This project involved deploying the open‑source analytics tool Metabase on Amazon ECS using the Fargate launch type and securely integrating it with a PostgreSQL database hosted on Amazon RDS. The implementation was designed to operate within a controlled VPC environment while exposing the Metabase interface to permitted external users through an Application Load Balancer (ALB). The goal was to combine containerized application delivery with a managed database backend in a network architecture that ensured security, availability and maintainability.
The central challenge was to enable reliable, low‑latency communication between the ECS service and the RDS database while keeping the database inaccessible from the public internet. At the same time, the Metabase interface needed to be available externally to authorized users in a secure manner. This meant balancing strict network isolation with selective external exposure, a common architectural requirement in production‑grade AWS workloads.
The solution combined AWS managed services with carefully configured network controls. The database was placed in a private VPC subnet with inbound rules limited to the ECS security group. An Application Load Balancer in public subnets handled incoming HTTP requests to Metabase, routing them to ECS tasks running in the same VPC as the database. ECS Fargate provided the operational simplicity of serverless containers, while security groups and target groups enforced separation of concerns and clear traffic flows.
I provisioned a new Amazon RDS PostgreSQL instance within the default VPC, configuring the database engine, instance identifier, master username, password and database name to meet the application’s requirements. A dedicated security group was assigned to the instance with an inbound rule on TCP port 5432, using the ECS service’s security group as the source. This ensured only traffic from the ECS tasks could reach the database.
I created a new target group configured for IP‑based targets on port 3000, corresponding to Metabase’s default listening port. This target group was intended to register ECS tasks dynamically and act as the ALB’s routing destination. I then set up an Application Load Balancer in public subnets across multiple availability zones to maximize availability. I associated it with a security group allowing inbound HTTP traffic on port 80. The ALB’s listener was configured to forward incoming requests to the previously created target group.
In the Amazon ECS console, I defined a new Fargate‑based task definition using the metabase/metabase container image. The container definition exposed port 3000, and environment variables were set to pass the database connection parameters:
MB_DB_TYPE, MB_DB_DBNAME, MB_DB_PORT, MB_DB_USER, MB_DB_PASS, and MB_DB_HOST.
I allocated 1 vCPU and 3 GB of memory to ensure smooth application performance under expected load.
I verified that both the ECS tasks and the RDS instance were located in the same VPC to allow direct private‑IP communication without routing over the internet. This step was essential to meet the project’s security objectives.