How ishihab/aws_aws_three_tier_architecture works
1. What this repo is
- A Terraform-based AWS infrastructure project for a classic 3-tier architecture: presentation/web, application, and data.
- The root config (main.tf, providers.tf, backend.tf, terraform.tf, variable.tf) is the orchestration layer; the actual infrastructure is split into reusable modules under module/.
2. State, provider, and deployment boundary
- Terraform uses an S3 remote backend for state storage and locking.
- The AWS provider is the only major runtime dependency; there is no application code here, only infrastructure definitions and bootstrap scripts.
3. Network foundation: module/vpc
- This module creates the shared network substrate: VPC, subnets, route tables, internet gateway, NAT gateways, and security groups.
- The README indicates a multi-AZ layout with separate subnet tiers for web/public, app/private, and DB/private, plus reserved subnets.
- It also creates an EC2 Instance Connect Endpoint so instances can be reached securely without a bastion host.
4. Compute foundation: module/ec2
- This module defines launch templates and the associated IAM roles / instance profiles used by EC2 instances in the web and app tiers.
- It is the place where instance-level permissions are attached, especially for AWS API access such as SSM, Secrets Manager, and related bootstrap operations.
5. Traffic entry and load balancing: module/app
- Despite the folder name, this module is really the traffic management + autoscaling tier.
- It creates a public Application Load Balancer for internet-facing traffic and an internal/private ALB for east-west traffic between tiers.
- It also defines target groups, listeners, and Auto Scaling Groups for both web and application instances.
6. Data tier: module/rds
- This module provisions the MySQL RDS database in private subnets.
- It includes the DB subnet group, parameter group, encryption/KMS, and database-related storage/monitoring configuration.
- The README also describes storing the DB password in Secrets Manager and the DB endpoint in SSM Parameter Store.
7. End-to-end request flow
- External users hit the public ALB over HTTP/HTTPS.
- The public ALB sends traffic to the web tier instances in the web/public subnets.
- The web tier forwards to the internal ALB, which distributes requests to the app tier instances in private subnets.
- The app tier connects to RDS MySQL in the private DB subnets.
8. Bootstrap and configuration flow
- scripts/web_user_data.sh and scripts/app_user_data.sh are the instance bootstrap entry points.
- They install runtime dependencies and, in the app tier, retrieve configuration from SSM Parameter Store and credentials from Secrets Manager.
- This keeps database endpoints and passwords out of the Terraform code and out of the instance image.
9. Security boundaries
- Access is segmented with least-privilege security groups between ALB, web, app, and DB tiers.
- Direct SSH is avoided; administrative access is meant to go through EC2 Instance Connect using the endpoint and allowed source IPs.
- The DB is not exposed publicly; only the private app tier can reach port 3306.
10. High availability and scaling
- The design is multi-AZ across the network, compute, and database layers.
- Both web and app tiers use Auto Scaling Groups behind ALBs, and RDS is configured for Multi-AZ availability.
- NAT gateways are deployed per AZ to preserve outbound access for private subnets without public exposure.
11. Operations and observability
- RDS supports enhanced monitoring, backups, and maintenance windows.
- The infrastructure is meant to be production-oriented, with outputs for the public ALB DNS, internal ALB DNS, and DB endpoint to support downstream deployment and validation.
12. How to read the repo as an architecture diagram
- Think in four layers: root orchestration, network foundation, compute/traffic layers, and data layer.
- The important directional dependencies are: vpc provides shared network IDs and security boundaries; ec2 provides instance identity and bootstrap permissions; app wires traffic and scaling; rds exposes the private database endpoint and secrets.
