amazon-ec2 | WARNING : You probably do n't want this code | AWS library

You have to add codedeploy:CreateDeployment permissions for church-managment-bff-s3 user. You can do this as an inline policy for the user in aws console:

By the looks of it, you are well aware of what you are trying to achieve. Even though you are saying that it is not the NACLs, I would check them one more time, as sometimes one can easily overlook something minor. Take into account the snippet below taken from this AWS troubleshooting article and make sure that you have the right S3 CIDRs in your rules for the respective region:

Make sure that the network ACLs associated with your EC2 instance's subnet allow the following: Egress on port 80 (HTTP) and 443 (HTTPS) to the Regional S3 service. Ingress on ephemeral TCP ports from the Regional S3 service. Ephemeral ports are 1024-65535. The Regional S3 service is the CIDR for the subnet containing your S3 interface endpoint. Or, if you're using an S3 gateway, the Regional S3 service is the public IP CIDR for the S3 service. Network ACLs don't support prefix lists. To add the S3 CIDR to your network ACL, use 0.0.0.0/0 as the S3 CIDR. You can also add the actual S3 CIDRs into the ACL. However, keep in mind that the S3 CIDRs can change at any time.

Your S3 endpoint policy looks good to me on first look, but you are right that it is very likely that the policy or the endpoint configuration in general could be the cause, so I would re-check it one more time too.

One additional thing that I have observed before is that depending on the AMI you use and your VPC settings (DHCP options set, DNS, etc) sometimes the EC2 instance cannot properly set it's default region in the yum config. Please check whether the files awsregion and awsdomain exist within the /etc/yum/vars directory and what's their content. In your use case, the awsregion should have:

As you can to see, your SO reads "nvme1n1" as name of device (not "/dev/sdd").

So, you could apply an user_data with the cloud-init instructions for your EC2 instance:

Personally, I would recommend using AWS EC2 to deploy your app because of the flexibility offered by EC2. They offered the free tier, so you can try and play around with the environment. The EC2 instance is a remote Linux machine, so you can configure it as much as you like and very flexible.

If you have dockerize your app, you just simply need to copy the docker instance to your EC2 instance and simply host your server there. If you don't dockerize your app, you can just fetch from your repository and download all the dependencies first and your app should work just fine.

To answer your question, there are 2 kinds of request. 1) one time request 2) persistent request.

one-time-request:- manually you can only terminate instance, you cannot stop it.Once you terminate instance the request goes away.

persistent-request:- In case of persistent request, it will automatically launch an instance when you manually terminate the instance, but if you stop it manually then you need to manually start it again. spot instance will not start for you automatically.docs

If the request is persistent, the request is opened again after your Spot Instance is interrupted( interruption by aws). If the request is persistent and you stop your Spot Instance, the request only opens after you start your Spot Instance.

Please NOTE

You can only stop/ start instance which is launched from persistent request and which not a part of fleet or launch group, Availability Zone group, or Spot block. docs when you stop the instance the request goes into disabled state.

It depends on the underlying virtualization, and almost all the modern ones use HVM; on those virtual machines, the devices are renamed by the kernel as described in the fine manual

One will want to similarly exercise caution about using NVMe devices, as they also get their own device nomenclature.

Thankfully, the ansible setup: module (or gather_facts: yes) will enumerate all available disks on the machine and make them available along with helpful metadata in the ansible_devices facts dict, which usually includes the AWS EBS volume-id in the symlinks

entering this to the user data when the instance is stopped should work

The first attempt will sadly not work. This is because UserData executes only when a new instance is launched.

When I paste my three lines instead of the hello world line, only the first one

The second attempt fails because this script runs as root in / folder (root of the filesystem). So unless your APP is in /APP, this will not work.

The easiest and a very good practice is to use SSM. System Manager has a Parameter Store and it lets you save encrypted credentials. Then all you need to do is assign an IAM Role to the EC2 with a Policy to access SSM or just edit the existing Role and give Full-SSM access to get it going then lock it down to Least Privilege.

but wouldn't that be an issue when our credentials change often? Wouldn't we have to update those every time our credentials expired?

IAM users have rotating passwords, you need a service account password.

By default the EC2 has access to somethings because when you spin one up you have to assign the EC2 with an IAM role. Also, most EC2 AMI's come with the AWS CLI & SDK installed, so you can straight away fetch SSM Parameter store values. Here is some Python to demo:

Just like everything else, there are multiple ways to go about this. Depending on the way you have ended the question looks like you are open to exploring them.

Here are my preferences depending on the increasing order of responsibilities on my side vs what AWS handles for me:

AWS Amplify :

Given that you are already using React and Node, this will be a relatively easy switch. Amplify is a not only a set of very useful frontend framework by makeing it easy to add functionalities like Authentication, Social Logins, Rotating API keys (via Cognito and API Gateway) etc but also backend logic that can be eventually deployed on AWS ApiGateway and AWS Lambda. Not only this but AMplify also provides a CICD pipeline and connects with Gothub.

In minutes, you can have a scalable service, with opetion to host frontend via AWS CloudFront, a global CDN service or via S3 hosting, deploy the API via ApiGateway and Lambda, have a CICD pipeline setup via AWS CodeDeploy and Code Build and also have user management via AWS Cognito. You can have multiple enviornments dev, test, beta etc and have it setup such that any push to the master branch is automatically deployed on the infra, and so on and so forth other branches being mapeed to specific enviornment. To top it all off, the same stack can be used to test and develop locally.

If you are rather tied down to use a specific service or function in a specific way, you can build up any of the combination of the above services. API Gateway for managing API, Cognito for user management, Lambda for compute capacity etc. Rememebr, these are managed services so you offload a lot of engineering hours to AWS and being serverles means you are paying for what you use.

Comming to the example you have shared, you don't want your node process to be responsible of serving static assets - its a waste of the compute power as there is no intelligence attached to serving JS, CSS or images and also because in that case you introduce a new process in the loop. Instead have NGINX serve static assets itself. Refer this official guide or this StackOverflow answer.