<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>InfraHub - AWS Security & Privacy</title>
  <link
    rel="stylesheet"
    href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css"
  />
  <link rel="stylesheet" href="{{ url_for('pages.serve_css', filename='retro.css') }}">
</head>
<body>
  <!-- ===== HEADER ===== -->
  <header>
    <div class="header-inner">
      <div class="left">
        <img src="{{ url_for('pages.serve_png', filename='infrahublogo.png') }}" alt="InfraHub Logo" class="logo">
      </div>
      <nav>
        <ul class="navbar">
          <li><a href="{{ url_for('pages.index') }}"><i class="fa fa-house"></i> Home</a></li>
          <li><a href="{{ url_for('pages.aws') }}"><i class="fa"></i> AWS Knowledge</a></li>
          <li><a href="{{ url_for('pages.multi_cdn') }}"><i class="fa fa-network-wired"></i> Multi-CDN</a></li>
          <li><a href="{{ url_for('pages.s3_backend') }}"><i class="fa fa-database"></i> S3 Backend</a></li>
        </ul>
      </nav>
    </div>
  </header>

  <!-- ===== MAIN CONTENT ===== -->
  <main>
    <div class="container">
      <section id="executive-summary">
        <h2>Executive Summary</h2>
        <p>
          This section of InfraHub provides guidance and reference material for IT administrators and developers on securing 
          public-facing EC2 instances and containerized backends. It demonstrates how traffic can be safely routed through CDNs 
          like CloudFront and Fastly, how NGINX header validation can limit exposure, and how TLS encryption and edge-level 
          protections reduce risk. Operational strategies such as automated container refreshes, systemd management, and AMI 
          snapshots are explained as best practices for maintaining security and consistency. All insights are intended as 
          educational examples so readers can apply these concepts to their own AWS architectures, rather than InfraHub 
          providing a deployable system.
        </p>
      </section>

      <hr class="divider">

      <section id="security-goals">
        <h2>Security Goals & Challenges</h2>
        <ul>
          <li>Protect publicly reachable EC2 instances from direct exposure.</li>
          <li>Ensure only CDN-originated requests are served via NGINX header validation.</li>
          <li>Maintain TLS encryption from browser to CDN.</li>
          <li>Prevent DoS attacks at the edge.</li>
          <li>Automate secure deployments and container updates using CI/CD.</li>
          <li>Maintain privacy: no user data is collected, logged, or tracked.</li>
        </ul>
      </section>

      <section id="architecture">
        <h2>System Architecture & Security Controls</h2>
        <p>
          Traffic flows through Route 53, CloudFront, or Fastly, before reaching the EC2 backend. EC2 instances run a container stack:
          NGINX reverse proxy + Flask backend. Backup EC2 exists for manual failover.
        </p>
        <ul>
          <li>CDNs handle TLS termination, SSL enforcement, and edge-level DoS protection.</li>
          <li>NGINX validates special headers from CloudFront and Fastly; all other requests return 404.</li>
          <li>Containers isolate application code from the host environment, limiting attack surfaces.</li>
          <li>Systemd services automatically refresh containers and clear caches on reboot to prevent drift.</li>
          <li>AWS Systems Manager is used exclusively for access, avoiding SSH exposure.</li>
        </ul>
      </section>

      <section id="operational-security">
        <h2>Operational Security</h2>
        <p>
          Deployment and operations are designed to maintain consistency and security:
        </p>
        <ul>
          <li>AMI snapshots allow instant recovery of both production and backup EC2 instances.</li>
          <li>Containers are pulled fresh on reboot using systemd to prevent stale images.</li>
          <li>NGINX blocks all non-CDN traffic at the edge.</li>
          <li>Route 53 health checks and multi-CDN failover ensure uninterrupted service.</li>
          <li>GHCR tokens are securely stored in GitHub Secrets, preventing unauthorized access.</li>
        </ul>
      </section>

      <section id="privacy-accessibility">
        <h2>Privacy & Accessibility</h2>
        <ul>
          <li>No personal data is collected or logged; only pre-rendered/static content is served.</li>
          <li>Frontend is lightweight and readable on mobile and desktop devices.</li>
          <li>Health Check page uses simple HTML for clarity and accessibility, compatible with assistive technologies.</li>
        </ul>
      </section>

      <section id="limitations-future">
        <h2>Limitations & Future Work</h2>
        <ul>
          <li>EC2 remains publicly reachable; future work could include PrivateLink or private load balancer.</li>
          <li>Manual failover for backup EC2; future improvements could automate scaling and failover.</li>
          <li>IP-restricted security groups are currently impractical due to rotating CDN IP ranges.</li>
          <li>Deep observability is limited; structured logs, metrics, and error-budget tracking could be added.</li>
          <li>Potential migration to ECS for automated scaling, containerized backends, and independent S3 buckets for rapid recovery.</li>
        </ul>
      </section>

      <section id="references">
        <h2>References & Resources</h2>
        <ul>
          <li><a href="https://docs.aws.amazon.com/">AWS Documentation</a></li>
          <li><a href="https://docs.aws.amazon.com/s3/">Amazon S3 Documentation</a></li>
          <li><a href="https://docs.aws.amazon.com/cloudfront/">CloudFront Documentation</a></li>
          <li><a href="https://www.fastly.com/documentation/">Fastly Documentation</a></li>
          <li>M. Wittig & A. Wittig, <em>Amazon Web Services in Action</em>, Manning Publications</li>
          <li>B. Holder et al., <em>AWS Certified Solutions Architect Study Guide</em>, Wiley</li>
        </ul>
      </section>

      <div class="back-home">
        <a href="{{ url_for('pages.aws') }}" class="back-btn"><i class="fa fa-arrow-left"></i> Back to AWS Hub</a>
      </div>
    </div>
  </main>

  <!-- ===== FOOTER ===== -->
  <footer>
    <p>© 2025 InfraHub — Designed for Learning and Deployment</p>
  </footer>
</body>
</html>
