TheArchitect

Hybrid Connectivity

AWS architecture template · SAA-C03: Direct Connect → private VPC → EC2 + RDS (on-premises extension)

Hybrid Connectivity is a free AWS architecture template built with Direct Connect, EC2 and RDS. Open it in TheArchitect to edit the diagram, estimate monthly cost, and export the CloudFormation or Terraform that deploys it.

Open in TheArchitect All templates
Private app A/BPrivate data A/BHybrid VPC 10.10.0.0/16Direct ConnectApp InstancePostgreSQL DB
Hybrid Connectivity architecture diagram

AWS services in this template

  • Direct Connect
  • EC2
  • RDS

Deployment notes

Reference

  • Direct Connect requires physical cross-connect provisioning — it cannot be created by CloudFormation alone.
  • EC2 and RDS resources are deployable; the DX connection is the reference anchor.

Generated CloudFormation — 18 resources

Logical IDResource type
DirectConnectdirectconnectAWS::DirectConnect::Connection
HybridVPC10100016vpcAWS::EC2::VPC
HybridVPC10100016vpcappruntimesgSecurityGroupAWS::EC2::SecurityGroup
HybridVPC10100016vpcdatastoresgSecurityGroupAWS::EC2::SecurityGroup
HybridVPC10100016vpcdatastoresgSecurityGroupIngressRuleAWS::EC2::SecurityGroupIngress
HybridVPC10100016vpcPrivateSubnet1AWS::EC2::Subnet
HybridVPC10100016vpcPrivateSubnet2AWS::EC2::Subnet
HybridVPC10100016vpcPrivateSubnet3AWS::EC2::Subnet
HybridVPC10100016vpcPrivateSubnet4AWS::EC2::Subnet
HybridVPC10100016vpcPrivateRouteTableAWS::EC2::RouteTable
HybridVPC10100016vpcPrivateSubnet1RTAAWS::EC2::SubnetRouteTableAssociation
HybridVPC10100016vpcPrivateSubnet2RTAAWS::EC2::SubnetRouteTableAssociation
HybridVPC10100016vpcPrivateSubnet3RTAAWS::EC2::SubnetRouteTableAssociation
HybridVPC10100016vpcPrivateSubnet4RTAAWS::EC2::SubnetRouteTableAssociation
HybridVPC10100016vpcDbSubnetGroupAWS::RDS::DBSubnetGroup
AppInstanceec2AWS::EC2::Instance
PostgreSQLDBrdsAWS::RDS::DBInstance
PostgreSQLDBrdsIngressSGAWS::EC2::SecurityGroup
View the full CloudFormation template
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Generated by TheArchitect — https://www.thecloudarchitect.dev",
  "Metadata": {
    "TheArchitect": {
      "Edges": [
        {
          "From": "AppInstanceec2",
          "To": "PostgreSQLDBrds",
          "Label": "SQL"
        }
      ]
    }
  },
  "Resources": {
    "DirectConnectdirectconnect": {
      "Type": "AWS::DirectConnect::Connection",
      "Properties": {
        "ConnectionName": "saa-hybrid-dx",
        "Bandwidth": "1Gbps",
        "Location": "EqSE2"
      }
    },
    "HybridVPC10100016vpc": {
      "Type": "AWS::EC2::VPC",
      "Properties": {
        "CidrBlock": "10.10.0.0/16",
        "EnableDnsHostnames": true,
        "EnableDnsSupport": true,
        "Tags": [
          {
            "Key": "Name",
            "Value": "saa-hybrid-vpc"
          }
        ]
      }
    },
    "HybridVPC10100016vpcappruntimesgSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupName": "app-runtime-sg",
        "GroupDescription": "App tier from on-premises CIDR",
        "VpcId": {
          "Ref": "HybridVPC10100016vpc"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "app-runtime-sg"
          }
        ],
        "SecurityGroupIngress": [
          {
            "IpProtocol": "tcp",
            "FromPort": 8080,
            "ToPort": 8080,
            "CidrIp": "192.168.0.0/16"
          }
        ],
        "SecurityGroupEgress": [
          {
            "IpProtocol": "-1",
            "CidrIp": "0.0.0.0/0"
          }
        ]
      }
    },
    "HybridVPC10100016vpcdatastoresgSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupName": "data-store-sg",
        "GroupDescription": "DB access from app tier",
        "VpcId": {
          "Ref": "HybridVPC10100016vpc"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "data-store-sg"
          }
        ],
        "SecurityGroupEgress": [
          {
            "IpProtocol": "-1",
            "CidrIp": "0.0.0.0/0"
          }
        ]
      }
    },
    "HybridVPC10100016vpcdatastoresgSecurityGroupIngressRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": {
          "Ref": "HybridVPC10100016vpcdatastoresgSecurityGroup"
        },
        "IpProtocol": "tcp",
        "FromPort": 5432,
        "ToPort": 5432,
        "SourceSecurityGroupId": {
          "Ref": "HybridVPC10100016vpcappruntimesgSecurityGroup"
        }
      }
    },
    "HybridVPC10100016vpcPrivateSubnet1": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": {
          "Ref": "HybridVPC10100016vpc"
        },
        "CidrBlock": "10.10.11.0/24",
        "AvailabilityZone": "us-east-1a",
        "MapPublicIpOnLaunch": false,
        "Tags": [
          {
            "Key": "Name",
            "Value": "private-app-a"
          }
        ]
      }
    },
    "HybridVPC10100016vpcPrivateSubnet2": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": {
          "Ref": "HybridVPC10100016vpc"
        },
        "CidrBlock": "10.10.12.0/24",
        "AvailabilityZone": "us-east-1b",
        "MapPublicIpOnLaunch": false,
        "Tags": [
