Scaling Smart: EC2 Autoscaling, Terraform, and Secrets Manager in AWS

In the last post, we deployed a secure, scalable AWS architecture for a restaurant booking app using EC2, RDS, and CloudWatch. Now let’s take it further:

  • 🔄 Auto Scaling EC2 Instances
  • ⚙️ Infrastructure as Code with Terraform
  • 🔐 Secrets Manager for Secure Configs

This final layer turns your setup into a production-grade cloud-native app.

🔄 1. Auto Scaling EC2 Instances

🔹 Why It Matters

Your app should automatically handle more traffic and recover from failure — even when you’re asleep.

✅ What We’ll Do

  • Create an Auto Scaling Group (ASG)
  • Attach to Application Load Balancer (ALB)
  • Use Launch Templates for consistency

🔧 Steps

Create Launch Template

aws ec2 create-launch-template \
  --launch-template-name web-app-template \
  --version-description v1 \
  --launch-template-data file://lt-config.json

Create Auto Scaling Group

aws autoscaling create-auto-scaling-group \
  --auto-scaling-group-name web-app-asg \
  --launch-template LaunchTemplateName=web-app-template,Version=1 \
  --min-size 2 --max-size 5 --desired-capacity 2 \
  --vpc-zone-identifier subnet-xxxxxx,subnet-yyyyyy \
  --target-group-arns arn:aws:elasticloadbalancing:...

Add Scaling Policy (CPU-Based)

aws autoscaling put-scaling-policy \
  --auto-scaling-group-name web-app-asg \
  --policy-name cpu-scale-up \
  --policy-type TargetTrackingScaling \
  --target-tracking-configuration file://cpu-scaling-config.json

⚙️ 2. Infrastructure as Code with Terraform

🔹 Why It Matters

  • Avoid manual configuration
  • Reproducible and version-controlled

✅ What We’ll Do

  • Use Terraform to deploy VPC, EC2, RDS, IAM, ALB, etc.

🧱 Sample Terraform Structure

terraform/
├── main.tf         # Provider and modules
├── vpc.tf          # VPC and subnet config
├── ec2.tf          # Launch template, ASG
├── alb.tf          # Load balancer setup
├── rds.tf          # Database
├── outputs.tf      # Useful outputs (IP, URLs)

🔧 Example Snippet

resource "aws_launch_template" "app" {
  name_prefix   = "web-app"
  image_id      = "ami-0abc12345"
  instance_type = "t3.micro"
  user_data     = filebase64("init.sh")
}

resource "aws_autoscaling_group" "app_asg" {
  desired_capacity     = 2
  max_size             = 5
  min_size             = 1
  launch_template {
    id      = aws_launch_template.app.id
    version = "$Latest"
  }
  vpc_zone_identifier = [aws_subnet.public1.id, aws_subnet.public2.id]
  target_group_arns   = [aws_lb_target_group.app_tg.arn]
}

Run it all with:

terraform init
terraform apply

🔐 3. Secrets Manager for Environment Variables

🔹 Why It Matters

Never hardcode secrets in .env files or user data scripts.

✅ What We’ll Do

  • Store API keys, DB passwords securely
  • Inject them into EC2 via IAM + SDK/CLI

🔧 Create and Retrieve Secret

aws secretsmanager create-secret \
  --name db_credentials \
  --secret-string '{"username":"admin","password":"mypassword"}'

aws secretsmanager get-secret-value --secret-id db_credentials

🔧 Access via Code (Python Example)

import boto3
import json

secrets = boto3.client('secretsmanager')
response = secrets.get_secret_value(SecretId='db_credentials')
creds = json.loads(response['SecretString'])
print(creds['username'])

Or pass to container as ENV via EC2 User Data script:

#!/bin/bash
export DB_USER=$(aws secretsmanager get-secret-value --secret-id db_credentials --query 'SecretString' --output text | jq -r .username)

📦 What You’ve Built

✅ EC2 Auto Scaling behind ALB ✅ Declarative Infrastructure via Terraform ✅ Secure Secrets Management via AWS-native services

Related Posts

Scroll to Top