Aurora Global
AWS architecture template · SAA-C03: Route 53 → ALB → Fargate → Aurora global cluster + CloudWatch
Aurora Global is a free AWS architecture template built with Aurora, CloudWatch, Fargate, IAM, Load Balancer and Route 53. Open it in TheArchitect to edit the diagram, estimate monthly cost, and export the CloudFormation or Terraform that deploys it.
AWS services in this template
- Aurora
- CloudWatch
- Fargate
- IAM
- Load Balancer
- Route 53
Deployment notes
Needs input
- Aurora Global Database requires separate cluster registration per region.
- Uses demo VPC with private subnets and Fargate task execution role.
Generated CloudFormation — 35 resources
| Logical ID | Resource type |
|---|---|
| Route53route53 | AWS::Route53::HostedZone |
| AuroraGlobalVPC10100016vpc | AWS::EC2::VPC |
| AuroraGlobalVPC10100016vpcedgewebsgSecurityGroup | AWS::EC2::SecurityGroup |
| AuroraGlobalVPC10100016vpcappruntimesgSecurityGroup | AWS::EC2::SecurityGroup |
| AuroraGlobalVPC10100016vpcappruntimesgSecurityGroupIngressRule | AWS::EC2::SecurityGroupIngress |
| AuroraGlobalVPC10100016vpcworkersgSecurityGroup | AWS::EC2::SecurityGroup |
| AuroraGlobalVPC10100016vpcdatastoresgSecurityGroup | AWS::EC2::SecurityGroup |
| AuroraGlobalVPC10100016vpcdatastoresgSecurityGroupIngressRule | AWS::EC2::SecurityGroupIngress |
| AuroraGlobalVPC10100016vpccontrolplanesgSecurityGroup | AWS::EC2::SecurityGroup |
| AuroraGlobalVPC10100016vpcPublicSubnet1 | AWS::EC2::Subnet |
| AuroraGlobalVPC10100016vpcPublicSubnet2 | AWS::EC2::Subnet |
| AuroraGlobalVPC10100016vpcPrivateSubnet1 | AWS::EC2::Subnet |
| AuroraGlobalVPC10100016vpcPrivateSubnet2 | AWS::EC2::Subnet |
| AuroraGlobalVPC10100016vpcPrivateSubnet3 | AWS::EC2::Subnet |
| AuroraGlobalVPC10100016vpcPrivateSubnet4 | AWS::EC2::Subnet |
| AuroraGlobalVPC10100016vpcInternetGateway | AWS::EC2::InternetGateway |
| AuroraGlobalVPC10100016vpcGatewayAttachment | AWS::EC2::VPCGatewayAttachment |
| AuroraGlobalVPC10100016vpcPublicRouteTable | AWS::EC2::RouteTable |
| AuroraGlobalVPC10100016vpcPublicRoute | AWS::EC2::Route |
| AuroraGlobalVPC10100016vpcPublicSubnet1RTA | AWS::EC2::SubnetRouteTableAssociation |
| AuroraGlobalVPC10100016vpcPublicSubnet2RTA | AWS::EC2::SubnetRouteTableAssociation |
| AuroraGlobalVPC10100016vpcNatEIP | AWS::EC2::EIP |
| AuroraGlobalVPC10100016vpcNatGateway | AWS::EC2::NatGateway |
| AuroraGlobalVPC10100016vpcPrivateRouteTable | AWS::EC2::RouteTable |
| AuroraGlobalVPC10100016vpcPrivateRoute | AWS::EC2::Route |
| AuroraGlobalVPC10100016vpcPrivateSubnet1RTA | AWS::EC2::SubnetRouteTableAssociation |
| AuroraGlobalVPC10100016vpcPrivateSubnet2RTA | AWS::EC2::SubnetRouteTableAssociation |
| AuroraGlobalVPC10100016vpcPrivateSubnet3RTA | AWS::EC2::SubnetRouteTableAssociation |
| AuroraGlobalVPC10100016vpcPrivateSubnet4RTA | AWS::EC2::SubnetRouteTableAssociation |
| AuroraGlobalVPC10100016vpcDbSubnetGroup | AWS::RDS::DBSubnetGroup |
| APIALBelb | AWS::ElasticLoadBalancingV2::LoadBalancer |
| APITaskfargate | AWS::ECS::TaskDefinition |
| TaskRoleiam | AWS::IAM::Role |
| AuroraGlobalaurora | AWS::RDS::DBCluster |
| LagAlarmcloudwatch | AWS::CloudWatch::Alarm |
View the full CloudFormation template
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "Generated by TheArchitect — https://www.thecloudarchitect.dev",
"Metadata": {
"TheArchitect": {
"Edges": [
{
"From": "TaskRoleiam",
"To": "APITaskfargate",
"Label": "task role"
}
]
}
},
"Resources": {
"Route53route53": {
"Type": "AWS::Route53::HostedZone",
"Properties": {
"Name": "api.example.com.",
"HostedZoneConfig": {
"Comment": "Latency-based routing to the Aurora global primary."
