# ishihab/aws_aws_three_tier_architecture architecture

> Architecture diagram of the GitHub repository ishihab/aws_aws_three_tier_architecture, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ishihab/aws_aws_three_tier_architecture
- Repository: https://github.com/ishihab/aws_aws_three_tier_architecture

## Overview

1. **What this repo is**
   - A Terraform-based AWS infrastructure project for a classic **3-tier architecture**: presentation/web, application, and data.
   - The root config (`main.tf`, `providers.tf`, `backend.tf`, `terraform.tf`, `variable.tf`) is the orchestration layer; the actual infrastructure is split into reusable modules under `module/`.

2. **State, provider, and deployment boundary**
   - Terraform uses an **S3 remote backend** for state storage and locking.
   - The AWS provider is the only major runtime dependency; there is no application code here, only infrastructure definitions and bootstrap scripts.

3. **Network foundation: `module/vpc`**
   - This module creates the shared network substrate: **VPC, subnets, route tables, internet gateway, NAT gateways, and security groups**.
   - The README indicates a multi-AZ layout with separate subnet tiers for **web/public**, **app/private**, and **DB/private**, plus reserved subnets.
   - It also creates an **EC2 Instance Connect Endpoint** so instances can be reached securely without a bastion host.

4. **Compute foundation: `module/ec2`**
   - This module defines **launch templates** and the associated **IAM roles / instance profiles** used by EC2 instances in the web and app tiers.
   - It is the place where instance-level permissions are attached, especially for AWS API access such as **SSM**, **Secrets Manager**, and related bootstrap operations.

5. **Traffic entry and load balancing: `module/app`**
   - Despite the folder name, this module is really the **traffic management + autoscaling tier**.
   - It creates a **public Application Load Balancer** for internet-facing traffic and an **internal/private ALB** for east-west traffic between tiers.
   - It also defines **target groups, listeners, and Auto Scaling Groups** for both web and application instances.

6. **Data tier: `module/rds`**
   - This module provisions the **MySQL RDS database** in private subnets.
   - It includes the DB subnet group, parameter group, **encryption/KMS**, and database-related storage/monitoring configuration.
   - The README also describes storing the DB password in **Secrets Manager** and the DB endpoint in **SSM Parameter Store**.

7. **End-to-end request flow**
   - External users hit the **public ALB** over HTTP/HTTPS.
   - The public ALB sends traffic to the **web tier instances** in the web/public subnets.
   - The web tier forwards to the **internal ALB**, which distributes requests to the **app tier instances** in private subnets.
   - The app tier connects to **RDS MySQL** in the private DB subnets.

8. **Bootstrap and configuration flow**
   - `scripts/web_user_data.sh` and `scripts/app_user_data.sh` are the instance bootstrap entry points.
   - They install runtime dependencies and, in the app tier, retrieve configuration from **SSM Parameter Store** and credentials from **Secrets Manager**.
   - This keeps database endpoints and passwords out of the Terraform code and out of the instance image.

9. **Security boundaries**
   - Access is segmented with **least-privilege security groups** between ALB, web, app, and DB tiers.
   - Direct SSH is avoided; administrative access is meant to go through **EC2 Instance Connect** using the endpoint and allowed source IPs.
   - The DB is not exposed publicly; only the private app tier can reach port **3306**.

10. **High availability and scaling**
   - The design is multi-AZ across the network, compute, and database layers.
   - Both web and app tiers use **Auto Scaling Groups** behind ALBs, and RDS is configured for **Multi-AZ** availability.
   - NAT gateways are deployed per AZ to preserve outbound access for private subnets without public exposure.

11. **Operations and observability**
   - RDS supports **enhanced monitoring**, backups, and maintenance windows.
   - The infrastructure is meant to be production-oriented, with outputs for the public ALB DNS, internal ALB DNS, and DB endpoint to support downstream deployment and validation.

12. **How to read the repo as an architecture diagram**
   - Think in four layers: **root orchestration**, **network foundation**, **compute/traffic layers**, and **data layer**.
   - The important directional dependencies are: `vpc` provides shared network IDs and security boundaries; `ec2` provides instance identity and bootstrap permissions; `app` wires traffic and scaling; `rds` exposes the private database endpoint and secrets.

