Building a Secure Three-Tier Architecture on AWS 🛡️
Learn to design and deploy a secure, scalable three-tier architecture using core AWS services.
📘Introduction
Most AWS tutorials focus on individual services, making it difficult to understand how they work together in a real-world environment. In this hands-on guide, you’ll build a complete three-tier architecture on AWS using a custom VPC, public and private subnets, an application server, Amazon RDS, and an Application Load Balancer. You’ll also implement AWS security best practices with least-privilege access and EC2 Instance Connect Endpoint. By the end, you’ll have clear understanding of how its components work together.
📋 Prerequisites
Before you begin, make sure you have:
- An AWS account with permissions to create AWS resources such as VPCs, EC2 instances, RDS databases, IAM roles, and load balancers.
- A basic understanding of AWS networking concepts, including VPCs, subnets, and routing.
- Familiarity with the AWS Management Console and basic Linux commands.
🔧 What You Will Build:
By the end of this guide, you’ll have:
- A secure three-tier AWS architecture with a custom VPC, public/private subnets, and an Application Load Balancer.
- A private EC2 application server connected to a private Amazon RDS MySQL database.
- Secure access to private resources using EC2 Instance Connect Endpoint and least-privilege security groups.
- A browser-accessible web application with a backend database that is never exposed to the public internet.
⚙️ Key Technologies
- Amazon VPC – Creates an isolated network with public and private subnets.
- Amazon EC2 – Hosts the web application.
- Amazon RDS (MySQL) – Stores application data in a managed database.
- Application Load Balancer (ALB) – Routes incoming traffic to the application securely.
- Security Groups – Control network access between different layers.
- IAM Roles – Provide secure AWS permissions to the EC2 instance.
- EC2 Instance Connect Endpoint – Enables secure access to private EC2 instances without a public IP.
- Gateway VPC Endpoint (S3) – Allows private access to Amazon S3 without internet or NAT Gateway.
🏛️ Architecture Diagram
🧩 Architecture Components
- Amazon VPC (10.0.0.0/16) – Provides an isolated network environment for all AWS resources.
- Public Subnets (2) – Host the Application Load Balancer and provide internet-facing access.
- Private Subnets (2) – Securely host the EC2 application server and Amazon RDS database.
- Internet Gateway (IGW) – Enables communication between the public subnets and the internet.
- Application Load Balancer (ALB) – Distributes incoming HTTP traffic to the application server.
- Amazon EC2 – Hosts the web application in a private subnet with no public IP address.
- Amazon RDS (MySQL) – Stores application data securely in a private subnet.
- EC2 Instance Connect Endpoint – Provides secure administrative access to the private EC2 instance without exposing SSH to the internet.
- Gateway VPC Endpoint (Amazon S3) – Allows the EC2 instance to access Amazon S3 privately without using a NAT Gateway or internet connection.
- Security Groups – Enforce least-privilege network access between the ALB, EC2 instance, and RDS database.
- Route Tables – Direct traffic between subnets, the Internet Gateway, and the S3 VPC Endpoint.
- Amazon S3 – Stores application assets and is accessed securely through the Gateway VPC Endpoint.
🛠️ Execution Workflow
I. Create the VPC
- Navigate to the VPC Console → Create VPC → select the "VPC and more" wizard.
- Configure the following:
- Name:
three-tier-vpc
- IPv4 CIDR:
10.0.0.0/16
- Availability Zones: 2
- Public subnets: 2
- Private subnets: 2
- NAT gateways: None
- VPC endpoints: S3 Gateway
- Click Create.
II. Verify the Layout
- In the VPC Console, navigate to Subnets and confirm the presence of 2 public subnets and 2 private subnets distributed across 2 Availability Zones.
- Confirm that both public subnets have "Auto-assign public IP" set to Yes.
III. Create Security Groups
- Create
alb-sg
- Attach to the Application Load Balancer (ALB).
