Auto-Scaling Web Cluster Deployment

Scenario

Use this workflow when deploying a production web application that requires infrastructure-as-code provisioning, dynamic compute scaling based on traffic, and automated integration with load balancers and managed databases. It eliminates manual ECS lifecycle management while ensuring consistent networking, security policies, and service discovery across all scaled nodes.

Integration steps

1. Provision Base Infrastructure: Define alicloud_vpc, alicloud_vswitch, and alicloud_security_group in main.tf. Run terraform init && terraform apply to establish the network boundary and baseline security group.
2. Deploy SLB & RDS: Add alicloud_slb (type intranet) and alicloud_db_instance resources. Export their IDs via output "slb_id" { value = alicloud_slb.web.id } for downstream ESS integration.
3. Define Scaling Template: Create alicloud_ess_scaling_configuration with instance_type = "ecs.c6.large", image_id, and security_group_id = alicloud_security_group.web.id.
4. Create Scaling Group: Deploy alicloud_ess_scaling_group with min_size = 2, max_size = 10, and vswitch_ids = [alicloud_vswitch.web.id].
5. Bind SLB Backend: Execute aliyun ess AttachLoadBalancers --ScalingGroupId <sg_id> --LoadBalancerIds <slb_id> --ForceAttach true (from ess-integrate-services) to auto-register new ECS nodes to the SLB.
6. Sync RDS Whitelist: Run aliyun ess AttachDBInstances --ScalingGroupId <sg_id> --DBInstanceIds <rds_id> to automatically inject scaled ECS private IPs into the RDS IP whitelist.
7. Configure ECS Networking: Use aliyun ecs AuthorizeSecurityGroup --SecurityGroupId <sg_id> --IpProtocol tcp --PortRange 80/80 --SourceCidrIp 0.0.0.0/0 to allow web traffic, and add a rule for RDS port 3306 restricted to the VPC CIDR.
8. Manage Instance Lifecycle: Verify healthy nodes with aliyun ess DescribeScalingInstances. Before patching, isolate a node using aliyun ess SetInstancesToStandby --ScalingGroupId <sg_id> --InstanceIds <i-xxx> (from ess-manage-instances).

Architecture

Terraform acts as the declarative orchestrator, provisioning VPC, SLB, RDS, and security groups. The ESS scaling group dynamically provisions ECS instances using the scaling configuration. Client traffic flows through SLB → ECS. ESS automatically registers new ECS nodes to the SLB backend pool and syncs their private IPs to the RDS whitelist. Security groups enforce north-south (SLB→ECS) and east-west (ECS→RDS) traffic isolation.

Prerequisites

• Alibaba Cloud CLI (aliyun) and Terraform (>=1.5.0) installed
• ALICLOUD_ACCESS_KEY and ALICLOUD_SECRET_KEY environment variables configured
• Valid ECS image ID and instance type in the target region
• RAM policy granting AliyunESSFullAccess, AliyunECSFullAccess, and AliyunSLBFullAccess

Common pitfalls

• SLB Health Check Mismatch: ESS terminates instances if the SLB health check path (/health) doesn't return HTTP 200. Align the SLB HealthCheckURI with your app's actual endpoint.
• RDS Whitelist Exhaustion: RDS IP whitelists cap at 1000 entries. Frequent scaling can hit this limit; prefer RDS security group mode over IP whitelisting for ESS.
• Security Group Rule Conflicts: Attaching overlapping security groups to the scaling configuration can inadvertently block port 80. Use a single, explicitly ordered security group per scaling config.
• Terraform State Drift: Manually modifying ESS parameters outside Terraform triggers destructive terraform plan diffs. Always route infra changes through terraform apply.

Typical questions

• deploy auto-scaling web cluster
• provision scalable application stack
• one-click deploy web app with auto scaling
• terraform deploy ESS with SLB and RDS
• 部署自动伸缩Web集群
• 一键部署弹性伸缩应用架构
• terraform搭建高可用网站
• 自动伸缩组绑定负载均衡和数据库

Q: How do I deploy an auto-scaling web cluster or scalable application stack? A: You can provision this architecture by using Terraform to deploy a complete web application stack and configuring Auto Scaling to manage ECS instances alongside SLB and RDS. This solution integrates infrastructure provisioning, instance management, service binding, and networking configuration across the specified cloud services.