
# AWS Cloud Infrastructure
Systematic AWS deployment for Node.js applications ensuring scalability, security, and cost efficiency.
## Overview
This Skill enforces:
- EC2 instance configuration and security
- RDS (Relational Database Service) setup
- IAM roles and least-privilege access
- Environment variable and secrets management
- Auto-scaling and load balancing
- Security group and network configuration
- CloudWatch monitoring
Apply when deploying to AWS, configuring databases, or managing cloud infrastructure.
## Deployment Workflow
**Every AWS deployment follows this process**:
```
Step 1: Create EC2 Instance
↓
Step 2: Configure Security Groups
↓
Step 3: Install Node.js and dependencies
↓
Step 4: Deploy application with PM2
↓
Step 5: Set up RDS database
↓
Step 6: Configure environment variables
↓
Step 7: Set up monitoring and scaling
```
## Step 1: EC2 Instance Setup
### Launch EC2 Instance
```bash
# Using AWS CLI
aws ec2 run-instances \
--image-id ami-0c55b159cbfafe1f0 \
--instance-type t3.micro \
--key-name your-key-pair \
--security-groups your-security-group
```
### Instance Types by Use Case
- **Development**: t3.micro (free tier eligible)
- **Production**: m5.large or c5.xlarge (more CPU/memory)
- **High-traffic**: c6i.2xlarge or m6i.2xlarge
### SSH into Instance
```bash
ssh -i "your-key.pem" ubuntu@<ec2-public-ip>
```
### Install Node.js and Dependencies
```bash
sudo apt update
sudo apt install nodejs npm nginx git curl -y
# Install NVM for Node version management
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
# Load NVM
export NVM_DIR="$HOME/.nvm"
source "$NVM_DIR/nvm.sh"
# Install Node 20 (LTS)
nvm install 20
nvm use 20
```
## Step 2: Security Groups Configuration
### Configure Security Group Rules
```
Inbound Rules:
- SSH (port 22): Only from your IP
- HTTP (port 80): From 0.0.0.0/0
- HTTPS (port 443): From 0.0.0.0/0
- Custom TCP (your app port): From Load Balancer
Outbound Rules:
- Allow all traffic
```
### Using AWS CLI
```bash
# Allow SSH from specific IP
aws ec2 authorize-security-group-ingress \
--group-id sg-xxxxx \
--protocol tcp \
--port 22 \
--cidr YOUR_IP/32
# Allow HTTP
aws ec2 authorize-security-group-ingress \
--group-id sg-xxxxx \
--protocol tcp \
--port 80 \
--cidr 0.0.0.0/0
# Allow HTTPS
aws ec2 authorize-security-group-ingress \
--group-id sg-xxxxx \
--protocol tcp \
--port 443 \
--cidr 0.0.0.0/0
```
## Step 3: Deploy Application
### Clone Repository and Install Dependencies
```bash
git clone https://github.com/your-repo/project.git
cd project
npm ci # Install exact versions from package-lock.json
```
### Setup Environment Variables
```bash
# Create .env file
cat > .env << EOF
NODE_ENV=production
DATABASE_URL=postgresql://user:password@your-rds-endpoint:5432/dbname
PORT=3000
EOF
# Verify .env is not committed
cat .gitignore | grep .env
```
### Install PM2 Process Manager
```bash
npm install -g pm2
# Start application
pm2 start npm --name "myapp" -- start
# Save PM2 process list to restart on reboot
pm2 startup
pm2 save
```
### Verify Application Running
```bash
curl http://localhost:3000
```
## Step 4: Set Up Nginx Reverse Proxy
### Configure Nginx
```nginx
# /etc/nginx/sites-available/default
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
location / {
proxy_pass http://localhost:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
```
### Enable and Test Nginx
```bash
sudo systemctl enable nginx
sudo systemctl start nginx
sudo nginx -t # Test configuration
```
## Step 5: RDS Database Setup
### Create RDS Instance
```bash
aws rds create-db-instance \
--db-instance-identifier mydb \
--db-instance-class db.t3.micro \
--engine postgres \
--master-username admin \
--master-user-password YourPasswordHere \
--allocated-storage 20 \
--publicly-accessible false
```
### Configure RDS Security Group
```bash
# Allow EC2 to access RDS
aws ec2 authorize-security-group-ingress \
--group-id sg-rds-xxxxx \
--protocol tcp \
--port 5432 \
--source-security-group-id sg-ec2-xxxxx
```
### Get RDS Endpoint
```bash
aws rds describe-db-instances \
--db-instance-identifier mydb \
--query 'DBInstances[0].Endpoint.Address'
```
### Connect to RDS
```bash
psql -h mydb.xxxxxx.us-east-1.rds.amazonaws.com \
-U admin \
-d postgres
```
## Step 6: Secrets Management
### MUST NOT: Hardcode Secrets
Use AWS Secrets Manager or Parameter Store:
```bash
# Store in Secrets Manager
aws secretsmanager create-secret \
