Abdimajid Hussein
All projects
01CompletedContainers · Networking · Keyless delivery

Snipe-IT on AWS ECS Fargate

  • AWS
  • Terraform
  • ECS Fargate
  • Docker
  • RDS

01 What I built

Snipe-IT is an open-source asset manager. I wanted to run a real application on AWS the way a small team would: private networking, a managed database, TLS on a real domain and a repeatable deployment.

  • 8 reusable Terraform modules
  • 4 GitHub Actions workflows
  • OIDC authentication with AWS instead of stored long-lived AWS credentials

02 Architecture

  1. 01Internet
    User
    Route 53
    DNS record for the domain
  2. 02Public subnets
    Application Load Balancer
    HTTPS listener · ACM certificate
    NAT Gateway
    outbound only
  3. 03Private subnets
    ECS Fargate service
    Snipe-IT tasks · image from ECR
  4. 04Data
    Amazon RDS
    reachable only from the task security group
  5. 05Delivery
    GitHub Actions
    assumes an IAM role via OIDC
    Amazon ECR
    versioned images
Route 53 resolves the domain to the load balancer. The ALB terminates TLS and forwards to Fargate tasks in private subnets. Tasks reach RDS privately and use the NAT gateway for outbound traffic only.

03 Important decision

Why ECS Fargate?

It removed host patching and capacity management, so the work stayed on networking, delivery and the app. The cost is less control over the host.

04 Issue solved

The load balancer marked every target unhealthy

Problem
Tasks were running but requests through the ALB returned a 502 Bad Gateway. The targets were not healthy.
Root cause
The task security group was not allowing the container port from the load balancer's security group.
Fix
Allowed the container port on the task security group from the ALB security group specifically, not a CIDR range. The targets became healthy and requests reached Snipe-IT.

05 Repository

View the repository
Back to all projects