}
}
},
"AuroraGlobalVPC10100016vpc": {
"Type": "AWS::EC2::VPC",
"Properties": {
"CidrBlock": "10.10.0.0/16",
"EnableDnsHostnames": true,
"EnableDnsSupport": true,
"Tags": [
{
"Key": "Name",
"Value": "saa-aurora-vpc"
}
]
}
},
"AuroraGlobalVPC10100016vpcedgewebsgSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupName": "edge-web-sg",
"GroupDescription": "Allow HTTPS from the internet to public load balancers",
"VpcId": {
"Ref": "AuroraGlobalVPC10100016vpc"
},
"Tags": [
{
"Key": "Name",
"Value": "edge-web-sg"
}
],
"SecurityGroupIngress": [
{
"IpProtocol": "tcp",
"FromPort": 443,
"ToPort": 443,
"CidrIp": "0.0.0.0/0"
}
],
"SecurityGroupEgress": [
{
"IpProtocol": "-1",
"CidrIp": "0.0.0.0/0"
}
]
}
},
"AuroraGlobalVPC10100016vpcappruntimesgSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupName": "app-runtime-sg",
"GroupDescription": "Allow application traffic from the edge tier",
"VpcId": {
"Ref": "AuroraGlobalVPC10100016vpc"
},
"Tags": [
{
"Key": "Name",
"Value": "app-runtime-sg"
}
],
"SecurityGroupEgress": [
{
"IpProtocol": "-1",
"CidrIp": "0.0.0.0/0"
}
]
}
},
"AuroraGlobalVPC10100016vpcappruntimesgSecurityGroupIngressRule": {
"Type": "AWS::EC2::SecurityGroupIngress",
"Properties": {
"GroupId": {
"Ref": "AuroraGlobalVPC10100016vpcappruntimesgSecurityGroup"
},
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80,
"SourceSecurityGroupId": {
"Ref": "AuroraGlobalVPC10100016vpcedgewebsgSecurityGroup"
}
}
},
"AuroraGlobalVPC10100016vpcworkersgSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupName": "worker-sg",
"GroupDescription": "Private worker runtime egress only",
"VpcId": {
"Ref": "AuroraGlobalVPC10100016vpc"
},
"Tags": [
{
"Key": "Name",
"Value": "worker-sg"
}
],
"SecurityGroupEgress": [
{
"IpProtocol": "-1",
"CidrIp": "0.0.0.0/0"
}
]
}
},
"AuroraGlobalVPC10100016vpcdatastoresgSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupName": "data-store-sg",
"GroupDescription": "Allow PostgreSQL from application runtimes",
"VpcId": {
"Ref": "AuroraGlobalVPC10100016vpc"
},
"Tags": [
{
"Key": "Name",
"Value": "data-store-sg"
}
],
"SecurityGroupEgress": [
{
"IpProtocol": "-1",
"CidrIp": "0.0.0.0/0"
}
]
}
},
"AuroraGlobalVPC10100016vpcdatastoresgSecurityGroupIngressRule": {
"Type": "AWS::EC2::SecurityGroupIngress",
"Properties": {
"GroupId": {
"Ref": "AuroraGlobalVPC10100016vpcdatastoresgSecurityGroup"
},
"IpProtocol": "tcp",
"FromPort": 5432,
"ToPort": 5432,
"SourceSecurityGroupId": {
"Ref": "AuroraGlobalVPC10100016vpcappruntimesgSecurityGroup"
}
}
},
"AuroraGlobalVPC10100016vpccontrolplanesgSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupName": "control-plane-sg",
"GroupDescription": "Private EKS control plane attachment group",
"VpcId": {
"Ref": "AuroraGlobalVPC10100016vpc"
},
"Tags": [
{
"Key": "Name",
"Value": "control-plane-sg"
}
],
