Restrict the security group
Allow SSH only from your trusted administration IP. Allow 80/443 publicly; do not expose the NestJS, PostgreSQL, or Redis ports.
Important: Never use 0.0.0.0/0 for SSH, PostgreSQL, or Redis.
Connect with your key
Use the downloaded key file by path. Never paste private-key contents into a form or repository.
chmod 600 <identity-file>
ssh -i <identity-file> ubuntu@<elastic-ip>Patch and harden Ubuntu
Apply the production Ubuntu guide before installing the application runtime.
sudo apt update && sudo apt upgrade -yNote: Complete the SSH, UFW, and automatic-update steps in the linked Ubuntu guide.
Deploy the application
Choose the PM2 or Docker Compose guide and keep the application port bound to loopback behind Nginx.
curl -I http://127.0.0.1:<port>/healthAttach DNS and HTTPS
Point the domain at the Elastic IP, wait for DNS resolution, then provision TLS through Nginx.
dig +short <domain>
curl -I https://<domain>Add AWS operational safeguards
Use an IAM role instead of static AWS keys, enable detailed monitoring as needed, and configure EBS snapshots and billing alarms.
Note: Backups and monitoring are separate controls; neither replaces application health checks.
Final verification
- ✓ SSH is limited to approved source IPs
- ✓ Only ports 80 and 443 are publicly reachable for the app
- ✓ The domain resolves to the intended AWS address
- ✓ HTTPS and the application health endpoint succeed
- ✓ The instance uses an IAM role rather than stored AWS access keys