← Reference architectures
Three-tier web application
Separate the tiers, then write what may cross
The classic web architecture: only the load balancer faces outward, while application servers and the database are reachable only from their own tiers. Each tier sits behind its own security group, and traffic between tiers is limited to ports you explicitly allow.
Tiers
-
Edge tier
- Gateway and firewall
- Load balancer
- Public IP
-
Application tier
- Application servers (scalable)
- Reachable only from the load balancer
- Not exposed directly
-
Data tier
- Managed database
- Reachable only from the application tier
- Automatic backups
Steps
- Create your VPC and define separate subnets for the tiers.
- Give each tier its own security group and open only the ports you need.
- Start your application servers and put a load balancer in front of them.
- Open your managed database in the data tier and define a backup policy.