- Add an inbound rule:
- Type: HTTP
- Port: 80
- Source:
0.0.0.0/0(Allow HTTP traffic from anywhere)
- Create
app-sg
- Attach to the EC2 application server(s).
- Add an inbound rule:
- Type: HTTP
- Port: 80
- Source:
alb-sg(Select the ALB security group as the source instead of an IP address)
- Create
db-sg
- Attach to the Amazon RDS database.
- Add an inbound rule:
- Type: MySQL/Aurora
- Port: 3306
- Source:
app-sg(Allow database access only from the application security group)
IV. Create an IAM Role for the Application
- Navigate to IAM Console → Roles → Create role.
- Configure the role:
- Trusted entity type: AWS service
- Use case: EC2
- Click Next.
- Search for and attach the policy:
- AmazonS3ReadOnlyAccess
- Click Next.
- Configure the role:
- Role name:
three-tier-app-role
- Description: Allows the application EC2 instance to read objects from Amazon S3.
- Click Create role.
V. Launch the App-Tier EC2 Instance
- Navigate to EC2 → Launch Instance.
- Instance Name:
three-tier-app-server
- Amazon Machine Image (AMI): Amazon Linux 2023
- Instance Type:
t3.micro
- VPC: Select your project VPC.
- Subnet: Choose a private subnet.
- Auto-assign Public IP: Disabled (None).
- Security Group: Select the existing
app-sgsecurity group.
- Key Pair: Select an existing key pair (or create one if required) for administrative access.
- In Advanced Details, under IAM instance profile, select
three-tier-app-role
- Launch the instance.
VI. Create a DB Subnet Group
- Navigate to Amazon RDS Console → Subnet groups → Create DB subnet group.
- Configure the subnet group:
- Name:
three-tier-db-subnet-group
- Description: Database subnet group for the three-tier architecture
- VPC:
three-tier-vpc
- Availability Zones: Select both Availability Zones.
- Subnets: Add both private subnets.
- Click Create.
VII. Create the RDS MySQL Database
- Navigate to Amazon RDS Console → Databases → Create database.
- Configure the database:
- Creation method: Full Configuration
- Engine type: MySQL
- Template: Free tier
- DB instance identifier:
three-tier-db
- Master username:
admin
- Master password: Create a secure password and store it safely.
- Instance class:
db.t3.micro
- Storage: Keep the default Free Tier settings.
- VPC:
three-tier-vpc
- DB subnet group:
three-tier-db-subnet-group
- Public access: No
- VPC security group: Select
db-sg
- Click Create database.
- Wait for the database status to change to Available before proceeding to the next step.
VIII. Create a Security Group for the EC2 Instance Connect Endpoint
- Navigate to Amazon VPC Console → Security Groups.
- Click Create security group.
- Configure the security group:
- Security group name:
three-tier-eic-sg
- Description: Security group for the EC2 Instance Connect Endpoint
- VPC:
three-tier-vpc
- Leave the Inbound rules section empty.
- Leave the default Outbound rule (
All traffic) unchanged.
- Click Create security group.
IX. Create an EC2 Instance Connect Endpoint
- Navigate to Amazon VPC Console → Endpoints → Create Endpoint.
- Configure the endpoint:
- Name:
three-tier-eic-endpoint
- Service category: AWS services
- Service: EC2 Instance Connect Endpoint
- VPC:
three-tier-vpc
- Subnet: Select one of the private subnets.
- Security group: Create a new security group named
three-tier-eic-sg
- Click Create endpoint.
X. Update the Application Security Group
- Navigate to VPC Console → Security Groups →
three-tier-app-sg.
- Add an inbound rule:
- Type: SSH
- Port: 22
- Source:
three-tier-eic-sg
- Save the changes.
- Connect to
three-tier-app-serverusing EC2 Instance Connect Endpoint.
XI. Verify S3 Access Through the Gateway VPC Endpoint
- Connect to
three-tier-app-serverusing the EC2 Instance Connect Endpoint.
