Virtual Private Cloud (VPC)

Mirth® Connect by NextGen Healthcare Amazon Web Services (AWS) Preferred Deployment

Subnets

Private You should place as many of your resources as possible into private subnets. This ensures that your resources are not publicly accessible, greatly reducing the attack surface. Resources that should be placed in private subnets include: Elastic Compute (EC2) instances Elastic Container Service (ECS) cluster Relational Database Service (RDS) database Elastic File System (EFS) volumes Note: Resources in a private subnet are not only unreachable by the internet but cannot make outbound internet requests. You need to create a public Network Address Translation (NAT) Gateway and route subnet traffic through that NAT Gateway to give resources outbound internet access. Public Amazon defines public subnets as subnets having a route table that directs traffic to an internet gateway. You will need to create a route table with a route to the internet gateway, then associate your public subnets to that route table. There are some resources that must be placed in a public subnet. For instanc

Mirth® Connect by NextGen Healthcare Amazon Web Services (AWS) Preferred Deployment

Internet Gateway

You will need an internet gateway attached to your Virtual Private Cloud (VPC) to allow your resources to be reached over the internet. Resources in a subnet with a route table containing an internet gateway become publicly accessible. Parent topic: Networking

Mirth® Connect by NextGen Healthcare Amazon Web Services (AWS) Preferred Deployment

Load Balancer

AWS has several load balancers available, but most Mirth® Connect by NextGen Healthcare users employ a Network Load Balancer since it operates at Open Systems Interconnection (OSI) layer 4, enabling it to route TCP traffic. The load balancer is used to send internet traffic to the Mirth® Connect by NextGen Healthcare cluster, therefore, it must be placed in one or more public subnets. The load balancer also needs a listener routing traffic to a target group for each port that is open to the internet. Parent topic: Networking

Mirth® Connect by NextGen Healthcare Amazon Web Services (AWS) Preferred Deployment

Networking

Provided in this section is a list of recommendations for creating security measures for your cloud resources. In general, all resources are not publicly accessible and any administration is done using a load balancer, routing traffic to one or more Mirth® Connect by NextGen Healthcare instances. Virtual Private Cloud (VPC) Subnets Load Balancer Internet Gateway Network Address Translation (NAT) Gateway Subnet Groups Security Groups Example: ECS Fargate/EC2 Deployment Opening More Ports

Mirth® Connect by NextGen Healthcare Amazon Web Services (AWS) Preferred Deployment

Preface and Assumptions

This document provides recommendations for Mirth® Connect by NextGen Healthcare users on how to deploy Mirth® Connect by NextGen Healthcare within their Amazon Web Services (AWS) account. This includes a set of services and configurations for those services which focus on security, durability, and efficiency. This is a high-level guide for users who have a working knowledge of AWS and a general understanding of the identified services who want examples of known tested and working infrastructure to house Mirth® Connect by NextGen Healthcare in Amazon's cloud. Networking ECS File Storage Database EC2 Elastic Container Service (ECS) Costs

Mirth® Connect by NextGen Healthcare Amazon Web Services (AWS) Preferred Deployment

Set up the Single EC2 Instance

Before you begin To run Mirth® Connect by NextGen Healthcare in a single EC2 instance, you will need the following prerequisites: Set up a virtual private cloud (VPC) with at least two private subnets An RDS database. Select EC2 from the Main Menu of the AWS console. Click Launch Instance, then select Launch Instance. Select Amazon Linux 2 AMI (HVM), SSD Volume Type for the AMI. For this single node setup, selectt3.medium (2 CPU, 4 GB RAM). Click Next: Configure Instance Details. Network: Select the VPC that you created in the Networking section of this document. Subnet: Select one of the subnets created in the Networking section of this document. Auto-assign Public IP: Select Disable (you are in a private subnet and will be behind an elastic load balancer). Keep the rest of the defaults on this page and select Next: Add Storage. Keep the default size for the root EBS volume (8GB) and select Next: Add Tags. Select Next: Configure Security Group. Next to Assign a security group, select

Virtual Private Cloud (VPC)

Recommendations

Subnets

Internet Gateway

Load Balancer

Networking

Preface and Assumptions

Set up the Single EC2 Instance

Virtual Private Cloud (VPC)

Subnets

Internet Gateway

Load Balancer

Networking

Preface and Assumptions

Set up the Single EC2 Instance