AWS for Django in production

Set it up

Guides that take this from nothing to running in production.

• Deploy Django on AWS EC2 Step by Step

  To deploy Django on AWS EC2 reliably, you need more than python manage.py runserver.

• Deploy Django on AWS Elastic Beanstalk

  Deploy Django to AWS Elastic Beanstalk with the EB CLI, Gunicorn, RDS PostgreSQL, leader-only migrations, static file mapping, and working health checks.

• Deploy Django on AWS ECS Fargate

  Run Django on AWS ECS Fargate with an ECR image, Secrets Manager credentials, an Application Load Balancer, one-off migration tasks, and safe rolling deploys.

• Deploy Django on AWS Lightsail

  Deploy Django on an AWS Lightsail instance with a static IP, firewall rules, Gunicorn, Nginx, HTTPS, and an optional Lightsail managed PostgreSQL database.

• Deploy Django on AWS App Runner

  Deploy a containerised Django app on AWS App Runner: build an image in ECR, configure the port and health check, connect to RDS through a VPC connector, run migrations, serve static files, and know when ECS fits better.

• Deploy Django to AWS Lambda

  Deploy Django to AWS Lambda with Zappa or a container image and the Lambda Web Adapter: package size limits, static files on S3, database connections with RDS Proxy, cold starts, and when serverless Django is a poor fit.

• Run Django Behind an AWS Application Load Balancer

  Configure Django correctly behind an AWS Application Load Balancer: HTTPS listeners with ACM, X-Forwarded-Proto and client IPs, ALLOWED_HOSTS for health checks, idle and keepalive timeouts, stickiness, and deregistration delay for deploys.

• Connect Django to Amazon RDS With IAM Authentication

  Connect Django to Amazon RDS PostgreSQL or Aurora with IAM database authentication instead of a static password: grant rds_iam, create an rds-db:connect policy, generate auth tokens in a custom database backend, and require TLS.

• How to Store Django Media Files on Amazon S3

  Local disk storage for Django media files works in development, but it breaks quickly in production.

• Serve Django Static Files Through CloudFront

  Serve Django static files from CloudFront: S3 with origin access control or origin pull, hashed filenames, immutable caching, and CORS.

• Send Django Email with Amazon SES

  Send Django email through Amazon SES: domain verification with DKIM, leaving the sandbox, SMTP or django-ses API backends, IAM permissions, custom MAIL FROM, and bounce handling.

• Upload Files Directly to S3 from Django with Presigned URLs

  Let browsers upload large files straight to S3 with presigned POST policies: size and type limits, bucket CORS, server-side confirmation, FileField wiring, and cleanup of abandoned uploads.

• Deploy Django on Amazon EKS

  Deploy Django on Amazon EKS: build images in ECR, expose the app through an ALB with the AWS Load Balancer Controller and ACM certificates, connect to RDS, grant AWS access with Pod Identity, sync secrets, and run migrations as Jobs.

• Deploy Django on AWS With the CDK

  Deploy Django on AWS with the Cloud Development Kit in Python: an ApplicationLoadBalancedFargateService, RDS PostgreSQL, Secrets Manager, S3 media, and a migration task, with cdk diff and cdk deploy in CI.

• Load Django Secrets From AWS Secrets Manager

  Load Django secrets such as SECRET_KEY and database passwords from AWS Secrets Manager: inject them into ECS and EKS as environment variables, fetch them at startup with boto3 and caching, grant least-privilege IAM, and rotate RDS credentials.

• Use Amazon SQS as the Celery Broker for Django

  Use Amazon SQS as a Celery broker for Django: install the SQS transport, authenticate with IAM roles, create queues, set visibility timeout and long polling, handle FIFO limitations, and avoid surprises with ETA tasks, results, and costs.

• Use AWS ElastiCache (Redis OSS or Valkey) With Django

  Connect Django to Amazon ElastiCache for caching, sessions, and Celery: choose Valkey or Redis OSS, serverless or node-based clusters, enable TLS and AUTH or IAM, use the primary endpoint, configure security groups, and handle failovers and cluster mode.