Main entry points: vpc.tf VPC · main.tf Root stack · launch_template.tf EC2 base · db.tf MySQL RDS
Components 20
Root orchestration
Terraform entrypoints and shared configuration
- Root stack · Top-level Terraform orchestration for the three-tier deployment
main.tf - AWS provider · Primary runtime dependency for AWS resources
providers.tf - Remote state · Terraform state storage and locking boundary
backend.tf - Root vars · Deployment-wide variables and environment settings
variable.tf
Network foundation
Shared VPC, subnets, routing, and security boundaries
- VPC · Shared VPC, subnets, routes, gateways, and security groups
module/vpc/vpc.tf - Subnets · Public, private, DB, and reserved subnets across AZs
module/vpc/subnets.tf - Routing · Internet and private routing for tiered network access
module/vpc/route_table.tf - Gateways · Internet gateway, NAT gateways, and secure instance access endpoint
module/vpc/gatway.tf - Security groups · Least-privilege ingress and egress boundaries between tiers
module/vpc/sg.tf - VPC data · Shared data sources and computed network values
module/vpc/data.tf
Traffic and compute
Load balancing, autoscaling, and instance identity
- EC2 base · Launch templates and IAM roles for web and app instances
module/ec2/launch_template.tf - Instance IAM · Permissions for SSM, Secrets Manager, and bootstrap access
module/ec2/role_policy.tf - ALBs · Public and internal application load balancers
module/app/alb.tf - Listeners · Front-door and east-west listener rules
module/app/listener.tf - Target groups · Targets for web and app tier load balancing
module/app/target_group.tf - Auto scaling · Web and app Auto Scaling Groups behind the load balancers
module/app/asg.tf
Data tier
Private database and persistence services
Bootstrap scripts
Instance startup and configuration loading
- Web bootstrap · Instance startup script for web tier setup
scripts/web_user_data.sh - App bootstrap · Instance startup script that pulls SSM and Secrets Manager config
scripts/app_user_data.sh
Connections 29
- Root stack → AWS provider: uses · Root stack is executed with the AWS provider
- Root stack → Remote state: stores state · Terraform state is kept in remote S3 backend
- Root stack → Root vars: configured by · Deployment settings are supplied through root variables
- Root stack → VPC: creates network · Root stack instantiates the shared VPC module
- Root stack → EC2 base: creates compute · Root stack instantiates the EC2 foundation module
- Root stack → ALBs: creates traffic · Root stack instantiates the traffic and autoscaling module
- Root stack → MySQL RDS: creates data · Root stack instantiates the database module
- VPC → Subnets: includes · VPC module defines subnet tiers and AZ placement
- VPC → Routing: includes · VPC module defines route tables and pathing
- VPC → Gateways: includes · VPC module defines internet, NAT, and secure access gateways
- VPC → Security groups: includes · VPC module defines security group boundaries
- VPC → VPC data: uses · VPC module reads computed network data
- VPC → EC2 base: feeds ids · Network identifiers and boundaries are consumed by compute resources
- VPC → ALBs: feeds ids · Load balancers and ASGs attach to VPC subnets and security groups
- VPC → MySQL RDS: feeds ids · Database is placed into private subnets with VPC security boundaries
- EC2 base → Instance IAM: attaches · Launch templates use IAM roles and instance profiles
- EC2 base → Web bootstrap: boots web · Web tier instances run the web bootstrap script
- EC2 base → App bootstrap: boots app · App tier instances run the app bootstrap script
- ALBs → Listeners: configures · ALBs expose public and internal listeners
- ALBs → Target groups: routes to · Listeners forward traffic to tier-specific target groups
- ALBs → Auto scaling: balances · Target groups register instances from both ASGs
- Target groups → Auto scaling: targets · Web and app target groups receive autoscaled instances
- Auto scaling → EC2 base: uses templates · ASGs launch instances from EC2 launch templates
- Auto scaling → Web bootstrap: initializes · Web ASG instances execute the web user-data entrypoint
- Auto scaling → App bootstrap: initializes · App ASG instances execute the app user-data entrypoint
- App bootstrap → MySQL RDS: reads config · App bootstrap fetches DB parameters and credentials for runtime
- MySQL RDS → DB config: configured by · Database module is driven by DB-specific inputs
- MySQL RDS → Security groups: restricted by · Only the private app tier can reach MySQL
- MySQL RDS → Instance IAM: publishes secrets · DB password and endpoint are integrated with AWS parameter and secret workflows