- Verify that the AWS CLI is installed:
- List the available S3 buckets:
- The command should execute successfully even though the instance has no public IP address and no NAT Gateway, confirming that S3 traffic is routed through the Gateway VPC Endpoint.
XII. Verify Connectivity to the RDS Database
- Install the MySQL client on the EC2 instance:
- Retrieve the database endpoint from:
Amazon RDS Console → Databases →
three-tier-db→ Connectivity & security.
- Connect to the database
- Enter the database password when prompted.
- A successful connection confirms that the application tier can securely communicate with the private RDS database.
Step XIII. Deploy the Application Load Balancer
- Create the Target Group
- Navigate to EC2 Console → Target Groups → Create target group.
- Configure the target group:
- Target type: Instances
- Name:
three-tier-tg
- Protocol: HTTP
- Port:
80
- VPC:
three-tier-vpc
- Register
three-tier-app-serveras the target.
- Click Create target group.
XIII B. Create the Application Load Balancer
- Navigate to EC2 Console → Load Balancers → Create Load Balancer → Application Load Balancer.
- Configure the load balancer:
- Name:
three-tier-alb
- Scheme: Internet-facing
- VPC:
three-tier-vpc
- Subnets: Select both public subnets
- Security group:
alb-sg
- Listener: HTTP (Port 80)
- Default action: Forward requests to
three-tier-tg
- Click Create load balancer.
XIII C. Install a Test Web Server
- Connect to
three-tier-app-serverand run:
sudo dnf install -y httpd 
sudo systemctl enable httpd
sudo systemctl start httpdecho "<h1>Three-Tier AWS Architecture</h1>" | sudo tee /var/www/html/index.html
- Wait until the target health status changes to Healthy.
- Open the DNS name of
three-tier-albin a web browser.
XIV. Cleanup
To avoid unnecessary AWS charges after completing the project, delete the resources in the following order:
- Delete the Application Load Balancer and Target Group.
- Terminate the EC2 instance.
- Delete the EC2 Instance Connect Endpoint.
- Delete the Amazon RDS MySQL database and DB Subnet Group.
- Remove the IAM Role and all Security Groups.
- Delete the Amazon S3 Gateway VPC Endpoint.
- Detach and delete the Internet Gateway.
- Delete the public and private subnets, and finally delete the Amazon VPC.
This ensures all project resources are removed safely and helps prevent unexpected AWS charges.
🎓 Key Takeaways
- Layered Security – Each tier communicates only with the tier directly in front of it.
- Private by Design – EC2 and RDS stay private while remaining securely accessible.
- IAM Roles – Securely grant AWS permissions without storing access keys.
- Cost-Optimized Architecture – Use VPC Endpoints instead of a NAT Gateway for S3 access.
⚡Why This Solution Matters
This architecture follows AWS security best practices by keeping the application server and database private and allowing only the required traffic between each layer. It also reduces costs by using a Gateway VPC Endpoint instead of a NAT Gateway while relying on Free Tier–eligible resources where possible. The result is a secure, cost-effective foundation for modern web applications.
💻 Source Code & Repository
This repository contains the complete implementation of a AWS Three-Tier Architecture, including architecture documentation, deployment and cleanup guides, execution workflow, command reference, and detailed screenshots demonstrating the deployment, configuration, verification, and successful operation of a secure three-tier web application on AWS.
🎯 Conclusion
This three-tier architecture demonstrates a secure AWS deployment using industry best practices and can be further enhanced with features such as Auto Scaling, Multi-AZ RDS, HTTPS with an Application Load Balancer, and Amazon CloudWatch monitoring. Mastering this architecture establishes a solid base for designing reliable and secure cloud solutions.
🤝 Let’s Connect
Open to ideas, feedback, and meaningful collaboration:
🌐 Explore More
To see more of my projects and technical work, feel free to visit:
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article