Three-Tier on AWS: One Direction Through Three Zones

Three-Tier on AWS: One Direction Through Three Zones An architecture diagram generated by Archify. Users · browser, mobile · Architecture component Users browser, mobile Route 53 + CloudFront · TLS, edge cache · Architecture component · presentation tier Route 53 + CloudFront TLS, edge cache presentation tier S3 frontend · private, via OAC · Architecture component S3 frontend private, via OAC AWS WAF · filters /api · Architecture component AWS WAF filters /api ALB · public subnets, 2+ AZs · Architecture component · only entry to the app tier ALB public subnets, 2+ AZs only entry to the app tier EC2 app, AZ-A · private subnet · AZ-A · stateless, Auto Scaling EC2 app, AZ-A private subnet stateless, Auto Scaling EC2 app, AZ-B · private subnet · AZ-B · stateless, Auto Scaling EC2 app, AZ-B private subnet stateless, Auto Scaling NAT Gateway A · outbound, this AZ only · AZ-A · one per AZ NAT Gateway A outbound, this AZ only one per AZ NAT Gateway B · outbound, this AZ only · AZ-B · one per AZ NAT Gateway B outbound, this AZ only one per AZ Data tier · Aurora Multi-AZ + Redis · Architecture component · S3 media, documents too Data tier Aurora Multi-AZ + Redis S3 media, documents too Internet · outbound traffic · Architecture component Internet outbound traffic /api static AZ-A AZ-B Legend Backend Database Cloud Security External

The Security Group Chain

  • • ALB group accepts 443 from the internet
  • • App group accepts its port from the ALB group
  • • Database group accepts its port from the app group
  • • No rule names an IP range

Multi-AZ Is A Claim

  • • One NAT in one AZ makes outbound single-AZ
  • • Lose that AZ: the other is up but cut off
  • • A NAT per AZ, with per-AZ route tables
  • • Remove an AZ on purpose and watch

Read The Status Code

  • • 502: the app gave no valid response
  • • 503: no healthy target, check the target group
  • • Slow site: walk the chain, database first
  • • Do not resize the instance first