"SecurityGroupEgress": [
{
"IpProtocol": "-1",
"CidrIp": "0.0.0.0/0"
}
]
}
},
"AuroraGlobalVPC10100016vpcPublicSubnet1": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "AuroraGlobalVPC10100016vpc"
},
"CidrBlock": "10.10.1.0/24",
"AvailabilityZone": "us-east-1a",
"MapPublicIpOnLaunch": true,
"Tags": [
{
"Key": "Name",
"Value": "public-edge-a"
}
]
}
},
"AuroraGlobalVPC10100016vpcPublicSubnet2": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "AuroraGlobalVPC10100016vpc"
},
"CidrBlock": "10.10.2.0/24",
"AvailabilityZone": "us-east-1b",
"MapPublicIpOnLaunch": true,
"Tags": [
{
"Key": "Name",
"Value": "public-edge-b"
}
]
}
},
"AuroraGlobalVPC10100016vpcPrivateSubnet1": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "AuroraGlobalVPC10100016vpc"
},
"CidrBlock": "10.10.11.0/24",
"AvailabilityZone": "us-east-1a",
"MapPublicIpOnLaunch": false,
"Tags": [
{
"Key": "Name",
"Value": "private-app-a"
}
]
}
},
"AuroraGlobalVPC10100016vpcPrivateSubnet2": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "AuroraGlobalVPC10100016vpc"
},
"CidrBlock": "10.10.12.0/24",
"AvailabilityZone": "us-east-1b",
"MapPublicIpOnLaunch": false,
"Tags": [
{
"Key": "Name",
"Value": "private-app-b"
}
]
}
},
"AuroraGlobalVPC10100016vpcPrivateSubnet3": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "AuroraGlobalVPC10100016vpc"
},
"CidrBlock": "10.10.21.0/24",
"AvailabilityZone": "us-east-1a",
"MapPublicIpOnLaunch": false,
"Tags": [
{
"Key": "Name",
"Value": "private-data-a"
}
]
}
},
"AuroraGlobalVPC10100016vpcPrivateSubnet4": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "AuroraGlobalVPC10100016vpc"
},
"CidrBlock": "10.10.22.0/24",
"AvailabilityZone": "us-east-1b",
"MapPublicIpOnLaunch": false,
"Tags": [
{
"Key": "Name",
"Value": "private-data-b"
}
]
}
},
"AuroraGlobalVPC10100016vpcInternetGateway": {
"Type": "AWS::EC2::InternetGateway",
"Properties": {
"Tags": [
{
"Key": "Name",
"Value": "saa-aurora-vpc-igw"
}
]
}
},
"AuroraGlobalVPC10100016vpcGatewayAttachment": {
"Type": "AWS::EC2::VPCGatewayAttachment",
"Properties": {
"VpcId": {
"Ref": "AuroraGlobalVPC10100016vpc"
},
"InternetGatewayId": {
"Ref": "AuroraGlobalVPC10100016vpcInternetGateway"
}
}
},
"AuroraGlobalVPC10100016vpcPublicRouteTable": {
"Type": "AWS::EC2::RouteTable",
"Properties": {
"VpcId": {
"Ref": "AuroraGlobalVPC10100016vpc"
},
"Tags": [
{
"Key": "Name",
"Value": "saa-aurora-vpc-public-rt"
}
]
}
},
"AuroraGlobalVPC10100016vpcPublicRoute": {
"Type": "AWS::EC2::Route",
"DependsOn": [
"AuroraGlobalVPC10100016vpcGatewayAttachment"
],
"Properties": {
"RouteTableId": {
"Ref": "AuroraGlobalVPC10100016vpcPublicRouteTable"
},
"DestinationCidrBlock": "0.0.0.0/0",
"GatewayId": {
"Ref": "AuroraGlobalVPC10100016vpcInternetGateway"
}
}
},
"AuroraGlobalVPC10100016vpcPublicSubnet1RTA": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Properties": {
