AWS solutions documentation change
Summary
Updated process flow steps to clarify connectivity methods for different bidder scenarios (external, VPC peering, RTB Fabric) and cache endpoint configuration. Reordered step numbering and added detail about network paths.
Security assessment
The changes describe secure connectivity methods like VPC peering and RTB Fabric for bidder communication, which reduces exposure to public internet. However, there is no explicit mention of patching vulnerabilities or addressing security incidents - these are architectural best practices rather than direct security fixes.
Diff
diff --git a/solutions/latest/prebid-server-deployment-on-aws/architecture-overview.md b/solutions/latest/prebid-server-deployment-on-aws/architecture-overview.md index 70ec01e5a..1ff4c9e1c 100644 --- a//solutions/latest/prebid-server-deployment-on-aws/architecture-overview.md +++ b//solutions/latest/prebid-server-deployment-on-aws/architecture-overview.md @@ -33 +33 @@ The high-level process flow for the solution, including the components deployed - 5. The request arrives at an [Amazon Elastic Container Service](https://aws.amazon.com/ecs/) (Amazon ECS) container, is parsed and validated, and requests to different bidding services are sent concurrently to the internet through the default internet gateway. + 5. The request arrives at an [Amazon Elastic Container Service](https://aws.amazon.com/ecs/) (Amazon ECS) container, is parsed and validated, and requests to different bidding services are sent concurrently. The connectivity method depends on the deployment configuration: @@ -35 +35 @@ The high-level process flow for the solution, including the components deployed - 6. The NAT gateway and internet gateway allow containers to initiate outbound requests to the internet and receive responses. These resources are primarily used for Prebid Server containers to request and gather bids for ad auctions. + 1. **External bidders** : Requests are sent through the NAT gateway and internet gateway to bidders over the public internet. @@ -37 +37 @@ The high-level process flow for the solution, including the components deployed - 7. Bidders receive one or more bid requests over the internet from a Prebid Server container. Bidders respond with zero or more bids for the various requests. The response, including the body of the winning creative(s), is sent back to the browser. + 2. **Bidder simulator with VPC peering** : Requests are sent directly through the VPC peering connection to the bidder simulator in its own VPC. @@ -39 +39 @@ The high-level process flow for the solution, including the components deployed - 8. During normal operation, Amazon CloudWatch metrics are collected from various resources involved in handling requests and responses through the solution. As the load changes throughout the cluster, CloudWatch alarms are used to determine when to scale-out or scale-in the container cluster. + 3. **Bidder simulator with RTB Fabric** : Requests are sent through the AWS RTB Fabric requester gateway to the responder gateway in the bidder simulator VPC, utilizing the private RTB Fabric network. @@ -41 +41 @@ The high-level process flow for the solution, including the components deployed - 9. An ECS service definition (Prebid ECS service) is responsible for tracking the health of the cluster, performing scale-out and scale-in operations, and managing the collection of containers available for ALB. The Prebid ECS service uses [AWS Fargate](https://aws.amazon.com/fargate/) instances. + 6. The NAT gateway and internet gateway allow containers to initiate outbound requests to the internet and receive responses. These resources are primarily used for Prebid Server containers to request and gather bids for ad auctions from external bidders. @@ -43 +43 @@ The high-level process flow for the solution, including the components deployed - 10. Metrics log files for each container are stored to a shared [Amazon Elastic File System](https://aws.amazon.com/efs/) (Amazon EFS) using NFS protocol. This file system is mounted to each Prebid Server container during start-up. A single metrics log file is written for a limited time and then closed and rotated, so that it can be included in the next stage of processing. EFS is treated as a temporary location as log data is generated and moved to longer-term storage on [Amazon Simple Storage Service](https://aws.amazon.com/s3/) (Amazon S3) and into [AWS Glue](https://aws.amazon.com/glue/). + 7. Bidders receive one or more bid requests (either over the internet, through VPC peering, or via RTB Fabric) from a Prebid Server container. Bidders respond with zero or more bids for the various requests. The response, including