Phase 12: EC2 deploy + self-hosted Kafka; RDS becomes private

[Poojithvsc]

What to build

Extend the Terraform to provision an EC2 instance that pulls poojithvsc/shopsphere:latest from Docker Hub via user-data, runs the app + Kafka as compose services, and connects to the Phase-11 RDS. RDS posture flips to private: publicly_accessible = false, security group now allows inbound only from the EC2's security group — proven by attempting psql from the laptop and getting a connection timeout. The full QA walkthrough runs end-to-end against http://<ec2-public-ip>:8080.

HITL — needs a Whizlabs lab session.

Full design in PLAN-002 §Phase 12.

Acceptance criteria

• Terraform module under code/terraform/ec2/ (or extends rds/): provisions t3.micro Amazon Linux 2023, EC2 security group, IAM instance profile (no SSM permissions yet)
• EC2 user-data installs Docker + docker-compose, writes compose.cloud.yml (app + Kafka), pulls poojithvsc/shopsphere:latest, brings up the stack
• RDS module updated: publicly_accessible = false, SG now allows ingress only from the EC2's SG (not laptop IP)
• terraform apply provisions RDS + EC2 in one apply
• App reachable at http://<ec2-public-ip>:8080/swagger-ui.html
• RDS is private — verified: psql -h <rds-endpoint> from the laptop times out
• QA walkthrough passes end-to-end against the EC2 endpoint
• Image is built locally and pushed to Docker Hub manually in this phase (Phase 19 automates push); document the manual push commands in the PR description
• terraform destroy cleans up both RDS and EC2
• mvn verify stays green
• ADR-0012 written (EC2 + self-hosted Kafka over MSK / Confluent Cloud; Docker Hub over ECR; RDS posture flip); books cited
• Article stub: articles/drafts/phase-12-ec2-deploy.md

Blocked by

• Phase 10: Containerize the app #53 (Phase 10 — needs the Dockerfile to build the image that EC2 pulls)
• Phase 11: RDS Postgres + connect local app to cloud DB #54 (Phase 11 — needs the RDS module to extend)

[Poojithvsc]

Lab run 2026-06-06 — deployed live, but RDS-private test deferred

The EC2 deploy was run on live AWS (Whizlabs Cloud Sandbox). Proven live:

• ✅ EC2 + self-hosted Kafka (compose) + app, all healthy on the box
• ✅ App reachable; HTTP QA passed end-to-end: register → login → cart → checkout (4242) → order PAID; declined card (4000…0002) → CANCELLED with stock released
• ✅ terraform destroy clean

Deferred (this AC is NOT met):

• ⏸️ RDS becomes private + the laptop-psql-must-time-out negative test. The sandbox denies RDS entirely (even rds:Describe), so Postgres ran as a container on the EC2 behind a new use_rds toggle. A co-located container has no separate network boundary, so the negative test is meaningless against it. The use_rds=true RDS path is written and terraform validate-clean — it just hasn't run on RDS-capable AWS.

Why this stays open: per XP "done means done" and the project's no-overclaim rule, I won't close #58 while its headline lesson (managed private DB behind a network boundary) is unproven live. Closing waits for RDS-capable AWS — the guided "EC2+RDS Terraform" lab after its 24h attempt reset, or own-AWS. See ADR-0012 (use_rds fallback section) and the session log 2026-06-06-phase-12-20-lab-run.

Deploy code is merged to dev (80387d7) and rides to main in the Phase-20 release PR; only the live RDS-private verification remains here.

[Poojithvsc]

Reopened — this was auto-closed when PR #80 merged, but that's incorrect. #58's headline acceptance criterion (RDS becomes private, proven by the laptop-psql-must-time-out negative test) has not been exercised on live AWS — the lab sandbox denies RDS, so Postgres ran as a container behind use_rds=false. The use_rds=true RDS path is terraform validate-clean but unrun. Per "done means done", #58 stays open until that negative test runs on RDS-capable AWS (the guided "EC2+RDS Terraform" lab after its attempt reset, or own-AWS). All other Phase-12 criteria are proven and merged to main via #80.