"SubnetId": {
"Ref": "AuroraGlobalVPC10100016vpcPublicSubnet1"
},
"RouteTableId": {
"Ref": "AuroraGlobalVPC10100016vpcPublicRouteTable"
}
}
},
"AuroraGlobalVPC10100016vpcPublicSubnet2RTA": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Properties": {
"SubnetId": {
"Ref": "AuroraGlobalVPC10100016vpcPublicSubnet2"
},
"RouteTableId": {
"Ref": "AuroraGlobalVPC10100016vpcPublicRouteTable"
}
}
},
"AuroraGlobalVPC10100016vpcNatEIP": {
"Type": "AWS::EC2::EIP",
"DependsOn": [
"AuroraGlobalVPC10100016vpcGatewayAttachment"
],
"Properties": {
"Domain": "vpc"
}
},
"AuroraGlobalVPC10100016vpcNatGateway": {
"Type": "AWS::EC2::NatGateway",
"Properties": {
"AllocationId": {
"Fn::GetAtt": [
"AuroraGlobalVPC10100016vpcNatEIP",
"AllocationId"
]
},
"SubnetId": {
"Ref": "AuroraGlobalVPC10100016vpcPublicSubnet1"
},
"Tags": [
{
"Key": "Name",
"Value": "saa-aurora-vpc-nat"
}
]
}
},
"AuroraGlobalVPC10100016vpcPrivateRouteTable": {
"Type": "AWS::EC2::RouteTable",
"Properties": {
"VpcId": {
"Ref": "AuroraGlobalVPC10100016vpc"
},
"Tags": [
{
"Key": "Name",
"Value": "saa-aurora-vpc-private-rt"
}
]
}
},
"AuroraGlobalVPC10100016vpcPrivateRoute": {
"Type": "AWS::EC2::Route",
"Properties": {
"RouteTableId": {
"Ref": "AuroraGlobalVPC10100016vpcPrivateRouteTable"
},
"DestinationCidrBlock": "0.0.0.0/0",
"NatGatewayId": {
"Ref": "AuroraGlobalVPC10100016vpcNatGateway"
}
}
},
"AuroraGlobalVPC10100016vpcPrivateSubnet1RTA": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Properties": {
"SubnetId": {
"Ref": "AuroraGlobalVPC10100016vpcPrivateSubnet1"
},
"RouteTableId": {
"Ref": "AuroraGlobalVPC10100016vpcPrivateRouteTable"
}
}
},
"AuroraGlobalVPC10100016vpcPrivateSubnet2RTA": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Properties": {
"SubnetId": {
"Ref": "AuroraGlobalVPC10100016vpcPrivateSubnet2"
},
"RouteTableId": {
"Ref": "AuroraGlobalVPC10100016vpcPrivateRouteTable"
}
}
},
"AuroraGlobalVPC10100016vpcPrivateSubnet3RTA": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Properties": {
"SubnetId": {
"Ref": "AuroraGlobalVPC10100016vpcPrivateSubnet3"
},
"RouteTableId": {
"Ref": "AuroraGlobalVPC10100016vpcPrivateRouteTable"
}
}
},
"AuroraGlobalVPC10100016vpcPrivateSubnet4RTA": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Properties": {
"SubnetId": {
"Ref": "AuroraGlobalVPC10100016vpcPrivateSubnet4"
},
"RouteTableId": {
"Ref": "AuroraGlobalVPC10100016vpcPrivateRouteTable"
}
}
},
"AuroraGlobalVPC10100016vpcDbSubnetGroup": {
"Type": "AWS::RDS::DBSubnetGroup",
"Properties": {
"DBSubnetGroupDescription": "Private subnets for saa-aurora-vpc",
"SubnetIds": [
{
"Ref": "AuroraGlobalVPC10100016vpcPrivateSubnet1"
},
{
"Ref": "AuroraGlobalVPC10100016vpcPrivateSubnet2"
},
{
"Ref": "AuroraGlobalVPC10100016vpcPrivateSubnet3"
},
{
