You log in · EC2 + RDS MySQL

10 steps from your browser to the database and back.

Runs on

EC2 ECS on Fargate Lambda

Database

RDS MySQL DynamoDB

Action

Add-ons

Background job Live updates

No background job: logging in doesn't change any todos. Try Create, Update or Delete.

Text version of this diagram.

What sits where:

AWS Region · us-east-1: A Region is a part of the world where AWS has data centers. Most things you build live in one Region. us-east-1 is in northern Virginia. contains:
- VPC: Virtual private cloud: your own private network inside AWS. Nothing gets in or out except the ways you allow. contains:
  - Public subnet · to IGW: A slice of the VPC that can reach the internet directly, through the internet gateway (IGW). contains:
    - EC2 instance (runs the web app): A virtual server you rent from AWS. You pick its size and operating system, and you look after it.
  - Private subnet · no internet: A slice of the VPC with no route to the internet at all. Nothing here can be reached from outside. contains:
    - RDS MySQL (database: todoio): A MySQL database that AWS runs for you, including the server, patches and backups. todoio is the database's name.
  - Internet gateway (the VPC's door): The door between a VPC and the internet. Without one, nothing in the VPC can talk to the internet directly.
- API Gateway (WebSocket API · live line): The front door for the app's web requests. A WebSocket API keeps a connection open, so the server can push updates to your browser instantly.
- CloudWatch Logs (app log lines): Collects the lines your app writes about what it's doing (its logs), so you can search them later.
Your browser (on the internet)

Steps, in order:

You log in. Path: Your browser. Your browser sends POST /login over HTTPS.
Into the VPC. Path: Your browser → Internet gateway. todo.io points at the instance's public IP, so the request comes in through the VPC's internet gateway. The public IP changes if the instance is stopped and started (an Elastic IP stays put), so the DNS record has to follow it. In Level 2 todo.io points at a load balancer's DNS name instead, which never changes.
Through the firewall. Path: Internet gateway → EC2 instance. The security group around the instance allows HTTPS on port 443, so the request reaches the web server. Checks: security-group: todo-app-sg: TCP 443 from 0.0.0.0/0 → allow.
Read the form. Path: EC2 instance. The app reads your email and password. You're a customer of Todo.io, not an IAM user, so AWS has no idea who you are.
Ask the database. Path: EC2 instance → RDS MySQL. The app sends SQL to RDS MySQL in the private subnet on port 3306. It logs in with a database username and password, not with IAM. Checks: security-group: todo-db-sg: TCP 3306 from todo-app-sg → allow; mysql: MySQL user todo_app: SELECT on todoio.users → allow.
The database answers. Path: RDS MySQL → EC2 instance. MySQL returns your user row, including the stored password hash.
Check the password. Path: EC2 instance. The app hashes the password you typed and compares it with the stored hash. They match, so it starts a session for you. Checks: app: Password hash matches → allow.
Back to you. Path: EC2 instance → Internet gateway → Your browser. You get 200 OK plus a session cookie, so your next requests prove who you are.
Open the live line. Path: Your browser → API Gateway. Now that you are logged in, your browser opens a WebSocket to API Gateway. It stays open, and the app saves its connection id against your user.
Leave a note. Path: EC2 instance → Internet gateway → CloudWatch Logs. The app's log line goes to CloudWatch Logs so Todo.io's engineers can see what happened. Like SQS, it's a public AWS service, so it leaves through the internet gateway.

Step 1 of 10

Your browser sends POST /login over HTTPS.

Show me the real thing

The HTTP request

POST /login HTTP/1.1
Host: todo.io
Content-Type: application/json

{"email":"sam@example.com","password":"••••••••"}

todo.io points at the instance's public IP, so the request comes in through the VPC's internet gateway. The public IP changes if the instance is stopped and started (an Elastic IP stays put), so the DNS record has to follow it. In Level 2 todo.io points at a load balancer's DNS name instead, which never changes.
Exam tipA subnet is "public" only because its route table sends 0.0.0.0/0 to an internet gateway. Nothing else makes it public.
The security group around the instance allows HTTPS on port 443, so the request reaches the web server.
- 🛡Security group todo-app-sg: TCP 443 from 0.0.0.0/0Allowed
Show me the real thing
Inbound rules on todo-app-sg
```
Type    Protocol  Port  Source
HTTPS   TCP       443   0.0.0.0/0
```
Exam tipThe classic way to do HTTPS is a free AWS Certificate Manager (ACM) certificate on a load balancer or CloudFront (Level 2). Since 2025 ACM can also sell you an exportable certificate to install on the instance or container itself.
The app reads your email and password. You're a customer of Todo.io, not an IAM user, so AWS has no idea who you are.
Exam tipYour app's customers are never IAM principals. IAM is for the people and software that manage or call AWS itself.
The app sends SQL to RDS MySQL in the private subnet on port 3306. It logs in with a database username and password, not with IAM.
- 🛡Security group todo-db-sg: TCP 3306 from todo-app-sgAllowed
- 🗄MySQL MySQL user todo_app: SELECT on todoio.usersAllowed
Show me the real thing
The SQL (real code sends the values as parameters, never pasted into the string)
```
SELECT id, password_hash FROM users WHERE email = 'sam@example.com';
```
Exam tipA security group rule can use another security group as its source: "anything wearing todo-app-sg may connect". Exam favourite.
MySQL returns your user row, including the stored password hash.
The app hashes the password you typed and compares it with the stored hash. They match, so it starts a session for you.
- ✓App Password hash matchesAllowed
You get 200 OK plus a session cookie, so your next requests prove who you are.
Show me the real thing
The HTTP response
```
HTTP/1.1 200 OK
Set-Cookie: session=eyJ1c2VySWQiOiJ1LTEyMyJ9.Zm9v; HttpOnly; Secure
```
Exam tipSecurity groups are stateful: a reply to an allowed request goes back out automatically. No outbound rule needed for it.
Now that you are logged in, your browser opens a WebSocket to API Gateway. It stays open, and the app saves its connection id against your user.
Show me the real thing
The WebSocket handshake
```
GET /prod HTTP/1.1
Host: ws123.execute-api.us-east-1.amazonaws.com
Upgrade: websocket
Connection: Upgrade

→ API Gateway assigns connection id Ab3xYzEXAMPLE=
```
Exam tipAn API Gateway WebSocket API has $connect, $disconnect and $default routes. Each one can call Lambda or an HTTP backend.
The app's log line goes to CloudWatch Logs so Todo.io's engineers can see what happened. Like SQS, it's a public AWS service, so it leaves through the internet gateway.
Show me the real thing
The log line
```
2026-10-11T18:42:07Z INFO POST /login user=u-123 status=200 14ms
```
Exam tipEC2 doesn't send logs by itself. You install the CloudWatch agent and give the instance role permission to write logs.

What to notice

You run the server. Patching, scaling and the HTTPS certificate are your job. One instance in one Availability Zone is a single point of failure (Level 2 adds a load balancer and a second AZ).
IAM never checked your SQL. MySQL has its own users; IAM only manages the database server itself.
The database sits in a private subnet with no route to the internet. Only the security groups you allowed can reach it.
The database password lives in the app config here. In production it belongs in Secrets Manager (Level 1).
A WebSocket stays open, so the server side can send you updates without you asking.
You, the customer, were never an IAM user. IAM controls the app, not its customers.