Main entry points: [`module/vpc/vpc.tf`](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/vpc/vpc.tf) (VPC), [`main.tf`](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/main.tf) (Root stack), [`module/ec2/launch_template.tf`](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/ec2/launch_template.tf) (EC2 base), [`module/rds/db.tf`](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/rds/db.tf) (MySQL RDS)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_root["Root orchestration"]
  node_main["Root stack<br/>terraform root<br/>[main.tf]"]
  node_providers["AWS provider<br/>provider config<br/>[providers.tf]"]
  node_backend[("Remote state<br/>S3 backend<br/>[backend.tf]")]
  node_rootvars["Root vars<br/>inputs<br/>[variable.tf]"]
end

subgraph group_network["Network foundation"]
  node_vpc["VPC<br/>network module<br/>[vpc.tf]"]
  node_subnets["Subnets<br/>network layout<br/>[subnets.tf]"]
  node_routes["Routing<br/>route tables<br/>[route_table.tf]"]
  node_gateways["Gateways<br/>egress access<br/>[gatway.tf]"]
  node_security{{"Security groups<br/>network policy<br/>[sg.tf]"}}
  node_vpcdata["VPC data<br/>network lookups<br/>[data.tf]"]
end

subgraph group_compute["Traffic and compute"]
  node_ec2["EC2 base<br/>compute module<br/>[launch_template.tf]"]
  node_iam{{"Instance IAM<br/>role policy<br/>[role_policy.tf]"}}
  node_alb["ALBs<br/>traffic module<br/>[alb.tf]"]
  node_listeners["Listeners<br/>traffic config<br/>[listener.tf]"]
  node_tg["Target groups<br/>routing targets<br/>[target_group.tf]"]
  node_asg(("Auto scaling<br/>[asg.tf]"))
end

subgraph group_data["Data tier"]
  node_rds[("MySQL RDS<br/>database module<br/>[db.tf]")]
  node_dbvars["DB config<br/>db inputs<br/>[variable.tf]"]
end

subgraph group_bootstrap["Bootstrap scripts"]
  node_webboot["Web bootstrap<br/>userdata script<br/>[web_user_data.sh]"]
  node_appboot["App bootstrap<br/>userdata script<br/>[app_user_data.sh]"]
end

node_main -->|"uses"| node_providers
node_main -->|"stores state"| node_backend
node_main -->|"configured by"| node_rootvars
node_main -->|"creates network"| node_vpc
node_main -->|"creates compute"| node_ec2
node_main -->|"creates traffic"| node_alb
node_main -->|"creates data"| node_rds
node_vpc -->|"includes"| node_subnets
node_vpc -->|"includes"| node_routes
node_vpc -->|"includes"| node_gateways
node_vpc -->|"includes"| node_security
node_vpc -->|"uses"| node_vpcdata
node_vpc -.->|"feeds ids"| node_ec2
node_vpc -.->|"feeds ids"| node_alb
node_vpc -.->|"feeds ids"| node_rds
node_ec2 -->|"attaches"| node_iam
node_ec2 -.->|"boots web"| node_webboot
node_ec2 -.->|"boots app"| node_appboot
node_alb -->|"configures"| node_listeners
node_alb -->|"routes to"| node_tg
node_alb -->|"balances"| node_asg
node_tg -->|"targets"| node_asg
node_asg -->|"uses templates"| node_ec2
node_asg -.->|"initializes"| node_webboot
node_asg -.->|"initializes"| node_appboot
node_appboot -.->|"reads config"| node_rds
node_rds -->|"configured by"| node_dbvars
node_rds -.->|"restricted by"| node_security
node_rds -.->|"publishes secrets"| node_iam