"Ref": "AuroraGlobalVPC10100016vpcPrivateSubnet4"
}
],
"Tags": [
{
"Key": "Name",
"Value": "saa-aurora-vpc-db-subnet-group"
}
]
}
},
"APIALBelb": {
"Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
"Properties": {
"Name": "saa-aurora-api-alb",
"Type": "application",
"Scheme": "internet-facing",
"IpAddressType": "ipv4",
"Subnets": [
{
"Ref": "AuroraGlobalVPC10100016vpcPublicSubnet1"
},
{
"Ref": "AuroraGlobalVPC10100016vpcPublicSubnet2"
}
],
"SecurityGroups": [
{
"Ref": "AuroraGlobalVPC10100016vpcedgewebsgSecurityGroup"
}
]
}
},
"APITaskfargate": {
"Type": "AWS::ECS::TaskDefinition",
"DependsOn": [
"TaskRoleiam"
],
"Properties": {
"Family": "saa-aurora-api",
"Cpu": "512",
"Memory": "1024",
"NetworkMode": "awsvpc",
"RequiresCompatibilities": [
"FARGATE"
],
"ExecutionRoleArn": {
"Fn::GetAtt": [
"TaskRoleiam",
"Arn"
]
},
"TaskRoleArn": {
"Fn::GetAtt": [
"TaskRoleiam",
"Arn"
]
}
}
},
"TaskRoleiam": {
"Type": "AWS::IAM::Role",
"Properties": {
"RoleName": "saa-aurora-task-exec-role",
"Description": "ECS task execution role for Fargate.",
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs-tasks.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
},
"ManagedPolicyArns": [
"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
]
}
},
"AuroraGlobalaurora": {
"Type": "AWS::RDS::DBCluster",
"Properties": {
"DBClusterIdentifier": "saa-global-aurora",
"Engine": "aurora-postgresql",
"EngineVersion": "16.2",
"VpcSecurityGroupIds": [
{
"Ref": "AuroraGlobalVPC10100016vpcdatastoresgSecurityGroup"
}
],
"MasterUsername": "globaladmin",
"ManageMasterUserPassword": true,
"StorageEncrypted": true,
"BackupRetentionPeriod": 7,
"DBSubnetGroupName": {
"Ref": "AuroraGlobalVPC10100016vpcDbSubnetGroup"
}
}
},
"LagAlarmcloudwatch": {
"Type": "AWS::CloudWatch::Alarm",
"Properties": {
"AlarmName": "saa-aurora-replica-lag",
"AlarmDescription": "Alert on Aurora Global DB replication lag.",
"Namespace": "AWS/RDS",
"MetricName": "AuroraGlobalDBReplicatedWriteIO",
"Statistic": "Sum",
"Period": 60,
"EvaluationPeriods": 2,
"Threshold": 100000,
"ComparisonOperator": "GreaterThanOrEqualToThreshold",
"TreatMissingData": "notBreaching"
}
}
}
}Generated by TheArchitect from the diagram above. Review values such as names, CIDR ranges and instance sizes before deploying to your account.
Related templates
- Twitter/X Scale TestCloudFront behavior split, API Gateway VPC Link, public/internal ALBs, private app/data subnets, queues, media, and data stores
- Fargate Spot Containers (70 % cheaper)ECS with FARGATE_SPOT capacity provider — up to 70 % savings over on-demand Fargate. SQS-driven task scaling with graceful SIGTERM handling for Spot interruptions.
- Media Transcode PipelineS3 upload triggers a Lambda dispatcher that enqueues SQS jobs consumed by auto-scaled Fargate workers. Renditions are served via CloudFront.