三层子网实战：公网 ALB、私网应用与隔离数据库

客户端 → IGW → 公网 ALB:443 → local → 私网 EC2:8080 → local → RDS:5432
客户端 ← IGW ← ALB ← EC2 响应（不走 NAT）
EC2 主动出网 → 同 AZ 的 NAT → IGW → 公网服务

export SOURCE_ROOT="$PWD"
export LAB_DIR="$HOME/three-tier-lab"
mkdir -m 700 "$LAB_DIR"  # 使用不存在的新目录
cp static/examples/aws-three-tier/* "$LAB_DIR/"
cd "$LAB_DIR"
python3 -m venv .venv
.venv/bin/pip install --require-hashes -r "$SOURCE_ROOT/static/examples/enterprise-orders/requirements.txt"

export AWS_REGION='us-east-1'  # 后续所有命令与配置保持一致
export ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
export ECR_REPOSITORY='three-tier-orders'  # 本例专属的新仓库名
aws ecr create-repository --repository-name "$ECR_REPOSITORY" --image-tag-mutability IMMUTABLE --image-scanning-configuration scanOnPush=true
export ECR_URI="${ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${ECR_REPOSITORY}"
# local-approved:release 必须是前述已验收的 amd64 镜像。
docker image inspect local-approved:release --format '{{.Architecture}}'
aws ecr get-login-password | docker login --username AWS --password-stdin "${ECR_URI%%/*}"
docker tag local-approved:release "$ECR_URI:release-1"
docker push "$ECR_URI:release-1"
aws ecr describe-images --repository-name "$ECR_REPOSITORY" --image-ids imageTag=release-1 --query 'imageDetails[0].imageDigest' --output text

account_id          = "REPLACE_ACCOUNT_ID"
region              = "us-east-1"
name                = "orders-network-lab"
azs                 = ["us-east-1a", "us-east-1b"]
ami_id              = "REPLACE_APPROVED_AL2023_AMI"
certificate_arn     = "REPLACE_SAME_REGION_ACM_CERTIFICATE_ARN"
client_cidr         = "REPLACE_APPROVED_CLIENT_PUBLIC_IP/32"
orders_image        = "REPLACE_ECR_URI@sha256:REPLACE_64_HEX_DIGEST"
ecr_repository_arn  = "REPLACE_ECR_REPOSITORY_ARN"
db_engine_version   = "REPLACE_APPROVED_POSTGRES_17_MINOR"
final_snapshot_id   = "orders-network-lab-final-REPLACE_UNIQUE_SUFFIX"

aws sts get-caller-identity
terraform init
terraform fmt -check
terraform validate
terraform plan -out=create.tfplan
# 核对账号、CIDR、两 AZ、数据库不公开、无应用公网 IP 后执行。
terraform apply create.tfplan
terraform output -json lab > outputs.json
curl --fail --proto '=https' --tlsv1.2 https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem -o rds-ca.pem

cd "$LAB_DIR"
export INSTANCE_ID=$(jq -r '.instances | to_entries[0].value' outputs.json)
export DB_HOST=$(jq -r .db_host outputs.json)
jq -n --arg host "$DB_HOST" '{host:[$host],portNumber:["5432"],localPortNumber:["15432"]}' > tunnel.json
aws ssm start-session --target "$INSTANCE_ID" --document-name AWS-StartPortForwardingSessionToRemoteHost --parameters file://tunnel.json

cd "$LAB_DIR"
.venv/bin/python bootstrap.py --outputs outputs.json --source "$SOURCE_ROOT/static/examples/enterprise-orders" --secure-dir "$LAB_DIR/secrets" --ca rds-ca.pem

sudo systemctl enable --now three-tier.service
sudo systemctl status three-tier.service --no-pager
sudo docker ps

cd "$LAB_DIR"
export BASE_URL='https://REPLACE_CERTIFIED_TEST_HOST'
export TOKEN_FILE="$LAB_DIR/secrets/token"
export OTHER_TOKEN_FILE="$LAB_DIR/secrets/other-token"
.venv/bin/python "$SOURCE_ROOT/static/examples/enterprise-orders/tests/acceptance.py"
aws elbv2 describe-target-health --target-group-arn "$(jq -r .target_group outputs.json)"
aws ec2 describe-route-tables --route-table-ids "$(jq -r .data_route_table outputs.json)"