click node_main "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/main.tf"
click node_providers "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/providers.tf"
click node_backend "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/backend.tf"
click node_rootvars "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/variable.tf"
click node_vpc "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/vpc/vpc.tf"
click node_subnets "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/vpc/subnets.tf"
click node_routes "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/vpc/route_table.tf"
click node_gateways "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/vpc/gatway.tf"
click node_security "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/vpc/sg.tf"
click node_vpcdata "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/vpc/data.tf"
click node_ec2 "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/ec2/launch_template.tf"
click node_iam "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/ec2/role_policy.tf"
click node_alb "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/app/alb.tf"
click node_listeners "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/app/listener.tf"
click node_tg "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/app/target_group.tf"
click node_asg "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/app/asg.tf"
click node_rds "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/rds/db.tf"
click node_dbvars "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/rds/variable.tf"
click node_webboot "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/scripts/web_user_data.sh"
click node_appboot "https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/scripts/app_user_data.sh"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_main,node_providers,node_backend,node_rootvars toneBlue
class node_vpc,node_subnets,node_routes,node_gateways,node_security,node_vpcdata toneAmber
class node_ec2,node_iam,node_alb,node_listeners,node_tg,node_asg toneMint
class node_rds,node_dbvars toneRose
class node_webboot,node_appboot toneIndigo
```

## Components

### Root orchestration

Terraform entrypoints and shared configuration

- [Root stack](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/main.tf): terraform root · Top-level Terraform orchestration for the three-tier deployment · `main.tf`
- [AWS provider](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/providers.tf): provider config · Primary runtime dependency for AWS resources · `providers.tf`
- [Remote state](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/backend.tf): S3 backend · Terraform state storage and locking boundary · `backend.tf`
- [Root vars](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/variable.tf): inputs · Deployment-wide variables and environment settings · `variable.tf`

### Network foundation

Shared VPC, subnets, routing, and security boundaries

- [VPC](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/vpc/vpc.tf): network module · Shared VPC, subnets, routes, gateways, and security groups · `module/vpc/vpc.tf`
- [Subnets](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/vpc/subnets.tf): network layout · Public, private, DB, and reserved subnets across AZs · `module/vpc/subnets.tf`
- [Routing](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/vpc/route_table.tf): route tables · Internet and private routing for tiered network access · `module/vpc/route_table.tf`
- [Gateways](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/vpc/gatway.tf): egress access · Internet gateway, NAT gateways, and secure instance access endpoint · `module/vpc/gatway.tf`
- [Security groups](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/vpc/sg.tf): network policy · Least-privilege ingress and egress boundaries between tiers · `module/vpc/sg.tf`
- [VPC data](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/vpc/data.tf): network lookups · Shared data sources and computed network values · `module/vpc/data.tf`

### Traffic and compute

Load balancing, autoscaling, and instance identity

- [EC2 base](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/ec2/launch_template.tf): compute module · Launch templates and IAM roles for web and app instances · `module/ec2/launch_template.tf`
- [Instance IAM](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/ec2/role_policy.tf): role policy · Permissions for SSM, Secrets Manager, and bootstrap access · `module/ec2/role_policy.tf`
- [ALBs](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/app/alb.tf): traffic module · Public and internal application load balancers · `module/app/alb.tf`
- [Listeners](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/app/listener.tf): traffic config · Front-door and east-west listener rules · `module/app/listener.tf`
- [Target groups](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/app/target_group.tf): routing targets · Targets for web and app tier load balancing · `module/app/target_group.tf`
- [Auto scaling](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/app/asg.tf): scaling · Web and app Auto Scaling Groups behind the load balancers · `module/app/asg.tf`

### Data tier

Private database and persistence services

- [MySQL RDS](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/rds/db.tf): database module · Private MySQL database with encryption, monitoring, and backups · `module/rds/db.tf`
- [DB config](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/module/rds/variable.tf): db inputs · Database sizing, subnet, and security inputs · `module/rds/variable.tf`

### Bootstrap scripts

Instance startup and configuration loading

- [Web bootstrap](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/scripts/web_user_data.sh): userdata script · Instance startup script for web tier setup · `scripts/web_user_data.sh`
- [App bootstrap](https://github.com/ishihab/aws_aws_three_tier_architecture/blob/main/scripts/app_user_data.sh): userdata script · Instance startup script that pulls SSM and Secrets Manager config · `scripts/app_user_data.sh`

## Connections

- Root stack → AWS provider: uses · Root stack is executed with the AWS provider
- Root stack → Remote state: stores state · Terraform state is kept in remote S3 backend
- Root stack → Root vars: configured by · Deployment settings are supplied through root variables
- Root stack → VPC: creates network · Root stack instantiates the shared VPC module
- Root stack → EC2 base: creates compute · Root stack instantiates the EC2 foundation module
- Root stack → ALBs: creates traffic · Root stack instantiates the traffic and autoscaling module
- Root stack → MySQL RDS: creates data · Root stack instantiates the database module
- VPC → Subnets: includes · VPC module defines subnet tiers and AZ placement
- VPC → Routing: includes · VPC module defines route tables and pathing
- VPC → Gateways: includes · VPC module defines internet, NAT, and secure access gateways
- VPC → Security groups: includes · VPC module defines security group boundaries
- VPC → VPC data: uses · VPC module reads computed network data
- VPC → EC2 base: feeds ids · Network identifiers and boundaries are consumed by compute resources
- VPC → ALBs: feeds ids · Load balancers and ASGs attach to VPC subnets and security groups
- VPC → MySQL RDS: feeds ids · Database is placed into private subnets with VPC security boundaries
- EC2 base → Instance IAM: attaches · Launch templates use IAM roles and instance profiles
- EC2 base → Web bootstrap: boots web · Web tier instances run the web bootstrap script
- EC2 base → App bootstrap: boots app · App tier instances run the app bootstrap script
- ALBs → Listeners: configures · ALBs expose public and internal listeners
- ALBs → Target groups: routes to · Listeners forward traffic to tier-specific target groups
- ALBs → Auto scaling: balances · Target groups register instances from both ASGs
- Target groups → Auto scaling: targets · Web and app target groups receive autoscaled instances
- Auto scaling → EC2 base: uses templates · ASGs launch instances from EC2 launch templates
- Auto scaling → Web bootstrap: initializes · Web ASG instances execute the web user-data entrypoint
- Auto scaling → App bootstrap: initializes · App ASG instances execute the app user-data entrypoint
- App bootstrap → MySQL RDS: reads config · App bootstrap fetches DB parameters and credentials for runtime
- MySQL RDS → DB config: configured by · Database module is driven by DB-specific inputs
- MySQL RDS → Security groups: restricted by · Only the private app tier can reach MySQL
- MySQL RDS → Instance IAM: publishes secrets · DB password and endpoint are integrated with AWS parameter and secret workflows