🚀 Deploying a Node.js CRUD App on AWS with Terraform

[MyrinNew]

Managing cloud infrastructure manually can quickly become messy. Terraform allows us to define infrastructure as code (IaC), making deployments repeatable, version-controlled, and automated.


In this guide, we’ll build a Node.js CRUD API (with Express + MongoDB) and deploy it to AWS ECS Fargate using Terraform.





🧩 What We’re Building

• A RESTful Todo API (CRUD endpoints with Express + MongoDB).
• Dockerized app pushed to Amazon ECR.
• AWS ECS Fargate service running containers in a managed VPC.
• Application Load Balancer (ALB) to expose the service.
• Secrets Manager for storing MongoDB credentials securely.
• CloudWatch Logs for centralized logging.

Here’s the final architecture:






Client → ALB → ECS (Fargate Task) → MongoDB (Atlas/Local)
↑
CloudWatch (logs)










🛠️ Tech Stack

Backend

• Node.js + Express
• MongoDB + Mongoose
• CORS + dotenv

Infrastructure

• Docker (containerization)
• Terraform (IaC)
• AWS ECR (image registry)
• AWS ECS Fargate (orchestration)
• AWS ALB (load balancing)
• AWS Secrets Manager (secure DB credentials)
• AWS IAM + Security Groups

📁 Project Structure

Your project is split into two main parts: app code and infra code.






manthanank-nodejs-terraform/
├── server.js # Express entry
├── Dockerfile # Build container
├── config/db.js # Mongo connection
├── controllers/todoController.js
├── models/Todo.js
├── routes/todoRoutes.js
├── terraform/ # Infrastructure as Code
│ ├── vpc.tf # VPC + networking
│ ├── ecs.tf # ECS cluster/service
│ ├── ecr.tf # ECR repo
│ ├── iam.tf # IAM roles/policies
│ ├── security.tf # Security groups
│ ├── logs.tf # CloudWatch logs
│ ├── secrets.tf # Secrets Manager
│ ├── variables.tf # Config vars
│ ├── outputs.tf # Useful outputs
│ └── provider.tf # AWS provider setup










📝 Step 1 — Build the Node.js API

Our CRUD endpoints live under /api/todos.

Example schema:






const todoSchema = new mongoose.Schema({
title: { type: String, required: true, trim: true },
description: { type: String, default: "" },
completed: { type: Boolean, default: false },
createdAt: { type: Date, default: Date.now },
});







Start locally:






npm install
npm run dev







Test:






curl http://localhost:5000/api/todos










📦 Step 2 — Dockerize the App

Dockerfile:






FROM node:18-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
ENV PORT=5000
EXPOSE 5000
CMD ["node", "server.js"]







Build locally:






docker build -t nodejs-todo-api .
docker run -p 5000:5000 -e MONGO_URI=your_mongo_uri nodejs-todo-api










☁️ Step 3 — Terraform AWS Infrastructure

Initialize





cd terraform
terraform init







Key Resources

• ECR — stores our container image (ecr.tf).
• ECS Fargate Service — runs containers (ecs.tf).
• ALB + Target Group — load balancing (ecs.tf).
• VPC + Subnets — networking (vpc.tf).
• IAM Roles — ECS execution permissions (iam.tf).
• Secrets Manager — injects MONGO_URI securely (secrets.tf).
• CloudWatch Logs — for application logs (logs.tf).

🐳 Step 4 — Push Image to ECR

1. Create the repo:

terraform apply -target=aws_ecr_repository.app -auto-approve

1. Build & push:

AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
REGION=ap-south-1
REPO=$AWS_ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com/node-crud-app
IMAGE_TAG=v1

docker build -t node-crud-app:$IMAGE_TAG .
aws ecr get-login-password --region $REGION | \
docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com
docker tag node-crud-app:$IMAGE_TAG $REPO:$IMAGE_TAG
docker push $REPO:$IMAGE_TAG










🚀 Step 5 — Deploy with Terraform

Apply the full infra:






terraform apply







Grab the output:






terraform output alb_dns







Test:






curl http:///api/todos










🔄 Step 6 — Deploy Updates

1. Build and push a new image with IMAGE_TAG=v2.
2. Update variables.tf → image_tag = "v2".
3. Run:

terraform apply -var="image_tag=v2"







ECS performs a rolling update behind the ALB.





📊 Monitoring & Logs

• CloudWatch Logs: All app logs stream automatically.
• ALB Health Checks: Ensure tasks are healthy.
• Troubleshooting: Check ECS task logs in CloudWatch if service won’t start.

🔒 Security Best Practices

• Use private subnets + NAT Gateway in production.
• Restrict Secrets Manager IAM role to a single secret ARN.
• Use immutable image tags (v1, v2) instead of latest.
• Enable HTTPS on ALB with ACM certificates.

🎯 Conclusion

With just a few .tf files, we’ve automated provisioning of:

• Containerized Node.js API
• Secure AWS networking & IAM
• Load-balanced ECS service
• Secrets and logs managed by AWS

This approach scales to any microservice — just add more services, modules, or CI/CD pipelines.





✨ Pro tip: Next step, integrate GitHub Actions or GitLab CI to automatically build/push Docker images and run terraform apply for full CI/CD.







More...