Patrick Stephan's questions

I have an Elastic Beanstalk app setup utilizing the docker platform. Everything runs smoothly and I can redeploy the app using the eb deploy cli command. The app is setup on a custom VPC (something I barely understand) and is accessible via the web.

I want to add a Memcached ElastiCache cluster to my app. I tried creating the cluster manually via the console, but I can't ever seem to connect to it (no matter how I set it up) from my app (I've tried telnetting from the Elastic Beanstalk instance). I have added a .ebextensions directory to my app and have tried adding a directive for EB to create the cache cluster for me. I have tried using the AWS example template, but that didn't work. I have tried changing settings and have even tried simplifying the directive down to the very minimum required parameters to get EB to create the cluster. Nothing I am doing seems to work. Below is my current file:

Resources:
  MyElastiCache:
    Type: "AWS::ElastiCache::CacheCluster"
    Properties:
      CacheNodeType: "cache.t2.small"
      NumCacheNodes: "1"
      Engine: "memcached"
      VpcSecurityGroupIds: 
        - sg-XXXXXXXX
      CacheSubnetGroupName: "subnet-XXXXXXXX"

For the VpcSecurityGroupIds, I have tried both EC2 security groups and VPC security groups. Neither seem to help. The CacheSubnetGroupName is the id of a subnet within my VPC.

It is very frustrating because it takes 5 minutes to test the most minimal change as EB has to redeploy my app every time I try something new. Any help would be greatly appreciated.

Edit: Here is my latest attempt.

Resources:
  MyElastiCacheSubnetGroup:
    Type: "AWS::ElastiCache::SubnetGroup"
    Properties:
      Description: "Blah blah blah"
      SubnetIds:
        - subnet-XXXXXXXX
        - subnet-XXXXXXXX
        - subnet-XXXXXXXX
        - subnet-XXXXXXXX
  MyElastiCache:
    Type: "AWS::ElastiCache::CacheCluster"
    Properties:
      CacheNodeType: "cache.t2.small"
      NumCacheNodes: "1"
      Engine: "memcached"
      VpcSecurityGroupIds: 
        - sg-XXXXXXXX
      CacheSubnetGroupName:
        Ref: "MyElastiCacheSubnetGroup"

And the error to go with it: Service:AmazonCloudFormation, Message:Stack named 'awseb-e-amyvnbtvps-stack' aborted operation. Current state: 'UPDATE_ROLLBACK_IN_PROGRESS' Reason: The following resource(s) failed to create: [MyElastiCacheSubnetGroup].

We are creating a Content Management System for our company. It is important that this CMS support dynamic domain names on a dynamic number of servers. After many hours of research we felt that Amazon's Elastic Beanstalk was the way to go. One thing that we also require is the ability to dynamically enable SSL for the domains associated with our system.

So in our system, we can create a "site" which will be associated with a domain. When the site is created, we should also have the ability to choose if the domain will be hosted over SSL/TLS. We plan on white-labeling the system and anticipate a large number of domains being associate with it.

I have been exploring the different possibilities for being able to get SSL set up on the servers (or the load balancer) and be able to change what domains are secured on the fly. Here is where I am at:

• Using Amazon's Certificate Manager: this would be the most desired way to go about it. It is integrated with AWS and very easy to use. However, it has several debilitating limitations: 1. You have to verify every domain by email every time you request a new certificate. No big deal except that 2. It cannot apply certs to EC2 instances, only load balancers and load balancers can only be assigned one cert. This means you have to re-verify every domain whenever you want another domain to be secured. No good.
• Using Let's Encrypt on the Load Balancer: this would be the next best way (that I can see) to secure our sites. Whenever a new site needs to be secured we will request a new certificate for all the domains that need SSL. Once the cert is created, we push it to IAM and tell EBS to associate the Load Balancer with the new Cert. The only problem I see with this is that LetsEncrypt limits their certs to 100 domains, as does the non-free but relatively inexpensive SSL provider, SSLMate. Might work for now, but it doesn't scale. Is there an automated SSL provider that has no limit on the number of domains on the cert?
• Using Passthrough SSL: Amazon's Elastic Beanstalk allows you to set it up in such a way so that the load balancer will pass the encrypted traffic straight to the EC2 instances. Then you can allow the EC2 instances to handle the certificates. I can then utilize LetsEncrypt and assign an individual cert for each domain. I run into an issue when considering autoscaling: we will need to duplicate the certs across instances. My solution would be to store the certs in a secured S3 bucket, then have a cron running on all the EC2 instances to pull the new/updated certs over.

Are there any concerns with the last idea? Is there a better solution to what I am trying to do? Am I missing something? A concern? Or maybe a super simple solution to my problem?

Note that I am using docker, so I can set anything up on the server that I need to.