DEV Community

Manthan Ankolekar
Manthan Ankolekar

Posted on

🚀 Deploying a Node.js CRUD App on AWS with Terraform

#node #aws #terraform #webdev

Managing cloud infrastructure manually can quickly become messy. Terraform allows us to define infrastructure as code (IaC), making deployments repeatable, version-controlled, and automated.

In this guide, we’ll build a Node.js CRUD API (with Express + MongoDB) and deploy it to AWS ECS Fargate using Terraform.

🧩 What We’re Building

  • A RESTful Todo API (CRUD endpoints with Express + MongoDB).
  • Dockerized app pushed to Amazon ECR.
  • AWS ECS Fargate service running containers in a managed VPC.
  • Application Load Balancer (ALB) to expose the service.
  • Secrets Manager for storing MongoDB credentials securely.
  • CloudWatch Logs for centralized logging.

Here’s the final architecture:

Client → ALB → ECS (Fargate Task) → MongoDB (Atlas/Local) ↑ CloudWatch (logs)
Enter fullscreen mode Exit fullscreen mode

🛠️ Tech Stack

Backend

  • Node.js + Express
  • MongoDB + Mongoose
  • CORS + dotenv

Infrastructure

  • Docker (containerization)
  • Terraform (IaC)
  • AWS ECR (image registry)
  • AWS ECS Fargate (orchestration)
  • AWS ALB (load balancing)
  • AWS Secrets Manager (secure DB credentials)
  • AWS IAM + Security Groups

📁 Project Structure

Your project is split into two main parts: app code and infra code.

manthanank-nodejs-terraform/ ├── server.js # Express entry ├── Dockerfile # Build container ├── config/db.js # Mongo connection ├── controllers/todoController.js ├── models/Todo.js ├── routes/todoRoutes.js ├── terraform/ # Infrastructure as Code │ ├── vpc.tf # VPC + networking │ ├── ecs.tf # ECS cluster/service │ ├── ecr.tf # ECR repo │ ├── iam.tf # IAM roles/policies │ ├── security.tf # Security groups │ ├── logs.tf # CloudWatch logs │ ├── secrets.tf # Secrets Manager │ ├── variables.tf # Config vars │ ├── outputs.tf # Useful outputs │ └── provider.tf # AWS provider setup
Enter fullscreen mode Exit fullscreen mode

📝 Step 1 — Build the Node.js API

Our CRUD endpoints live under /api/todos.
Example schema:

const todoSchema = new mongoose.Schema({ title: { type: String, required: true, trim: true }, description: { type: String, default: "" }, completed: { type: Boolean, default: false }, createdAt: { type: Date, default: Date.now }, });
Enter fullscreen mode Exit fullscreen mode

Start locally:

npm install npm run dev
Enter fullscreen mode Exit fullscreen mode

Test:

curl http://localhost:5000/api/todos
Enter fullscreen mode Exit fullscreen mode

📦 Step 2 — Dockerize the App

Dockerfile:

FROM node:18-alpine WORKDIR /app COPY package*.json ./ RUN npm ci --only=production COPY . . ENV PORT=5000 EXPOSE 5000 CMD ["node", "server.js"]
Enter fullscreen mode Exit fullscreen mode

Build locally:

docker build -t nodejs-todo-api . docker run -p 5000:5000 -e MONGO_URI=your_mongo_uri nodejs-todo-api
Enter fullscreen mode Exit fullscreen mode

☁️ Step 3 — Terraform AWS Infrastructure

Initialize 

cd terraform terraform init
Enter fullscreen mode Exit fullscreen mode

Key Resources

  • ECR — stores our container image (ecr.tf).
  • ECS Fargate Service — runs containers (ecs.tf).
  • ALB + Target Group — load balancing (ecs.tf).
  • VPC + Subnets — networking (vpc.tf).
  • IAM Roles — ECS execution permissions (iam.tf).
  • Secrets Manager — injects MONGO_URI securely (secrets.tf).
  • CloudWatch Logs — for application logs (logs.tf).

🐳 Step 4 — Push Image to ECR

  1. Create the repo: 
terraform apply -target=aws_ecr_repository.app -auto-approve
Enter fullscreen mode Exit fullscreen mode
  1. Build & push: 
AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) REGION=ap-south-1 REPO=$AWS_ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com/node-crud-app IMAGE_TAG=v1 docker build -t node-crud-app:$IMAGE_TAG . aws ecr get-login-password --region $REGION | \ docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com docker tag node-crud-app:$IMAGE_TAG $REPO:$IMAGE_TAG docker push $REPO:$IMAGE_TAG
Enter fullscreen mode Exit fullscreen mode

🚀 Step 5 — Deploy with Terraform

Apply the full infra:

terraform apply
Enter fullscreen mode Exit fullscreen mode

Grab the output:

terraform output alb_dns
Enter fullscreen mode Exit fullscreen mode

Test:

curl http://<alb_dns>/api/todos
Enter fullscreen mode Exit fullscreen mode

🔄 Step 6 — Deploy Updates

  1. Build and push a new image with IMAGE_TAG=v2.
  2. Update variables.tf → image_tag = "v2".
  3. Run: 
terraform apply -var="image_tag=v2"
Enter fullscreen mode Exit fullscreen mode

ECS performs a rolling update behind the ALB.

📊 Monitoring & Logs

  • CloudWatch Logs: All app logs stream automatically.
  • ALB Health Checks: Ensure tasks are healthy.
  • Troubleshooting: Check ECS task logs in CloudWatch if service won’t start.

🔒 Security Best Practices

  • Use private subnets + NAT Gateway in production.
  • Restrict Secrets Manager IAM role to a single secret ARN.
  • Use immutable image tags (v1, v2) instead of latest.
  • Enable HTTPS on ALB with ACM certificates.

🎯 Conclusion

With just a few .tf files, we’ve automated provisioning of:

  • Containerized Node.js API
  • Secure AWS networking & IAM
  • Load-balanced ECS service
  • Secrets and logs managed by AWS

This approach scales to any microservice — just add more services, modules, or CI/CD pipelines.

✨ Pro tip: Next step, integrate GitHub Actions or GitLab CI to automatically build/push Docker images and run terraform apply for full CI/CD.

🔗 GitHub Repository: manthanank/nodejs-terraform
🧑‍💻 Author: Manthan Ankolekar

Top comments (0)