AWS solutions documentation change
Summary
Added documentation for optional AWS RTB Fabric integration, bidder simulator, and cache architecture using ElastiCache Serverless. Updated service descriptions to include new routing and caching functionalities.
Security assessment
The changes add documentation about security features including IAM authentication for ElastiCache, private network connectivity via VPC peering and RTB Fabric (keeping traffic off public internet), and asymmetric security in RTB Fabric (HTTPS from requester, HTTP internally). However, there is no evidence these changes address a specific security vulnerability or incident - they appear to be architectural enhancements and new feature documentation.
Diff
diff --git a/solutions/latest/prebid-server-deployment-on-aws/architecture-details.md b/solutions/latest/prebid-server-deployment-on-aws/architecture-details.md index 23b2d051c..d81d8f86c 100644 --- a//solutions/latest/prebid-server-deployment-on-aws/architecture-details.md +++ b//solutions/latest/prebid-server-deployment-on-aws/architecture-details.md @@ -5 +5 @@ -AWS services in this solutionCloudFront distributionAWS WAFApplication Load Balancer (ALB)Amazon VPCAmazon ECSPrebid Server containerAmazon EFSDataSync (EFS to S3)Glue ETL (Metrics processing)AWS Glue Data CatalogAmazon CloudWatch +AWS services in this solutionCloudFront distributionAWS WAFApplication Load Balancer (ALB)Amazon VPCAmazon ECSAWS RTB Fabric integration (optional)Bidder Simulator (optional)Cache architecturePrebid Server containerAmazon EFSDataSync (EFS to S3)Glue ETL (Metrics processing)AWS Glue Data CatalogAmazon CloudWatch @@ -19 +19,2 @@ AWS service | Description -[Elastic Load Balancing](https://aws.amazon.com/elasticloadbalancing/) | **Core**. Provide high availability and automate scaling of Prebid Server application containers hosted on Amazon ECS. +[Amazon ElastiCache](https://aws.amazon.com/elasticache/) | **Core**. Provide serverless Redis-compatible cache (Valkey) for storing cached bid responses with configurable time-to-live (TTL). +[Elastic Load Balancing](https://aws.amazon.com/elasticloadbalancing/) | **Core**. Provide high availability and automate scaling of Prebid Server application containers hosted on Amazon ECS. Route cache requests to Lambda function. @@ -24 +25 @@ AWS service | Description -[AWS Lambda](https://aws.amazon.com/lambda/) | **Core**. Facilitate deployment and deletion of the solution through [Lambda-backed custom resources](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/template-custom-resources-lambda.html), cleaning archived log and metrics files from Amazon EFS after being moved to Amazon S3 for long term storage, and triggering AWS Glue. +[AWS Lambda](https://aws.amazon.com/lambda/) | **Core**. Facilitate deployment and deletion of the solution through [Lambda-backed custom resources](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/template-custom-resources-lambda.html), cleaning archived log and metrics files from Amazon EFS after being moved to Amazon S3 for long term storage, triggering AWS Glue, and handling cache storage and retrieval operations. @@ -31,0 +33 @@ AWS service | Description +[AWS RTB Fabric](https://aws.amazon.com/rtb-fabric/) | **Optional**. Provide low-latency, cost-optimized private network connectivity between Prebid Server and bidders without traversing the public internet. @@ -47 +49 @@ If you want to opt out of using CloudFront and AWS WAF and directly send request -ALB distributes incoming request traffic for Prebid Server through the cluster of containers. It provides a single entry point into the cluster and is the primary origin for the CloudFront distribution. +ALB distributes incoming request traffic for Prebid Server through the cluster of containers. It provides a single entry point into the cluster and is the primary origin for the CloudFront distribution. ALB also routes cache-related requests (paths starting with `/cache`) to the cache Lambda function, which handles storage and retrieval of cached bid responses in ElastiCache. @@ -52,0 +55,10 @@ The Amazon Virtual Private Cloud (Amazon VPC) is configured with redundant subne +When the bidder simulator is deployed, the solution supports two connectivity modes: + +**VPC Peering (default)** + +When deploying with the bidder simulator, the solution automatically creates a VPC peering connection between the Prebid Server VPC and the Bidder Simulator VPC. This provides direct, private connectivity between the two environments without traversing the public internet. The peering connection is automatically configured with appropriate routes and security group rules. + +**AWS RTB Fabric (optional)** + +When deploying with both the bidder simulator and RTB Fabric, the solution creates a private network connection through AWS RTB Fabric instead of VPC peering. This provides purpose-built, low-latency connectivity optimized for real-time bidding traffic. See the AWS RTB Fabric integration section for details. + @@ -56,0 +69,97 @@ Amazon Elastic Container Service (Amazon ECS) is a fully managed container orche +## AWS RTB Fabric