Project — Three-Tier Web App

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand Project — Three-Tier Web App without feeling intimidated by it
Get hands-on running the AWS CLI/Console yourself
Apply this concept immediately in a real project

Let's think about it this way for a moment

Real-world web apps are usually split into 3 layers — the Web tier (ALB + frontend server, Public Subnet), the App tier (backend server, auto-scaled via ASG, Public/Private Subnet), and the Database tier (RDS, Private Subnet, no direct internet access). Inside the VPC you split into Public and Private Subnets, and lock down the Security Group per layer (only allowing traffic web → app → database).

Let's connect it to a real scenario

Deploy layer by layer: a VPC (from the Intermediate chapter) → 2 Public Subnets (Web tier), 2 Private Subnets (App/DB tier) → an ALB (in front of the Web tier) → an ASG (App tier, min=2 max=6) → RDS Multi-AZ (Database tier). For each layer's Security Group, only allow traffic coming up from the layer below (e.g. web → app: port 8080, app → db: port 5432).

3-tier architecture: Web (ALB) → App (ASG) → Database (RDS Multi-AZ)
Separating the Public Subnet (Web) from the Private Subnet (App/DB)
Locking down Security Groups tightly, layer by layer

Let's walk through it together

text

Three-Tier Architecture
=========================

Internet
   |
[ALB] -- Public Subnet (Web tier)
   |
[ASG: App servers x2-6] -- Public/Private Subnet (App tier)
   |
[RDS Multi-AZ] -- Private Subnet (Database tier)

Security Groups:
  ALB -> App:  port 8080 only
  App -> DB:   port 5432 only
  Internet -> ALB: port 443 (HTTPS) only

You should see

You'll be able to design and deploy a 3-tier AWS architecture (combining VPC/Subnet/SG/ALB/ASG/RDS).

Try it in 5 minutes

Sketch out the 3-tier architecture yourself as a VPC/Subnet/SG diagram, and if you can, actually deploy it in a practice account (within Free Tier limits) — then make sure to clean up every resource afterward.

A quick word of caution

Running a multi-resource architecture (ALB + ASG + RDS Multi-AZ) can easily push you past the Free Tier — once you're done practicing, don't forget to clean up every resource (in the order ALB → ASG → RDS → VPC).

Easy traps

Letting the app tier's Security Group accept traffic directly from the internet — it should only accept traffic from the ALB
Leaving RDS as Single-AZ instead of enabling Multi-AZ — if that AZ goes down, the whole database can become unavailable

Now try it yourself

You'll know it worked when: You'll be able to design and deploy a 3-tier AWS architecture (combining VPC/Subnet/SG/ALB/ASG/RDS).