Internet Gateway

Mirth® Connect by NextGen Healthcare Amazon Web Services (AWS) Preferred Deployment

Subnets

Private You should place as many of your resources as possible into private subnets. This ensures that your resources are not publicly accessible, greatly reducing the attack surface. Resources that should be placed in private subnets include: Elastic Compute (EC2) instances Elastic Container Service (ECS) cluster Relational Database Service (RDS) database Elastic File System (EFS) volumes Note: Resources in a private subnet are not only unreachable by the internet but cannot make outbound internet requests. You need to create a public Network Address Translation (NAT) Gateway and route subnet traffic through that NAT Gateway to give resources outbound internet access. Public Amazon defines public subnets as subnets having a route table that directs traffic to an internet gateway. You will need to create a route table with a route to the internet gateway, then associate your public subnets to that route table. There are some resources that must be placed in a public subnet. For instanc

Mirth® Connect by NextGen Healthcare Amazon Web Services (AWS) Preferred Deployment

Virtual Private Cloud (VPC)

We recommend putting the Mirth® Connect by NextGen Healthcare infrastructure in its own VPC to make for easy, logical separation of the infrastructure. If that isn't possible because you have reached the cap on your VPCs for your AWS account, you can request more from Amazon. If you cannot do that for any other reasons, be sure to follow the subnet recommendations. Parent topic: Networking

Mirth® Connect by NextGen Healthcare Amazon Web Services (AWS) Preferred Deployment

Network Address Translation (NAT) Gateway

NAT Gateways can be public or private. In this case, you will need the NAT Gateway to provide outbound access to Mirth® Connect by NextGen Healthcare and the ECS cluster service. Because of this, the NAT gateway must be placed in a public subnet, configured for public connectivity, and allocated to an elastic IP. Parent topic: Networking

Mirth® Connect by NextGen Healthcare Amazon Web Services (AWS) Preferred Deployment

Example: ECS Fargate/EC2 Deployment

Here is one example of what a Mirth® Connect network might look like: VPC with CIDR 10.0.0.0/16 (65,536 IPs) Internet Gateway attached to the VPC Public Subnets Load Balancer Subnet 1 Availability zone: A CIDR block: 10.0.2.0/25 (123 IPs) Route table routes: 10.0.0.0/16 - local 0.0.0.0/0 - Internet gateway Load Balancer Subnet 2 Availability Zone - B CIDR block: 10.0.2.128/25 (123 IPs) Route table routes: 10.0.0.0/16 - local 0.0.0.0/0 - Internet gateway NAT Gateway Subnet CIDR block: 10.0.3.0/25 (123 IPs) Route table routes: 10.0.0.0/16 - local 0.0.0.0/0 - Internet gateway NAT Gateway Subnet: Nat Gateway Subnet Connectivity Type: Public Ip: Allocated Elastic IP Route Tables Public Route Table Route: 0.0.0.0/0 to internet gateway Nat Gateway Route Table Route: 0.0.0.0/0 to NAT gateway Private Subnets Connect Subnet 1 Availability zone: A CIDR block: 10.0.0.0/25 (123 IPs) Route table routes: 10.0.0.0/16 - local 0.0.0.0/0 - NAT gateway Connect Subnet 2 Availability zone: B CIDR block: 10.

Mirth® Connect by NextGen Healthcare Amazon Web Services (AWS) Preferred Deployment

Subnet Groups

In order for Regional Database Service (RDS) to make use of your subnets, you must put them into a subnet group (available in the RDS service page). Parent topic: Networking

Mirth® Connect by NextGen Healthcare Amazon Web Services (AWS) Preferred Deployment

Networking

Provided in this section is a list of recommendations for creating security measures for your cloud resources. In general, all resources are not publicly accessible and any administration is done using a load balancer, routing traffic to one or more Mirth® Connect by NextGen Healthcare instances. Virtual Private Cloud (VPC) Subnets Load Balancer Internet Gateway Network Address Translation (NAT) Gateway Subnet Groups Security Groups Example: ECS Fargate/EC2 Deployment Opening More Ports

Internet Gateway

Recommendations

Subnets

Virtual Private Cloud (VPC)

Network Address Translation (NAT) Gateway

Example: ECS Fargate/EC2 Deployment

Subnet Groups

Networking

Internet Gateway

Subnets

Virtual Private Cloud (VPC)

Network Address Translation (NAT) Gateway

Example: ECS Fargate/EC2 Deployment

Subnet Groups

Networking