AWS solutions documentation change
Summary
Updated connectivity documentation for Prebid Server and Bidder Simulator, added RTB Fabric architecture diagrams, implemented script-based Fabric Link management, and introduced VPC peering fallback option.
Security assessment
The changes focus on architectural improvements and deployment flexibility without addressing security vulnerabilities. While asymmetric security (HTTPS/HTTP) is mentioned, this is existing functionality. No CVEs, vulnerabilities, or incident responses are referenced.
Diff
diff --git a/solutions/latest/prebid-server-deployment-on-aws/architecture-details.md b/solutions/latest/prebid-server-deployment-on-aws/architecture-details.md index 4c3546b56..c9f223413 100644 --- a//solutions/latest/prebid-server-deployment-on-aws/architecture-details.md +++ b//solutions/latest/prebid-server-deployment-on-aws/architecture-details.md @@ -59 +59 @@ When the bidder simulator is deployed, the solution supports two connectivity mo -**VPC Peering (default)** +**VPC Peering** @@ -61 +61 @@ When the bidder simulator is deployed, the solution supports two connectivity mo -When deploying with the bidder simulator, the solution automatically creates a VPC peering connection between the Prebid Server VPC and the Bidder Simulator VPC. This provides direct, private connectivity between the two environments without traversing the public internet. The peering connection is automatically configured with appropriate routes and security group rules. +When deploying with the bidder simulator using `--simulator-connectivity vpc-peering`, the solution creates a VPC peering connection between the Prebid Server VPC and the Bidder Simulator VPC. This provides direct, private connectivity between the two environments without traversing the public internet. The peering connection is automatically configured with appropriate routes and security group rules. Use this mode in regions where RTB Fabric is not available. @@ -63 +63 @@ When deploying with the bidder simulator, the solution automatically creates a V -**AWS RTB Fabric (optional)** +**AWS RTB Fabric (recommended)** @@ -65 +65 @@ When deploying with the bidder simulator, the solution automatically creates a V -When deploying with both the bidder simulator and RTB Fabric, the solution creates a private network connection through AWS RTB Fabric instead of VPC peering. This provides purpose-built, low-latency connectivity optimized for real-time bidding traffic. See the AWS RTB Fabric integration section for details. +When deploying with the bidder simulator using `--simulator-connectivity rtb-fabric`, the solution creates RTB Fabric gateways in each VPC and manages the Fabric Link through the `simulator-fabric-link.sh` script. This provides purpose-built, low-latency connectivity optimized for real-time bidding traffic. See the AWS RTB Fabric integration section for details. @@ -73 +73,20 @@ Amazon Elastic Container Service (Amazon ECS) is a fully managed container orche -[AWS RTB Fabric](https://aws.amazon.com/rtb-fabric/) is a private network purpose-built for real-time bidding that provides low-latency, cost-optimized connectivity between ad tech participants without traversing the public internet. When deployed, the solution creates the following components: +[AWS RTB Fabric](https://aws.amazon.com/rtb-fabric/) is a private network purpose-built for real-time bidding that provides low-latency, cost-optimized connectivity between ad tech participants without traversing the public internet. When deployed, the solution creates gateway resources in CloudFormation and manages the Fabric Link lifecycle through an external script. + +### RTB Fabric architecture + +The RTB Fabric integration spans two VPCs and uses a dedicated private network for bid request traffic: + + + ┌─────────────────────────────┐ ┌─────────────────────────────┐ + │ PrebidServerStack VPC │ │ BidderSimulatorStack VPC │ + │ │ │ │ + │ ┌───────────────────────┐ │ │ ┌───────────────────────┐ │ + │ │ ECS Fargate Tasks │ │ │ │ Lambda Bidder │ │ + │ │ (Prebid Server) │ │ │ │ (Simulator) │ │ + │ └──────────┬────────────┘ │ │ └──────────▲────────────┘ │ + │ │ │ │ │ │ + │ ┌──────────▼────────────┐ │ │ ┌──────────┴────────────┐ │ + │ │ Requester Gateway │──┼── RTB ──┼──│ Responder Gateway │ │ + │ │ (HTTPS port 443) │ │ Fabric │ │ (HTTP port 80) │ │ + │ └───────────────────────┘ │ Link │ └───────────────────────┘ │ + └─────────────────────────────┘ └─────────────────────────────┘ @@ -77 +96 @@ Amazon Elastic Container Service (Amazon ECS) is a fully managed container orche -Deployed in the Prebid Server VPC, the requester gateway sends bid requests over HTTPS (port 443) through the RTB Fabric private network. Prebid Server is configured to route bid requests to the RTB Fabric link URL instead of directly to bidder endpoints. +Deployed in the Prebid Server VPC, the requester gateway sends bid requests over HTTPS (port 443) through the RTB Fabric private network. Prebid Server is configured to route bid requests to the RTB Fabric link URL instead of directly to bidder endpoints. The gateway is provisioned as part of the PrebidServerStack when `EnableRtbRequesterGateway` is set to `true`. @@ -81 +100 @@ Deployed in the Prebid Server VPC, the requester gateway sends bid requests over -Deployed in the Bidder Simulator VPC, the responder gateway receives bid requests over HTTP (port 80) and forwards them to the bidder simulator Application Load Balancer. The connection uses asymmetric security—HTTPS from requester to responder, with HTTP responses on the internal AWS network. +Deployed in the Bidder Simulator VPC, the responder gateway receives bid requests over HTTP (port 80) and forwards them to the bidder simulator Application Load Balancer. The connection uses asymmetric security — HTTPS from requester to responder, with HTTP responses on the internal AWS network. The gateway is provisioned as part of the BidderSimulatorStack when `EnableRtbFabric` is set to `true`. @@ -85 +104,103 @@ Deployed in the Bidder Simulator VPC, the responder gateway receives bid request -The Fabric Link connects the requester and responder gateways through AWS RTB Fabric’s private network. A Lambda function automatically accepts the Fabric Link during deployment. The link provides dedicated bandwidth and low-latency routing optimized for real-time bidding traffic patterns. +The Fabric Link connects the requester and responder gateways through AWS RTB Fabric’s private network. The link provides dedicated bandwidth and low-latency routing optimized for real-time bidding traffic patterns. Unlike the gateways, the Fabric Link is **not** managed by CloudFormation — it is created and deleted by the `simulator-fabric-link.sh` script (see Script-based link lifecycle below). + +### WaitForGateway custom resource + +The `WaitForGateway` custom resource ensures that the RTB Fabric Requester Gateway is fully provisioned and ready to accept connections before the CloudFormation stack reports completion. Gateway provisioning is asynchronous — the `CfnGateway` resource returns immediately, but the gateway may take several minutes to reach an `ACTIVE` state. + +The custom resource uses a Lambda function that: + + 1. Polls the gateway status using the RTB Fabric API + + 2. Waits until the gateway reaches `ACTIVE` state + + 3. Returns success to CloudFormation, allowing dependent resources to proceed + + + + +This ensures that any post-deployment steps (such as Fabric Link creation) can rely on the gateway being ready. The `WaitForGateway` resource is gated by the `HasRtbRequesterGateway` condition and depends directly on the `RequesterGateway` resource. + +### Script-based link lifecycle + +The Fabric Link is managed independently of CloudFormation by the `deployment/simulator-fabric-link.sh` script. This design decouples the link lifecycle from stack operations, enabling: + + * Independent link creation and deletion without stack updates + + * Reliable teardown ordering (delete link before destroying stacks) + + * Faster iteration during development (no 5-10 minute stack update cycles) + + * Direct ECS task definition updates (~30 seconds vs. full stack update) + + + + +The script provides three subcommands: + +Subcommand | Description +---|--- +`create` | Creates a Fabric Link, polls until active with exponential backoff (5s → 10s → 20s → 30s cap, 5-minute timeout), accepts the link, stores the link ID in SSM Parameter Store, and updates the ECS task definition with the link URL. +`delete` | Reads the link ID from SSM Parameter Store, calls the RTB Fabric