the body of the winning creative(s), is sent back to the browser. @@ -45 +45 @@ The high-level process flow for the solution, including the components deployed - 11. [AWS DataSync](https://aws.amazon.com/datasync/) replicates rotated log files from EFS to S3 on a recurring schedule. DataSync verifies each transferred file and provides a report of the completed work to an [AWS Lambda](https://aws.amazon.com/lambda/) function. + 8. For cache operations, Prebid Server containers are configured to use the publicly accessible endpoint (CloudFront domain or external ALB DNS) to store and retrieve cached bid responses. Cache requests from containers flow through the same entry point as client requests, reaching the cache Lambda function via ALB routing rules. This unified cache endpoint ensures both server-side and client-side cache access use the same path. @@ -47 +47 @@ The high-level process flow for the solution, including the components deployed - 12. The `DataSyncLogsBucket` S3 bucket receives the replicated log files from EFS using the same folder structure. Log files arrive in this bucket as a result of the DataSync process. + 9. During normal operation, Amazon CloudWatch metrics are collected from various resources involved in handling requests and responses through the solution. As the load changes throughout the cluster, CloudWatch alarms are used to determine when to scale-out or scale-in the container cluster. @@ -49 +49 @@ The high-level process flow for the solution, including the components deployed - 13. The `delete_efs_files` Lambda function runs after the DataSync process completes in step 12 and removes transferred and verified log file data from EFS. + 10. An ECS service definition (Prebid ECS service) is responsible for tracking the health of the cluster, performing scale-out and scale-in operations, and managing the collection of containers available for ALB. The Prebid ECS service uses [AWS Fargate](https://aws.amazon.com/fargate/) instances. @@ -51 +51 @@ The high-level process flow for the solution, including the components deployed - 14. An AWS Glue job performs an ETL operation on the metrics data in the `DataSyncLogsBucket` S3 bucket. The ETL operation structures the metric data into a single database with several tables, partitions the physical data, and writes it to an S3 bucket. + 11. Metrics log files for each container are stored to a shared [Amazon Elastic File System](https://aws.amazon.com/efs/) (Amazon EFS) using NFS protocol. This file system is mounted to each Prebid Server container during start-up. A single metrics log file is written for a limited time and then closed and rotated, so that it can be included in the next stage of processing. EFS is treated as a temporary location as log data is generated and moved to longer-term storage on [Amazon Simple Storage Service](https://aws.amazon.com/s3/) (Amazon S3) and into [AWS Glue](https://aws.amazon.com/glue/). @@ -53 +53 @@ The high-level process flow for the solution, including the components deployed - 15. The `MetricsEtlBucket` S3 bucket contains the metric log data transformed and partitioned through ETL. The data in this bucket is made available to AWS Glue clients for queries. + 12. [AWS DataSync](https://aws.amazon.com/datasync/) replicates rotated log files from EFS to S3 on a recurring schedule. DataSync verifies each transferred file and provides a report of the completed work to an [AWS Lambda](https://aws.amazon.com/lambda/) function. @@ -55 +55,9 @@ The high-level process flow for the solution, including the components deployed - 16. Many different types of clients use [AWS Glue Data Catalog](https://docs.aws.amazon.com/glue/latest/dg/catalog-and-crawler.html) to access the Prebid Server metric data. + 13. The `DataSyncLogsBucket` S3 bucket receives the replicated log files from EFS using the same folder structure. Log files arrive in this bucket as a result of the DataSync process. + + 14. The `delete_efs_files` Lambda function runs after the DataSync process completes in step 12 and removes transferred and verified log file data from EFS. + + 15. An AWS Glue job performs an ETL operation on the metrics data in the `DataSyncLogsBucket` S3 bucket. The ETL operation structures the metric data into a single database with several tables, partitions the physical data, and writes it to an S3 bucket. + + 16. The `MetricsEtlBucket` S3 bucket contains the metric log data transformed and partitioned through ETL. The data in this bucket is made available to AWS Glue clients for queries. + + 17. Many different types of clients use [AWS Glue Data Catalog](https://docs.aws.amazon.com/glue/latest/dg/catalog-and-crawler.html) to access the Prebid Server metric data.