AWS Multi-Tier VPC Architecture: Production Blueprint
AWS Multi-Tier VPC Architecture Blueprint
A robust cloud infrastructure requires strong network segregation, least-privilege security groups, and redundant availability zones.
TIP
Always deploy resources across a minimum of two Availability Zones (AZs) to ensure fault tolerance during AWS regional service maintenance.
Subnet CIDR Partitioning Scheme (10.0.0.0/16)
| Subnet Tier | AZ-A CIDR | AZ-B CIDR | Route Table Target | Description |
|---|---|---|---|---|
| Public | 10.0.1.0/24 | 10.0.2.0/24 | Internet Gateway (igw-xxxx) | ALBs, Bastion, NAT Gateways |
| App / Compute | 10.0.10.0/24 | 10.0.20.0/24 | NAT Gateway (nat-xxxx) | EC2 instances, ECS/EKS nodes |
| Database | 10.0.100.0/24 | 10.0.200.0/24 | Local Only (No Internet) | Aurora / RDS, ElastiCache |
Network Topology Diagram
graph LR
User([Internet Users]) --> IGW[Internet Gateway]
subgraph VPC [AWS VPC: 10.0.0.0/16]
subgraph PublicSubnets [Public Tier: Subnet 10.0.1.0/24]
IGW --> ALB[Application Load Balancer]
NAT[NAT Gateway]
end
subgraph PrivateSubnets [Private App Tier: Subnet 10.0.10.0/24]
ALB --> EC2_1[Web / App Server A]
ALB --> EC2_2[Web / App Server B]
EC2_1 --> NAT
EC2_2 --> NAT
end
subgraph DBSubnets [Isolated DB Tier: Subnet 10.0.100.0/24]
EC2_1 --> RDS[(RDS Primary Database)]
EC2_2 --> RDS
end
endSecurity Group Matrix Rules
bash
# App Tier Security Group (Allow traffic only from ALB)
aws ec2 authorize-security-group-ingress \
--group-id sg-app-tier \
--protocol tcp \
--port 8080 \
--source-group sg-alb
# DB Tier Security Group (Allow traffic only from App Tier)
aws ec2 authorize-security-group-ingress \
--group-id sg-db-tier \
--protocol tcp \
--port 3306 \
--source-group sg-app-tier