Use Existing Amazon VPC

Overview

When a Webiny project is deployed in production mode, it is deployed into a new Amazon Virtual Private Cloud (Amazon VPC), with already configured public and private subnets, security groups, and so on.

And although this may work for multiple types of users and projects, when it comes to enterprise organizations, often times a fully configured Amazon VPC is already in place and there’s no need to create a new one. In those cases, deploying a Webiny project into the existing Amazon VPC makes more sense.

In this article, we describe how enterprise organizations can deploy their Webiny project into an existing Amazon VPC.

Configuration

In order to deploy Webiny into an existing Amazon VPC, we need to apply four configuration changes to four default project applications that are included in every Webiny project:

1. Core (apps/core)
2. API (apps/api)
3. Admin (apps/admin)
4. Website (apps/website)

For all applications, changes will be applied in application’s respective webiny.application.ts file. Note that all the changes are essentially the same: we use the vpc.existingVpc option to pass relevant existing Amazon VPC-related resources: private subnet and security group IDs.

Let’s take a look at the changes that need to be made.

1. Core (apps/core)

The Core application’s webiny.application.ts file should look like the following:

Note that, if the Webiny project is being deployed into the production environment, two private subnets need to specified via OPENSEARCH_PRIVATE_SUBNETS and LAMBDA_FUNCTIONS_PRIVATE_SUBNETS arrays. This is because the OpenSearch cluster that Webiny deploys relies on two instances that are deployed into two different private subnets. For environments other than production, specifying a single private subnet will suffice.

2. API (apps/api)

The API application’s webiny.application.ts file should look like the following:

As we can see, in this configuration file we’re providing the necessary VPC-related parameters for AWS Lambda functions that the application deploys.

3. Admin (apps/admin)

The Admin application’s webiny.application.ts file should look like the following:

In this config, no VPC-related parameters need to be specified. Essentially it’s the same config that users have when they create a brand new Webiny project, except this time the createAdminApp function is imported from the enterprise folder.

4. Website (apps/website)

The Website application’s webiny.application.ts file should look like the following:

Like with the API project application, again, in this configuration file we’re providing the necessary VPC-related parameters for AWS Lambda functions that the project application deploys.

Testing

Once the above changes have been applied, we’re ready to do a test deployment, which can be done via the webiny deploy command:

At the end of the deployment process, you should receive relevant URLs in the terminal, where the installation process can be completed.

Additional Notes

Internet Gateway / NAT Gateway Deployment

Note that for a Webiny project to work as expected, an Amazon VPC must have an Internet and NAT gateways deployed. This is because access to public internet is required on a couple of occasions:

1. Amazon Cognito - Webiny’s application code interacts with Amazon Cognito via AWS SDK. May not be needed if the organization doesn’t plan to rely on Amazon Cognito as their identity provider.
2. Amazon CloudFront - Webiny’s application code interacts with Amazon CloudFront via AWS SDK
3. Webiny Control Panel (WCP) - Webiny Control Panel (WCP)-linked Webiny projects also frequently interact with app’s public HTTP API (api.webiny.com)
4. Webiny’s Prerendering Service - for website performance reasons, whenever a user publishes a page created with Webiny’s Page Builder application, behind the scenes, an AWS Lambda function is triggered, which issues HTTP requests to published page’s URL (a public CloudFront URL). May not be needed if the organization doesn’t plan to use the Page Builder application.

VPC Endpoints

Users can use Amazon VPC endpoints in order to further secure communication between different services a Webiny project is relying on. At the moment, this is possible for:

1. DynamoDB (gateway)
2. S3 (gateway)
3. SQS (interface)
4. EventBridge (interface)

Note that VPC endpoints are configured within the provided existing Amazon VPC. This is mainly because organizations have full control of their environment, and are able to do this.