The AWS Region - High Availability (HA) Architecture is designed to provide a resilient, scalable, and fault-tolerant deployment of the miniOrange Identity Platform on AWS. The solution leverages multiple Availability Zones (Multi-AZ) within each AWS Region to ensure continuous service availability while supporting deployment across multiple geographic regions for improved global reach and disaster resilience.
Components:
- Application Load Balancer (ALB): Handles HTTP/HTTPS (80/443) traffic and distributes incoming web requests across the Identity Platform nodes.
- Network Load Balancer (NLB): Handles UDP-based authentication protocols such as RADIUS (1812/1813) and TACACS (10049), providing high-performance network traffic distribution.
- VPC – Primary Environment (Multi-AZ): Hosts multiple Identity Platform nodes across Availability Zones to ensure high availability.
- IDP Nodes (EC2): Each node includes:
- NGINX Reverse Proxy: Serves as the entry point for incoming requests.
- Apache Tomcat & miniOrange Identity Server: Hosts the core identity and access management services.
- Microservices: Deliver modular IAM functionality and background processing.
- Amazon ElastiCache (Redis): Provides distributed caching to improve application performance and reduce database load.
- Amazon RDS: Stores persistent identity, configuration, and application data with managed backups and high availability.
- Amazon MQ (RabbitMQ): Enables reliable communication between internal services and microservices.
- Supporting AWS Services:
- Amazon CloudWatch: Monitors infrastructure health, metrics, and alerts.
- Amazon S3: Stores backups, logs, and other application artifacts.
- Amazon SES: Handles transactional emails and user notifications.
Connectivity:
External client traffic is routed through dedicated AWS load balancers based on the protocol:
- 80 (HTTP) and 443 (HTTPS) are served through the Application Load Balancer (ALB).
- 1812 (UDP): RADIUS Authentication
- 1813 (UDP): RADIUS Accounting
- 10049 (UDP): TACACS
The Network Load Balancer (NLB) routes authentication traffic to the Identity Platform nodes. Internal communication between the application nodes and supporting services is maintained through secure private networking:
- 6379 (TCP): Amazon ElastiCache (Redis)
- Database Port (TCP): Amazon RDS
- 5672 (TCP): Amazon MQ (RabbitMQ)
Multi-Region Deployment:
The same HA architecture can be deployed across multiple AWS Regions, including United States, India, Europe, and Australia, providing regional redundancy, lower latency for geographically distributed users, and improved business continuity.
Use Case:
This architecture is ideal for enterprise and mission-critical deployments that require high availability, scalability, and reliable authentication services. By combining Multi-AZ deployment with managed AWS services and multi-region support, organizations can minimize downtime, improve performance, and maintain secure identity services for globally distributed users.
