Deploy production-ready ECS web server

Scenario

Developers use this workflow when deploying a production-grade web server from scratch on Alibaba Cloud. It combines infrastructure-as-code for rapid provisioning, precise network configuration for public web traffic, OS-level kernel tuning for high-throughput workloads, and automated data protection to ensure resilience against disk failures or accidental deletions.

Integration steps

1. Provision VPC & ECS with Terraform: Define alicloud_vpc, alicloud_vswitch, and alicloud_instance using an Alinux 3 image ID. Inject user_data to install Nginx and set instance_type = "ecs.c7.large".
2. Configure Security Groups & EIP: Create alicloud_security_group with explicit ingress rules (ip_protocol = "tcp", port_range = "80/80" and "443/443"). Allocate alicloud_eip and bind via alicloud_eip_association with depends_on = [alicloud_instance.web].
3. Attach Secondary ENI (Optional): Use alicloud_network_interface and alicloud_network_interface_attachment to isolate backend management traffic from public web ingress.
4. Tune Alinux Kernel for Production: In user_data or via remote-exec, run tuned-adm profile network-latency and append net.core.somaxconn=65535, net.ipv4.tcp_tw_reuse=1, and vm.swappiness=10 to /etc/sysctl.conf. Apply with sysctl -p.
5. Automate Snapshots via ECS API: Call POST /CreateAutoSnapshotPolicy with {"RegionId":"cn-hangzhou","TimePoints":"02:00","RetentionDays":30}. Attach to disks using POST /ApplyAutoSnapshotPolicy with {"DiskIds":"[\"d-bp1xxx\"]","AutoSnapshotPolicyId":"sp-bp1xxx"}.
6. Validate & Apply: Run terraform init && terraform apply. Verify web reachability via curl -I http://<EIP> and confirm snapshot schedules via aliyun ecs DescribeAutoSnapshotPolicyEx.

Architecture

Terraform orchestrates the foundational layer, provisioning the VPC, subnets, and ECS instance running Alibaba Cloud Linux. The ECS networking layer (Security Groups + EIP) routes inbound HTTP/HTTPS traffic to the instance while isolating management ports. Alinux handles the OS kernel stack, applying TCP and I/O optimizations via tuned and sysctl. The ECS snapshot service operates asynchronously at the block storage layer, capturing point-in-time disk backups without interrupting application traffic or requiring guest-agent coordination.

Prerequisites

• Alibaba Cloud account with AliyunECSFullAccess and AliyunVPCFullAccess RAM roles
• Terraform CLI (v1.5+) with hashicorp/alicloud provider configured (access_key, secret_key, region)
• SSH key pair for initial instance access
• Valid Alinux 3 image ID (e.g., aliyun_3_x64_20G_alibase_20231219.vhd)
• Target region and availability zone identifiers

Common pitfalls

• EIP Association Timing: Binding an EIP before the ECS instance reaches Running state causes Terraform apply failures. Always enforce depends_on = [alicloud_instance.web].
• Security Group Over-Blocking: Default SGs deny all ingress. Explicitly defining ingress rules for ports 80/443 is mandatory; otherwise, web traffic drops silently.
• Non-Persistent Kernel Tuning: Running sysctl -w without persisting to /etc/sysctl.conf or using tuned profiles loses optimizations after instance reboot.
• Snapshot Policy Scope: Auto-snapshot policies only apply to explicitly attached disks. Forgetting to attach the policy to data disks leaves application state unprotected.
• State Drift: Manual console edits to SG rules or EIP bindings break Terraform state. Always run terraform plan before manual changes and use terraform import to reconcile.

Typical questions

• deploy production ECS server
• set up web server with Terraform
• provision and configure ECS
• full stack ECS deployment
• configure ECS after terraform deploy
• Terraform部署ECS并配置网络
• 一键部署生产环境服务器
• ECS生产环境搭建

Q: How do I deploy and configure a production-ready ECS web server? A: You can stand up a production ECS workload from scratch by following a sequential workflow that provisions infrastructure with Terraform, configures networking, tunes the Alinux OS kernel, and sets up automated snapshot policies. This approach integrates four core capabilities: provisioning cloud resources, configuring ECS networking, managing instance lifecycles, and handling data recovery.