# karimrabiee/aws-secure-scalable-web-application-architecture architecture

> Architecture diagram of the GitHub repository karimrabiee/aws-secure-scalable-web-application-architecture, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/karimrabiee/aws-secure-scalable-web-application-architecture
- Repository: https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture

## Overview

Nimbus Store is a Flask storefront deployed on private, two-AZ AWS infrastructure. A user browses products and places orders through the web tier; the application reads products and writes orders in RDS. Terraform defines the platform, while the documented guarded GitHub Actions flow delivers infrastructure changes. Relationships among sampled application components are supported by source excerpts; most AWS wiring and delivery details are documented in the README rather than sampled Terraform or workflow source.

Main entry points: [`terraform/environments/dev/main.tf`](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/environments/dev/main.tf) (Dev and prod stacks), [`terraform/modules/compute/app-src/app.py`](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/compute/app-src/app.py) (Web entry), [`terraform/modules/compute/main.tf`](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/compute/main.tf) (Private app tier), [`terraform/modules/compute/app-src/db.py`](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/compute/app-src/db.py) (Database access)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_storefront["Storefront"]
  node_storefront_ui["Storefront UI"]
  node_order_client["Order client<br/>[app.js]"]
  node_web_entry["Web entry<br/>[app.py]"]
  node_database_layer["Database access<br/>[db.py]"]
end

subgraph group_platform["AWS platform"]
  node_alb["Application load balancer<br/>[main.tf]"]
  node_compute["Private app tier<br/>[main.tf]"]
  node_networking["VPC networking<br/>[main.tf]"]
  node_rds[("RDS MySQL<br/>[main.tf]")]
end

subgraph group_security_ops["Security and operations"]
  node_waf{{"AWS WAF<br/>[main.tf]"}}
  node_secrets["Secrets Manager<br/>[main.tf]"]
  node_security{{"IAM and security groups<br/>[main.tf]"}}
  node_monitoring["Alarms and logs<br/>[main.tf]"]
end

subgraph group_delivery["Infrastructure delivery"]
  node_github["GitHub Actions"]
  node_oidc["AWS OIDC role<br/>[main.tf]"]
  node_environment["Dev and prod stacks<br/>[main.tf]"]
end

node_shopper(("Shopper"))

node_shopper -->|"requests storefront"| node_waf
node_waf -->|"filters traffic"| node_alb
node_alb -->|"routes requests"| node_compute
node_compute -->|"serves Flask"| node_web_entry
node_web_entry -->|"renders pages"| node_storefront_ui
node_storefront_ui -->|"loads client"| node_order_client
node_order_client -->|"posts orders"| node_web_entry
node_web_entry -->|"calls data access"| node_database_layer
node_database_layer -->|"reads and writes"| node_rds
node_database_layer -->|"retrieves credentials"| node_secrets
node_environment -->|"configures network"| node_networking
node_environment -->|"configures ingress"| node_alb
node_environment -->|"configures app tier"| node_compute
node_environment -->|"configures database"| node_rds
node_environment -->|"configures protection"| node_waf
node_environment -->|"configures access"| node_security
node_environment -->|"configures observability"| node_monitoring
node_compute -->|"reads secret"| node_secrets
node_monitoring -->|"observes services"| node_rds
node_monitoring -->|"alerts through SNS"| node_github
node_github -->|"authenticates with OIDC"| node_oidc
node_github -->|"plans and applies"| node_environment