integration (optional) + +[AWS RTB Fabric](https://aws.amazon.com/rtb-fabric/) is a private network purpose-built for real-time bidding that provides low-latency, cost-optimized connectivity between ad tech participants without traversing the public internet. When deployed, the solution creates the following components: + +**Requester Gateway** + +Deployed in the Prebid Server VPC, the requester gateway sends bid requests over HTTPS (port 443) through the RTB Fabric private network. Prebid Server is configured to route bid requests to the RTB Fabric link URL instead of directly to bidder endpoints. + +**Responder Gateway** + +Deployed in the Bidder Simulator VPC, the responder gateway receives bid requests over HTTP (port 80) and forwards them to the bidder simulator Application Load Balancer. The connection uses asymmetric security—HTTPS from requester to responder, with HTTP responses on the internal AWS network. + +**Fabric Link** + +The Fabric Link connects the requester and responder gateways through AWS RTB Fabric’s private network. A Lambda function automatically accepts the Fabric Link during deployment. The link provides dedicated bandwidth and low-latency routing optimized for real-time bidding traffic patterns. + +###### Note + +RTB Fabric requires the bidder simulator to be deployed as it needs both requester and responder gateways. RTB Fabric must also be available in your deployment region. + +## Bidder Simulator (optional) + +The bidder simulator is an optional component that provides a quick start testing environment to validate your Prebid Server deployment without needing to configure external bidders. The simulator includes: + +**Architecture** + +The bidder simulator uses a CloudFront + Application Load Balancer + Lambda architecture to simulate bidder responses. It supports both banner and video ad formats, including VAST instream video. + +**Bidder Simulator Adapter Integration** + +When deployed, the solution automatically configures the custom prebid bidder adapter in Prebid Server allowing connectivity to the Bidder Simulator. The adapter files are conditionally included in the Docker build, and environment variables are automatically set for proper integration. + +**Demo Website** + +A demo website with Prebid.js integration is included to test the end-to-end flow from prebid.js through Prebid Server to the bidder simulator. The demo supports both banner and video ad units. For usage instructions, see the demo website readme at `source/loadtest/demo/README.md`. + +**Connectivity Options** + +The bidder simulator supports two connectivity modes to Prebid Server: + + * **VPC Peering** (default): Direct private connectivity through VPC peering connection + + * **RTB Fabric** : Private network connectivity through AWS RTB Fabric + + + + +###### Note + +The bidder simulator is intended for testing and validation purposes. For production deployments, configure Prebid Server to connect to your actual bidder endpoints. + +## Cache architecture + +The solution includes a cache service that stores and retrieves bid responses for Prebid Server. The cache architecture uses the following components: + +**ElastiCache Serverless (Valkey)** + +The solution uses Amazon ElastiCache Serverless with Valkey (Redis-compatible) engine to provide a fully managed, serverless cache. The cache is deployed in the private subnets of the VPC and uses IAM authentication for secure access. Cache data is stored with configurable time-to-live (TTL) settings. + +**Cache Lambda Function** + +An AWS Lambda function handles cache storage and retrieval operations. The function is invoked through ALB target group rules that route requests with paths starting with `/cache` to the Lambda function. The Lambda function connects to the ElastiCache Serverless cache using IAM authentication and the Redis protocol. + +**Unified Cache Endpoint** + +Both Prebid Server containers and client-side code (prebid.js) use the same publicly accessible cache endpoint: + + * **CloudFront deployment** : Cache endpoint is the CloudFront distribution domain + + * **ALB-only deployment** : Cache endpoint is the external ALB DNS name + + + + +This unified approach ensures consistent cache access patterns and simplifies the architecture by eliminating the need for separate internal and external cache endpoints. + +**Cache Request Flow** + +When Prebid Server needs to cache a bid response: + + 1. Container sends cache request to the configured `CACHE_HOST` (CloudFront domain or external ALB DNS) + + 2. Request flows through CloudFront (if deployed) to the external ALB + + 3. ALB routes the request to the cache Lambda function based on path rules + + 4. Lambda function stores the bid response in ElastiCache Serverless and returns a cache key + + 5. Client-side code later retrieves the cached response using the same endpoint + + + + +###### Note + +The cache service is designed to handle both server-side caching (from Prebid Server containers) and client-side retrieval (from browsers). Using a single public endpoint for both access patterns ensures optimal performance and simplifies configuration. +