<p>You would put it ideally into a private subnet behind an AWS Load balancer of some sort. The benefit of this is that any security issues in your nginx installation are offloaded to AWS, therefore are no longer your concern.</p>
<p>Some detractions:</p>
<ul>
<li>slightly more complex setup</li>
<li>minimum cost of ~25USD per month for load balancer (minimum cost of around 25USD per 25 client certificates if you terminate them on Application Load Balancer)</li>
</ul>
<p>People would access the nginx servers via a jump/ bastion hosts. Access to this host would probably be limited by IP address and/or VPN.</p>
<p>The AWS provided NAT gateway does not allow inbound traffic, unless it was initiated by outbound traffic.</p>

CC BY-SA 4.0
2022-03-06T21:34:35.260Z
2022-03-06T21:34:35.260Z
jdog
<p>I want to put the <code>fargate</code> container which contains <code>django</code> + <code>nginx</code></p>
<p>However what subnet should be used for?</p>
<p>At first I put this in public subnet, of course it works well.</p>
<p>However, is it possible to put this in private subnet with <code>NAT gateway</code>?</p>
<p>If so, How can users access to the private subnet from outside?</p>
<p>A few users(admin) need to access to this django, it doesn't need to get access from other users.</p>

<amazon-web-services><fargate><aws-subnets>
Best practice put nginx + django in AWS subnet private?public?
Dekishigrash
# Best practice put nginx + django in AWS subnet private?public?

(Asked by: username_0 on 2022-03-06)

I want to put the `fargate` container which contains `django` + `nginx`

However what subnet should be used for?

At first I put this in public subnet, of course it works well.

However, is it possible to put this in private subnet with `NAT gateway`?

If so, How can users access to the private subnet from outside?

A few users(admin) need to access to this django, it doesn't need to get access from other users.

**Tags:** amazon-web-services, fargate, aws-subnets


---

## 1 answers

### Answer by username_1 on 2022-03-06. Score: 0

You would put it ideally into a private subnet behind an AWS Load balancer of some sort. The benefit of this is that any security issues in your nginx installation are offloaded to AWS, therefore are no longer your concern.

Some detractions:

* slightly more complex setup
* minimum cost of ~25USD per month for load balancer (minimum cost of around 25USD per 25 client certificates if you terminate them on Application Load Balancer)

People would access the nginx servers via a jump/ bastion hosts. Access to this host would probably be limited by IP address and/or VPN.

The AWS provided NAT gateway does not allow inbound traffic, unless it was initiated by outbound traffic.


---

