Detection

File upload triggered 403 Forbidden. Console showed repeated Failed to load resource: status 403 errors. Network tab confirmed CloudFront returning "Request blocked."

Console: 403 errors on PDF upload

Network: CloudFront "Request blocked"

Root Cause Analysis

1. CloudFront — HTTP Method Restriction
Default behavior only allowed GET / HEAD. File upload POST was rejected at the CDN layer.

2. WAF — SizeRestrictions_BODY Rule
AWSManagedRulesCommonRuleSet blocks request bodies exceeding 8KB. PDF uploads exceed this threshold.

Resolution

Fix 1: Updated CloudFront behavior for /api/* to allow GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE.

Fix 2: Changed SizeRestrictions_BODY from Block to Count.

CloudFront: Allowed HTTP Methods

WAF: SizeRestrictions_BODY → Count

Result

File uploads working correctly. PDF syllabus files now pass through CloudFront and WAF to reach the backend successfully.

Detection

In v1, EC2 was directly exposed with a public IP. Nginx logs revealed bot scanning within minutes:

47.91.97.187 - "GET /gy8D HTTP/1.1" 400 - "Go-http-client/1.1"
47.91.97.187 - "GET /VYBk HTTP/1.1" 200 - "Go-http-client/1.1"

[crit] SSL_read() failed (SSL: error:0A0001BB:SSL routines::bad record type)
  client: 47.91.97.187, server: 0.0.0.0:443

64.62.197.2 - "GET /geoserver/web/ HTTP/1.1" 200
64.62.197.2 - "GET /.git/config HTTP/1.1" 200

v1 Response

Addressed at the Nginx level — details in GitHub Issue #26. But the root problem remained: server was directly exposed to the internet.

Plan A: Private Subnet + Bastion Host

Considered isolating into a Private Subnet — requiring 3 EC2 instances + NAT Gateway.

Problem: Cost Explosion

Plan A: Private Subnet (3 EC2 + NAT GW)
  EC2 t2.small × 3               ~$51.00
  NAT Gateway ($0.045/hr × 730h) ~$32.85
  NAT Data Processing             ~$2-5
  CloudFront                      ~$1
  Route 53                        ~$0.50
  Total                        ~$88-91/month

NAT Gateway alone (~$32.85/month) exceeded the entire v1 budget. Not viable for a student project.

Plan B (Adopted): Single EC2 + CloudFront + WAF

Kept all containers on 1 EC2 and added CloudFront + WAF as the security layer:

• CloudFront — hides origin EC2 IP
• AWS WAF — blocks scanning patterns
• Security Group — only accepts CloudFront IPs

Plan B: Single EC2 + WAF (Adopted)
  EC2 t2.small × 1               ~$17.00
  CloudFront                      ~$1
  Route 53                        ~$0.50
  WAF (Web ACL + rules)           ~$8
  Total                         ~$27/month

Plan A: 3 EC2 + NAT GW (~$88/mo)

Plan B: 1 EC2 + WAF (~$27/mo)

Result

Scanning bots blocked at WAF layer. EC2 no longer directly accessible. Cost stayed at ~$27/month — 70% savings vs Plan A.

Docker Containerization

Containerized all services (Frontend Nginx, FastAPI backend, Redis, MySQL) with Docker for consistent deployment across environments.

GitHub Actions CI/CD

Automated build → push to ECR → deploy to ECS pipeline. Every push to main triggers automatic deployment with zero downtime.

AWS CloudFormation

Provisioned and managed entire AWS infrastructure (EC2/ECS, CloudFront, WAF, Route 53) using CloudFormation templates for reproducible, version-controlled environments.