Configuring AWS RDS, AWS EFS Storage, KMS and SSL certificate in ACM.
Tags: database, security, storage, aws
Published: 2022-12-30 06:50:45

![Infrastructure](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/54y5cno52o72y3wufb28.png)
Now that the major networking services have be configured, next we will configure the data layer and security services.

**Create Encryption Key in Amazon KMS**
AWS Key Management Service (AWS KMS) create and control keys used to encrypt or digitally sign data. We will use the KMS key to encrypt the AWS RDS MYSQL database. This resource is region specific, hence for this project the KMS key will be created in us-east-1 as with other AWS resource.

- In the Key Management Service dashboard, click on `create key`
- Ensure `Symmetric` and `Encrypt and decrypt` is check and click  next
-Enter a Name, description and Tag

![key](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/psbvxhuftd154g96rm6c.png)
Select yourself as administrator

![permission](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r96pahfej2oxlun4ng4h.png)
Give yourself key usage permission

![usage](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tz9w00ja3ljmk8enz3r5.png)
Click Next to review and Finish

![Key](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yhd8qn6frtitz85tkvtc.png)

**Amazon RDS**
Amazon Relational Database Service (Amazon RDS) is a web service that makes it easier to set up, operate, and scale a relational database in the AWS Cloud. 
Amazon RDS supports couple of database engines including MYSQL database needed in this project.

**_Create Subnet groups_**
The DB subnet group defines which subnet(s) of VPC the database instance would deploy to.

- Navigate to the Amazon RDS dashboard
- In the left menu, click on subnet groups
- Click on create subnet group
- Enter Name, description and select VPC
- Select availabity zone us-east-1a and us-east-1b
- Select the subnet 10.0.5.0/24 and 10.0.6.0/24 as seen in the diagram.
- Click create 
![subnet group](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/emnrhl6iu9ect7990a9i.png)

**_Create RDS MySql database_**
- Navigate to the Amazon RDS dashboard
- Create database
- Under Engine options - select `MySql`
- Availability and durability - select Free tier (or Multi-AZ DB Cluster for high availability, data redundancy and increases capacity to serve read workloads)
- Enter a `Name` and `password` for the database
- Select the right VPC
- Ensure the database subnet group is selected
- Public access: No
- Select the `data layer security group` we created earlier.
- Select `us-east-1a` under Availability Zone
- Leave other default options
- Click create database

![rdson](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xu269hsuojapn5jd76bw.png)

![db](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xdx9gi7zbw354yw49b4s.png)

**Create File Storage with EFS**
Amazon Elastic File System (Amazon EFS) provides a simple, scalable, elastic file system for general purpose workloads for use with AWS Cloud services and on-premises resources.
It is  serverless, elastic, set-and-forget file system that automatically grows and shrinks as you add and remove files with no need for management or provisioning.

- Navigate Amazon EFS dashboard
- Click on create file system
- Enter Name, tag and click next

![efs](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4qruxo1f62pwezluw6vq.png)
- Select the appropriate VPC
- Select private subnet 1 & 2 (10.0.2.0/24 and 10.0.4.0/24)
- Next, review the setting and click on create

![efs](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xpmomxm1o6tntbusxzqm.png)

**_Access Point_**
One of the advantages of Amazon EFS is that, it is a shared file systems, meaning it can serve as a storage for more than one application. It keeps each application separate with the use of Access points. We will be hosting two applications.

**_Create Access Point for Two Applications_**
- Click the name of the file system

![fs](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ovic3gi57m583rc76weu.png)
- Click on **_Access Points_** Tab and click create **_access point_**

![access point](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/erebt8oote07pxv6zjyh.png)
- Enter the following details for WordPress application and create access point
```
Name: wordpress
Path: /wordpress
POSIX user ID, Group ID, Owner user ID, group ID: 0
Access point permissions: 0755
Tag - Name: wordpress-ap

```
The second application is named **_Tooling_**

- Enter the following details for Tooling application and create access point
```
Name: tooling
Path: /tooling
POSIX user ID, Group ID, Owner user ID, group ID: 0
Access point permissions: 0755
Tag: Name: tooling-ap

```

![access point](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5n453y5255vygpc6lolh.png)

**SSL Certificate**
Amazon Certificate Manager (ACM) handles the complexity of creating, storing, and renewing public and private SSL/TLS X.509 certificates and keys that protect your AWS websites and applications.

**_Create certificate_**
- In the ACM dashboard click on _Request a certificate_
- Ensure _Request a public certificate_ is selected and click next
- Use a wildcard ("*") as the Fully qualified domain name ("*".yourdomain.xx)

![cert](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s0vk4fa5ehb31r9rsx0q.png)
- Accept the default values and click _Request_
- Next Click List Certificate in the left menu
- Click on the certificate you just created

![Cert](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ugfmpnamhf69w0qf0tld.png)
- Click on _Create records in Route 53_
- Click on Create records

![records](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mtwsrf180ujb4dc535xc.png)

> _If you purchased your domain externally, you need to create a hosted zone in Route 53 and updated the DNS records._

After a few minute the certificate would be validated and issued.

![ssl](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8wa5ivcw9h56ndbluflc.png)

Next, let's create AMI's for the web application. 
Watch out for the concluding implementation.