AWS Startup Reference Architecture: Step-by-Step Hands-On Runbook

Standard AWS NAT Gateways cost $32.85/month each. For early-stage startups, deploy the battle-tested open-source fck-nat AMI on a t4g.nano Graviton instance:

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.8.0"

  name = "startup-core-vpc"
  cidr = "10.0.0.0/16"

  azs             = ["eu-west-1a", "eu-west-1b"]
  public_subnets  = ["10.0.1.0/24", "10.0.2.0/24"]
  private_subnets = ["10.0.10.0/24", "10.0.20.0/24"]

  enable_nat_gateway     = false # Skip $65/mo managed NAT
  single_nat_gateway     = false
  enable_dns_hostnames   = true
}

module "fck_nat" {
  source  = "RaJiska/fck-nat/aws"
  version = "1.3.0"

  vpc_id      = module.vpc.vpc_id
  subnet_id   = module.vpc.public_subnets[0]
  instance_type = "t4g.nano" # ~$3.20/month
}

Configure an AWS ALB with automated HTTP-to-HTTPS redirection and health check thresholds:

resource "aws_lb" "api" {
  name               = "startup-api-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb.id]
  subnets            = module.vpc.public_subnets
}

resource "aws_lb_target_group" "api" {
  name        = "startup-api-tg"
  port        = 8080
  protocol    = "HTTP"
  vpc_id      = module.vpc.vpc_id
  target_type = "ip"

  health_check {
    path                = "/health"
    matcher             = "200"
    interval            = 30
    timeout             = 5
    healthy_threshold   = 2
    unhealthy_threshold = 3
  }
}

Run containers serverlessly without managing EC2 worker nodes or suffering Kubernetes control plane fees:

resource "aws_ecs_cluster" "core" {
  name = "startup-core-cluster"
}

resource "aws_ecs_task_definition" "api" {
  family                   = "api-task"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = "256" # 0.25 vCPU
  memory                   = "512" # 0.5 GB RAM
  execution_role_arn       = aws_iam_role.ecs_execution.arn
  task_role_arn            = aws_iam_role.ecs_task.arn

  container_definitions = jsonencode([{
    name      = "api"
    image     = "${aws_ecr_repository.api.repository_url}:latest"
    essential = true
    portMappings = [{ containerPort = 8080, hostPort = 8080 }]
  }])
}

Deploy relational PostgreSQL with automatic scaling between 0.5 ACU (night idle) and 2.0 ACU (peak traffic):

resource "aws_rds_cluster" "db" {
  cluster_identifier = "startup-postgres"
  engine             = "aurora-postgresql"
  engine_mode        = "provisioned"
  engine_version     = "16.1"
  database_name      = "app"
  master_username    = "dbadmin"
  manage_master_user_password = true # AWS Secrets Manager integration

  serverlessv2_scaling_configuration {
    max_capacity = 2.0
    min_capacity = 0.5 # ~$43/mo idle
  }
}