click node_storefront_ui "https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/tree/main/terraform/modules/compute/app-src/templates"
click node_order_client "https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/compute/app-src/static/js/app.js"
click node_web_entry "https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/compute/app-src/app.py"
click node_database_layer "https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/compute/app-src/db.py"
click node_waf "https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/waf/main.tf"
click node_alb "https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/alb/main.tf"
click node_compute "https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/compute/main.tf"
click node_networking "https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/networking/main.tf"
click node_rds "https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/database/main.tf"
click node_secrets "https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/security-services/main.tf"
click node_security "https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/security/main.tf"
click node_monitoring "https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/monitoring/main.tf"
click node_github "https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/.github/workflows/terraform-deploy.yml"
click node_oidc "https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/security/main.tf"
click node_environment "https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/environments/dev/main.tf"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_storefront_ui,node_order_client,node_web_entry,node_database_layer toneBlue
class node_alb,node_compute,node_networking,node_rds toneAmber
class node_waf,node_secrets,node_security,node_monitoring toneMint
class node_github,node_oidc,node_environment toneRose
class node_shopper toneIndigo
```

## Components

### Storefront

- [Storefront UI](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/tree/main/terraform/modules/compute/app-src/templates): `terraform/modules/compute/app-src/templates`
- [Order client](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/compute/app-src/static/js/app.js): `terraform/modules/compute/app-src/static/js/app.js`
- [Web entry](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/compute/app-src/app.py): `terraform/modules/compute/app-src/app.py`
- [Database access](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/compute/app-src/db.py): `terraform/modules/compute/app-src/db.py`

### AWS platform

- [Application load balancer](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/alb/main.tf): `terraform/modules/alb/main.tf`
- [Private app tier](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/compute/main.tf): `terraform/modules/compute/main.tf`
- [VPC networking](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/networking/main.tf): `terraform/modules/networking/main.tf`
- [RDS MySQL](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/database/main.tf): `terraform/modules/database/main.tf`

### Security and operations

- [AWS WAF](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/waf/main.tf): `terraform/modules/waf/main.tf`
- [Secrets Manager](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/security-services/main.tf): `terraform/modules/security-services/main.tf`
- [IAM and security groups](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/security/main.tf): `terraform/modules/security/main.tf`
- [Alarms and logs](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/monitoring/main.tf): `terraform/modules/monitoring/main.tf`

### Infrastructure delivery

- [GitHub Actions](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/.github/workflows/terraform-deploy.yml): `.github/workflows/terraform-deploy.yml`
- [AWS OIDC role](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/modules/security/main.tf): `terraform/modules/security/main.tf`
- [Dev and prod stacks](https://github.com/karimrabiee/aws-secure-scalable-web-application-architecture/blob/main/terraform/environments/dev/main.tf): `terraform/environments/dev/main.tf`

### Other components

- **Shopper**

## Connections

- Shopper → AWS WAF: requests storefront (evidence: `README.md`)
- AWS WAF → Application load balancer: filters traffic (evidence: `README.md`)
- Application load balancer → Private app tier: routes requests (evidence: `README.md`)
- Private app tier → Web entry: serves Flask (evidence: `README.md`)
- Web entry → Storefront UI: renders pages (evidence: `terraform/modules/compute/app-src/app.py`)
- Storefront UI → Order client: loads client (evidence: `README.md`)
- Order client → Web entry: posts orders (evidence: `terraform/modules/compute/app-src/static/js/app.js`)
- Web entry → Database access: calls data access (evidence: `terraform/modules/compute/app-src/app.py`)
- Database access → RDS MySQL: reads and writes (evidence: `README.md`)
- Database access → Secrets Manager: retrieves credentials (evidence: `terraform/modules/compute/app-src/db.py`)
- Dev and prod stacks → VPC networking: configures network (evidence: `README.md`)
- Dev and prod stacks → Application load balancer: configures ingress (evidence: `README.md`)
- Dev and prod stacks → Private app tier: configures app tier (evidence: `README.md`)
- Dev and prod stacks → RDS MySQL: configures database (evidence: `README.md`)
- Dev and prod stacks → AWS WAF: configures protection (evidence: `README.md`)
- Dev and prod stacks → IAM and security groups: configures access (evidence: `README.md`)
- Dev and prod stacks → Alarms and logs: configures observability (evidence: `README.md`)
- Private app tier → Secrets Manager: reads secret (evidence: `README.md`)
- Alarms and logs → RDS MySQL: observes services (evidence: `README.md`)
- Alarms and logs → GitHub Actions: alerts through SNS (evidence: `README.md`)
- GitHub Actions → AWS OIDC role: authenticates with OIDC (evidence: `README.md`)
- GitHub Actions → Dev and prod stacks: plans and applies (evidence: `README.md`)