• Run Django on Amazon Aurora PostgreSQL and Aurora Serverless v2

  Run Django on Amazon Aurora PostgreSQL: choose provisioned or Serverless v2 capacity, use writer and reader endpoints with a database router, add RDS Proxy for connection pooling and faster failover, set minimum ACUs, and plan upgrades and backups.

• Load Django Settings From AWS SSM Parameter Store

  Use AWS Systems Manager Parameter Store for Django configuration and secrets: store SecureString parameters under a path per environment, inject them into ECS task definitions, read them with boto3 on EC2 and Lambda, grant least-privilege IAM, and compare with Secrets Manager.

• Protect Django on AWS With AWS WAF

  Put AWS WAF in front of a Django app on an ALB, CloudFront, or API Gateway: start with AWS managed rule groups in count mode, add rate-based rules for login and API endpoints, exclude rules that break uploads or admin forms, and log and tune blocked requests.

• Deploy Django to AWS From GitHub Actions With OIDC (No Access Keys)

  Replace long-lived AWS access keys in GitHub Actions with OpenID Connect: create the GitHub OIDC provider and an IAM role with a trust policy scoped to your repo and branch, assume it with aws-actions/configure-aws-credentials, and push to ECR and deploy ECS.

Run it well

Tuning, reliability, and operations once it works.

• Auto Scale a Django Service on Amazon ECS

  Configure ECS service auto scaling for Django web and Celery services: target tracking on CPU or ALB requests per target, step scaling on SQS or custom queue metrics, sensible min and max tasks, cooldowns, database connection limits, and graceful shutdown.

• Send Django Logs to Amazon CloudWatch

  Ship Django, Gunicorn, and Celery logs to Amazon CloudWatch Logs: the awslogs driver on ECS, the CloudWatch agent on EC2, JSON logs for Logs Insights queries, retention settings, metric filters and alarms, and controlling ingestion cost.

Check it

Review lists to run before launch or after a change.

• Django on AWS Production Checklist

  A production checklist for Django on AWS: account security, VPC and security groups, IAM roles instead of keys, RDS and ElastiCache settings, S3 and CloudFront, secrets, TLS, logging, backups, and cost controls.

Fix it

Errors and symptoms, each traced to a cause and a fix.

• Fix AWS Application Load Balancer 502s for Django

  Fix intermittent and constant 502 Bad Gateway errors from an AWS Application Load Balancer in front of Django: keepalive timeouts shorter than the ALB idle timeout, unhealthy targets, security groups, and HTTP/HTTPS target mismatches.

• Fix boto3 NoCredentialsError in Django

  Fix botocore NoCredentialsError Unable to locate credentials in Django with django-storages or SES: give the process an IAM role or environment credentials, fix systemd and Docker env loading, IMDSv2 hop limits, and region settings.

• Fix ECS "Essential Container in Task Exited" for a Django Service

  Fix AWS ECS tasks that stop with Essential container in task exited for Django on Fargate or EC2: read the stopped reason and CloudWatch logs, fix missing secrets and permissions, health check failures, exit codes 137 and 1, and migration commands.

• Fix AccessDenied Errors Uploading Django Files to S3

  Fix AccessDenied from S3 when django-storages uploads files: IAM policy actions, bucket policies, Object Ownership and ACLs, KMS keys, and credentials.

• Fix S3 SignatureDoesNotMatch and AWS4-HMAC-SHA256 Errors in Django

  Fix SignatureDoesNotMatch and The authorization mechanism you have provided is not supported, please use AWS4-HMAC-SHA256 in django-storages: set the bucket region and signature version, fix presigned URLs, clock skew, and custom endpoints for R2, Spaces, and MinIO.

• Fix django-storages "AccessControlListNotSupported: The Bucket Does Not Allow ACLs"

  Fix the S3 error AccessControlListNotSupported, the bucket does not allow ACLs, in django-storages: stop sending ACL headers with default_acl None, use bucket policies for public static files, and keep private media behind presigned URLs.

Related topics