🏛️

3-Tier Architecture

ALB → EC2 web tier → EC2 app tier → RDS PostgreSQL, each layer in its own subnet with its own security group.

What you can build with this

A network-segmented version of the Web App template for teams that need to isolate presentation, logic, and data layers — each EC2 tier only accepts traffic from the layer in front of it, and the database only accepts traffic from the app tier's subnet. Both EC2 tiers have no public IP and no SSH access; you reach them exclusively through SSM Session Manager. Two NAT Gateways (one per public subnet/AZ) give the private tiers outbound internet access for patching — this is the biggest recurring cost line beyond the instances themselves.

Deployment timing

After you run the deploy command, resources come online at different times. Check the validation steps in order.

Resource	Ready in
VPC, subnets, security groups	1–2 min
NAT Gateways (both AZs)	2–4 min
Load Balancer	2–3 min
EC2 instances launched + registered with SSM	3–5 min
RDS Database available	5–10 min
Your app starts accepting traffic	After you deploy and start both tiers

DNS / Certificate note: The load balancer DNS name is the correct Route53 alias target — never a raw IP, which can change. HTTPS requires a Certificate ARN set on the ALB node before export; the exported default is HTTP-only.

CloudFormation parameters

These are the values you will fill in when deploying the exported template. Changing these does not break the template — that is the point.

Parameter	What to provide	Example
Environment	Environment tag applied to resources (does not rename them)	dev