Storage

The volume was placed in the same Availability Zone as projectzero-prod-websvr to allow it to be attached to the EC2 instance.

I created a dedicated EBS volume to provide persistent storage for the production web server, configuring the volume with the following settings:

From EC2 → Elastic Block Store → Volumes, I selected the newly created projectzero-volume and chose Actions → Attach volume.

I selected projectzero-prod-websvr as the target EC2 instance and assigned /dev/sdf as the requested Linux device name. AWS may expose the device internally using an NVMe device name on Nitro-based EC2 instances.

I connected to projectzero-prod-websvr through the jumpbox and used lsblk to inspect the available block devices. The newly attached 10 GiB EBS volume appeared as nvme1n1, confirming that the volume was successfully attached and recognized by the operating system.

I used lsblk to identify the newly attached EBS volume. The 10 GiB volume was presented to the instance as nvme1n1 and did not yet contain a filesystem or mount point.

I formatted the new EBS volume with the ext4 filesystem so it could be used for persistent Linux storage.

sudo mkfs -t ext4 /dev/nvme1n1

I created a dedicated directory that will serve as the mount point for the EBS volume.

sudo mkdir /mnt/projectzero-data

I mounted the formatted EBS volume to /mnt/projectzero-data, making the storage accessible through the production web server's filesystem.

sudo mount /dev/nvme1n1 /mnt/projectzero-data

I used df -h to confirm that the EBS volume was successfully mounted. The output shows the 10 GiB nvme1n1 device mounted at /mnt/projectzero-data.

Finally, I created a test file on the mounted volume and read its contents back to verify that the filesystem was writable and functioning correctly.

echo "EBS Volume Test - $(date)" | sudo tee /mnt/projectzero-data/test.txt

cat /mnt/projectzero-data/test.txt

To ensure the EBS volume remains available after the EC2 instance is rebooted, I configured a persistent mount using /etc/fstab. I used the filesystem UUID rather than the NVMe device name to provide a stable reference for the volume across reboots.

First, I retrieved the UUID of the EBS filesystem: sudo blkid /dev/nvme1n1

From EC2 → Elastic Block Store → Volumes, I selected projectzero-volume and chose Actions → Create snapshot. I configured the snapshot with a descriptive name and description so the recovery point could be easily identified.

Snapshot creation occurs asynchronously. I monitored the snapshot until its status changed to Completed and progress reached 100%, confirming that the backup was successfully created.

I selected the existing projectzero-prod-websvr instance and created an image from its current configuration using: Actions → Image and templates → Create image I configured the image with a descriptive name and included the instance storage configuration as part of the AMI.

After the image creation process completed, I verified that the custom AMI was available and recorded its AMI ID for use when launching a new instance.

I configured the new instance with the same t3.small instance type as the original web server and selected my existing SSH key pair for administrative access.

I deployed the instance into the existing projectzero-prod-vpc, but selected the Public Subnet instead of the private web subnet. I also enabled automatic public IPv4 assignment so the instance could be accessed directly for validation.

I launched a new EC2 instance from the custom AMI using the public subnet configuration. For validation, I updated the security group to permit access to the application on TCP port 4321.

After the new instance launched, I connected to it and confirmed that the threat-intel-app application files were already present. This verified that the custom AMI successfully preserved the configured web server environment.

Finally, I accessed the Threat Intelligence Application using the new EC2 instance's public IPv4 address on port 4321. The application loaded successfully in the browser, validating the AMI deployment from end to end.