--name prod/database/password \
--secret-string YourSecurePassword
# Retrieve secret
aws secretsmanager get-secret-value \
--secret-id prod/database/password
```
### Environment Variable Best Practices
```ts
// ✅ GOOD: Use environment variables
const dbPassword = process.env.DATABASE_PASSWORD;
const apiKey = process.env.API_KEY;
// ❌ BAD: Hardcoded secrets
const dbPassword = 'MyPassword123';
const apiKey = 'sk-1234567890';
```
### IAM Role for EC2
```bash
# Create IAM role with least privilege
aws iam create-role \
--role-name EC2-App-Role \
--assume-role-policy-document file://trust-policy.json
# Attach policy to access RDS and Secrets Manager
aws iam attach-role-policy \
--role-name EC2-App-Role \
--policy-arn arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess
```
## Step 7: Monitoring and Logging
### CloudWatch Configuration
```bash
# View application logs
pm2 logs myapp
# Configure CloudWatch Logs
sudo apt install awslogs -y
# Check CloudWatch metrics
aws cloudwatch get-metric-statistics \
--namespace AWS/EC2 \
--metric-name CPUUtilization \
--dimensions Name=InstanceId,Value=i-xxxxx \
--start-time 2025-11-13T00:00:00Z \
--end-time 2025-11-13T01:00:00Z \
--period 300 \
--statistics Average
```
## Auto-Scaling and Load Balancing
### Create Load Balancer
```bash
aws elbv2 create-load-balancer \
--name my-alb \
--subnets subnet-xxxxx subnet-yyyyy \
--security-groups sg-xxxxx
```
### Auto Scaling Group
```bash
aws autoscaling create-auto-scaling-group \
--auto-scaling-group-name myapp-asg \
--launch-configuration-name myapp-lc \
--min-size 2 \
--max-size 10 \
--desired-capacity 2 \
--load-balancer-names my-lb
```
## HTTPS with Let's Encrypt
### Install Certbot
```bash
sudo apt install certbot python3-certbot-nginx -y
# Get certificate
sudo certbot certonly --nginx -d yourdomain.com
# Auto-renew setup
sudo systemctl enable certbot.timer
```
### Configure Nginx for HTTPS
```nginx
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
location / {
proxy_pass http://localhost:3000;
# ... proxy settings ...
}
}
# Redirect HTTP to HTTPS
server {
listen 80;
listen [::]:80;
server_name yourdomain.com;
return 301 https://$server_name$request_uri;
}
```
## Anti-Patterns
```bash
# ❌ BAD: SSH access from anywhere
--cidr 0.0.0.0/0 # Port 22 open to world
# ❌ BAD: Hardcoded credentials
DATABASE_URL=postgresql://user:password@host:5432/db
# ❌ BAD: Public RDS instance
--publicly-accessible true
# ❌ BAD: No backup configuration
# No automated snapshots enabled
# ❌ BAD: Single instance (no redundancy)
# No load balancing or auto-scaling
# ❌ BAD: No monitoring
# No CloudWatch alarms or logging
```
## Verification Before Production
- [ ] EC2 instance launched and accessible
- [ ] Security groups configured (SSH limited, HTTP/HTTPS open)
- [ ] Node.js installed and application running with PM2
- [ ] Nginx reverse proxy working
- [ ] RDS instance created and accessible from EC2
- [ ] Environment variables configured (not hardcoded)
- [ ] Secrets in AWS Secrets Manager or Parameter Store
- [ ] IAM roles with least-privilege access
- [ ] SSL/TLS certificate installed
- [ ] CloudWatch monitoring enabled
- [ ] Backups configured
- [ ] Auto-scaling groups set up
- [ ] Load balancer distributing traffic
## Common Commands
```bash
# Check application status
pm2 status
# View application logs
pm2 logs myapp
# Restart application
pm2 restart myapp
# Stop application
pm2 stop myapp
# Reload (graceful restart)
pm2 reload myapp
# Monitor resources
pm2 monit
# Check nginx status
sudo systemctl status nginx
# Reload nginx configuration
sudo systemctl reload nginx
# Monitor system resources
htop
```
## Integration with Project Standards
Enforces security best practices:
- S-5: Secrets in environment variables
- S-1: Encryption in transit (HTTPS)
- No hardcoded credentials
- IAM least-privilege access
- Security group whitelisting
- Monitoring and logging
## Resources
- AWS EC2: https://docs.aws.amazon.com/ec2
- AWS RDS: https://docs.aws.amazon.com/rds
- PM2 Documentation: https://pm2.keymetrics.io
- Nginx Reverse Proxy: https://nginx.org/en/docs
---
**Last Updated:** January 15, 2026
**Version:** 1.1.0
**Status:** Production Ready ✅
> **January 2026 Note:** This skill has been updated for compatibility with Claude Code v2.x and Claude Opus 4.5. For complex infrastructure planning, use Claude Opus 4.5 with `effort: high` to get comprehensive deployment strategies.