          {
            "Key": "Name",
            "Value": "private-app-b"
          }
        ]
      }
    },
    "HybridVPC10100016vpcPrivateSubnet3": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": {
          "Ref": "HybridVPC10100016vpc"
        },
        "CidrBlock": "10.10.21.0/24",
        "AvailabilityZone": "us-east-1a",
        "MapPublicIpOnLaunch": false,
        "Tags": [
          {
            "Key": "Name",
            "Value": "private-data-a"
          }
        ]
      }
    },
    "HybridVPC10100016vpcPrivateSubnet4": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": {
          "Ref": "HybridVPC10100016vpc"
        },
        "CidrBlock": "10.10.22.0/24",
        "AvailabilityZone": "us-east-1b",
        "MapPublicIpOnLaunch": false,
        "Tags": [
          {
            "Key": "Name",
            "Value": "private-data-b"
          }
        ]
      }
    },
    "HybridVPC10100016vpcPrivateRouteTable": {
      "Type": "AWS::EC2::RouteTable",
      "Properties": {
        "VpcId": {
          "Ref": "HybridVPC10100016vpc"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "saa-hybrid-vpc-private-rt"
          }
        ]
      }
    },
    "HybridVPC10100016vpcPrivateSubnet1RTA": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "SubnetId": {
          "Ref": "HybridVPC10100016vpcPrivateSubnet1"
        },
        "RouteTableId": {
          "Ref": "HybridVPC10100016vpcPrivateRouteTable"
        }
      }
    },
    "HybridVPC10100016vpcPrivateSubnet2RTA": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "SubnetId": {
          "Ref": "HybridVPC10100016vpcPrivateSubnet2"
        },
        "RouteTableId": {
          "Ref": "HybridVPC10100016vpcPrivateRouteTable"
        }
      }
    },
    "HybridVPC10100016vpcPrivateSubnet3RTA": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "SubnetId": {
          "Ref": "HybridVPC10100016vpcPrivateSubnet3"
        },
        "RouteTableId": {
          "Ref": "HybridVPC10100016vpcPrivateRouteTable"
        }
      }
    },
    "HybridVPC10100016vpcPrivateSubnet4RTA": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "SubnetId": {
          "Ref": "HybridVPC10100016vpcPrivateSubnet4"
        },
        "RouteTableId": {
          "Ref": "HybridVPC10100016vpcPrivateRouteTable"
        }
      }
    },
    "HybridVPC10100016vpcDbSubnetGroup": {
      "Type": "AWS::RDS::DBSubnetGroup",
      "Properties": {
        "DBSubnetGroupDescription": "Private subnets for saa-hybrid-vpc",
        "SubnetIds": [
          {
            "Ref": "HybridVPC10100016vpcPrivateSubnet1"
          },
          {
            "Ref": "HybridVPC10100016vpcPrivateSubnet2"
          },
          {
            "Ref": "HybridVPC10100016vpcPrivateSubnet3"
          },
          {
            "Ref": "HybridVPC10100016vpcPrivateSubnet4"
          }
        ],
        "Tags": [
          {
            "Key": "Name",
            "Value": "saa-hybrid-vpc-db-subnet-group"
          }
        ]
      }
    },
    "AppInstanceec2": {
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "InstanceType": "t3.medium",
        "Tags": [
          {
            "Key": "Name",
            "Value": "saa-hybrid-app"
          }
        ],
        "SubnetId": {
          "Ref": "HybridVPC10100016vpcPrivateSubnet1"
        },
        "SecurityGroupIds": [
          {
            "Ref": "HybridVPC10100016vpcappruntimesgSecurityGroup"
          }
        ],
        "MetadataOptions": {
          "HttpTokens": "required"
        }
      }
    },
    "PostgreSQLDBrds": {
      "Type": "AWS::RDS::DBInstance",
      "Properties": {
        "DBInstanceIdentifier": "saa-hybrid-appdb",
        "Engine": "postgres",
        "DBName": "appdb",
        "DBInstanceClass": "db.t4g.micro",
        "DBSubnetGroupName": {
          "Ref": "HybridVPC10100016vpcDbSubnetGroup"
        },
        "VPCSecurityGroups": [
          {
            "Ref": "HybridVPC10100016vpcdatastoresgSecurityGroup"
          },
          {
            "Ref": "PostgreSQLDBrdsIngressSG"
          }
        ],
        "PubliclyAccessible": false,
        "AllocatedStorage": "20",
        "MaxAllocatedStorage": 100,
        "StorageType": "gp3",
        "MasterUsername": "appadmin",
        "ManageMasterUserPassword": true,
        "StorageEncrypted": true,
        "BackupRetentionPeriod": 7
      }
    },
    "PostgreSQLDBrdsIngressSG": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "Allow connected compute to RDS postgres on port 5432",
        "SecurityGroupIngress": [
          {
            "IpProtocol": "tcp",
            "FromPort": 5432,
            "ToPort": 5432,
            "SourceSecurityGroupId": {
              "Ref": "HybridVPC10100016vpcappruntimesgSecurityGroup"
            }
          }
        ],
        "VpcId": {
          "Ref": "HybridVPC10100016vpc"
        }
      }
    }
  }
}

Generated by TheArchitect from the diagram above. Review values such as names, CIDR ranges and instance sizes before deploying to your account.

Related templates