Deploy Laravel to AWS via Console (Part 1): Architecture — VPC, Subnets & Security Groups

In Part 0, you created your AWS account, secured root, and set up an IAM user. Now let's build the network foundation for the entire infrastructure.

Every action in this post is performed in the AWS Console — no terminal needed.

What We're Building

After all 5 parts, you'll have:

Architecture Overview

                    ┌───────────────────────────────────────┐
                    │             Route 53 (DNS)             │
                    └──────────────────┬────────────────────┘
                                       │
                    ┌──────────────────┴────────────────────┐
                    │         CloudFront (CDN)               │
                    └──────────────────┬────────────────────┘
                                       │
                    ┌──────────────────┴────────────────────┐
                    │     ALB (Application Load Balancer)    │
                    │     SSL termination (ACM Certificate)  │
                    └───┬──────────────────────────────┬────┘
                        │          VPC 10.0.0.0/16     │
            ┌───────────┴───────────┐    ┌─────────────┴──────────┐
            │   Public Subnet A     │    │   Public Subnet C      │
            │   10.0.1.0/24         │    │   10.0.2.0/24          │
            │   AZ: ap-northeast-1a │    │   AZ: ap-northeast-1c  │
            │  ┌─────────────────┐  │    │  ┌─────────────────┐   │
            │  │   EC2 Instance  │  │    │  │   (scale later) │   │
            │  │   Nginx+PHP-FPM │  │    │  │                 │   │
            │  └─────────────────┘  │    │  └─────────────────┘   │
            └───────────────────────┘    └────────────────────────┘
            ┌───────────────────────┐    ┌────────────────────────┐
            │  Private Subnet A     │    │  Private Subnet C      │
            │  10.0.11.0/24         │    │  10.0.12.0/24          │
            │  ┌─────────────────┐  │    │                        │
            │  │   RDS MySQL 8.0 │  │    │   (RDS Standby -       │
            │  │   Primary       │  │    │    Multi-AZ replica)   │
            │  └─────────────────┘  │    │                        │
            └───────────────────────┘    └────────────────────────┘

Step 1: Create VPC

1a. Open VPC Console

1. Search bar → type "VPC" → click VPC
2. Left menu → Your VPCs
3. Click "Create VPC"

1b. Select "VPC and more"

Choose the "VPC and more" tab — creates VPC with subnets, route tables, and IGW in one step.

1c. Fill In Details

1d. Review Preview & Create

The right panel shows a visual network diagram. Verify it matches the architecture above, then click "Create VPC".

1e. Enable Auto-assign Public IP

1. VPC → Subnets → click public subnet 1
2. Actions → Edit subnet settings
3. Check "Enable auto-assign public IPv4 address" → Save
4. Repeat for public subnet 2

Step 2: Verify Internet Gateway & Route Tables

Public Route Table

1. VPC → Route tables → click the public route table
2. Routes tab should have:

Private Route Table

Only has 10.0.0.0/16 → local. No internet route — by design.

Step 3: Create Security Groups

3a. ALB Security Group

1. VPC → Security groups → Create security group

Inbound rules: HTTP (80) from 0.0.0.0/0, HTTPS (443) from 0.0.0.0/0

3b. EC2 Security Group

Inbound rules: HTTP (80) from laravel-alb-sg, SSH (22) from My IP

3c. RDS Security Group

Inbound rules: MYSQL/Aurora (3306) from laravel-ec2-sg

3d. ElastiCache Security Group

Inbound rules: Custom TCP (6379) from laravel-ec2-sg

Step 4: Create IAM Role for EC2

4a. Create Policy

1. IAM → Policies → Create policy → JSON tab:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
            "Resource": "arn:aws:s3:::your-laravel-bucket/*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::your-laravel-bucket"
        }
    ]
}

Policy name: laravel-s3-access

4b. Create Role

1. IAM → Roles → Create role
2. Trusted entity: AWS service → EC2
3. Attach laravel-s3-access policy
4. Role name: laravel-ec2-role

Step 5: Create SSH Key Pair

1. EC2 → Key Pairs → Create key pair

The .pem file downloads automatically. Move it:

mv ~/Downloads/laravel-production.pem ~/.ssh/
chmod 400 ~/.ssh/laravel-production.pem

Cost Estimate

Series Navigation:

• ← Part 0: Prerequisites
• Part 1: Architecture & VPC (You are here)
• Part 2: EC2 & Amazon Linux 2023 →
• Part 3: RDS, S3 & ElastiCache →
• Part 4: ALB, CloudFront & SSL →
• Part 5: CI/CD & Zero-Downtime Deploy →