DeleteLink API, and removes the SSM parameter. Idempotent — exits successfully if no link exists. +`status` | Reads the link ID from SSM Parameter Store and displays the current link status, URL, and gateway IDs. + +**Integration with deployment scripts:** + + * `deploy.sh` invokes `simulator-fabric-link.sh create` after both stacks are deployed (when using `--simulator-connectivity rtb-fabric`) + + * `destroy.sh` invokes `simulator-fabric-link.sh delete` before initiating CloudFormation stack deletion + + * The CI/CD pipeline runs the script as a post-deployment step before functional tests + + + + +**State persistence:** + +The script persists the Fabric Link ID in AWS Systems Manager Parameter Store at the path `/{stack-name}/fabric-link/link-id`. This allows the link to be managed across separate script invocations and survives stack updates. + +**ECS task update:** + +After link creation, the script registers a new ECS task definition revision with the `AMT_BIDDING_SERVER_SIMULATOR_ENDPOINT` environment variable set to the link URL, then updates the ECS service to trigger a rolling deployment. This approach takes approximately 30 seconds compared to 5-10 minutes for a full CloudFormation stack update. + +### VPC peering fallback architecture + +For regions where AWS RTB Fabric is not available, the solution supports direct VPC peering as a fallback connectivity mode. VPC peering provides private connectivity between the Prebid Server VPC and the Bidder Simulator VPC without traversing the public internet. + + + ┌─────────────────────────────┐ ┌─────────────────────────────┐ + │ PrebidServerStack VPC │ │ BidderSimulatorStack VPC │ + │ │ │ │ + │ ┌───────────────────────┐ │ │ ┌───────────────────────┐ │ + │ │ ECS Fargate Tasks │ │ │ │ Lambda Bidder │ │ + │ │ (Prebid Server) │ │ │ │ (Simulator) │ │ + │ └──────────┬────────────┘ │ │ └──────────▲────────────┘ │ + │ │ │ │ │ │ + │ ┌──────────▼────────────┐ │ VPC │ ┌──────────┴────────────┐ │ + │ │ Private Subnet │──┼─Peering─┼──│ ALB │ │ + │ │ (Route to BSS CIDR) │ │ │ │ (Bidder endpoint) │ │ + │ └───────────────────────┘ │ │ └───────────────────────┘ │ + └─────────────────────────────┘ └─────────────────────────────┘ + +When VPC peering is used: + + * The `SimulatorEndpoint` CloudFormation parameter is set to the bidder simulator ALB DNS name + + * Routes are configured in both VPCs to allow traffic across the peering connection + + * Security groups permit inbound traffic from the peer VPC CIDR + + * The ECS task `AMT_BIDDING_SERVER_SIMULATOR_ENDPOINT` environment variable resolves to the `SimulatorEndpoint` value + + * No RTB Fabric gateways or links are created + + + + +**Choosing between RTB Fabric and VPC peering:** + +Criteria | RTB Fabric | VPC Peering +---|---|--- +Region availability | Requires RTB Fabric support in the deployment region | Available in all AWS regions +Latency optimization | Purpose-built for real-time bidding traffic patterns | Standard VPC networking +Production readiness | Recommended for production bidder integrations | Suitable for testing or non-RTB regions +Setup mechanism | `deploy.sh --simulator-connectivity rtb-fabric` | `deploy.sh --simulator-connectivity vpc-peering` @@ -89 +210 @@ The Fabric Link connects the requester and responder gateways through AWS RTB Fa -RTB Fabric requires the bidder simulator to be deployed as it needs both requester and responder gateways. RTB Fabric must also be available in your deployment region. +RTB Fabric requires the bidder simulator to be deployed as it needs both requester and responder gateways. RTB Fabric must also be available in your deployment region. If RTB Fabric is not available, use VPC peering as the connectivity mode. @@ -111 +232 @@ The bidder simulator supports two connectivity modes to Prebid Server: - * **VPC Peering** (default): Direct private connectivity through VPC peering connection + * **VPC Peering** : Direct private connectivity through VPC peering connection. Use in regions without RTB Fabric support. @@ -113 +234 @@ The bidder simulator supports two connectivity modes to Prebid Server: - * **RTB Fabric** : Private network connectivity through AWS RTB Fabric + * **RTB Fabric** (recommended): Private network connectivity through AWS RTB Fabric, managed by the `simulator-fabric-link.sh` script.