Multi-Tier Architecture Patterns

User Request Flow:
├── Route 53 (DNS Resolution)
│   └── Resolves to CloudFront or ALB
│
├── CloudFront (CDN - Optional)
│   ├── Caches static content at edge locations
│   ├── Reduces latency for global users
│   └── Offloads traffic from origin
│
├── Application Load Balancer (Internet-Facing)
│   ├── Deployed in PUBLIC subnets
│   ├── Has public IP addresses
│   ├── SSL/TLS termination
│   └── Routes to web tier instances
│
└── Web Servers (EC2 or Containers)
    ├── Can be in public OR private subnets
    ├── Serve dynamic content
    └── Forward API calls to app tier

Application Tier Architecture:

Internal ALB (in Private Subnets)
├── Receives requests from Web Tier only
├── No public IP - not internet accessible
├── Routes based on path or host headers
└── Health checks app server instances

Auto Scaling Group
├── Spans multiple Availability Zones
├── Minimum: 2 instances (high availability)
├── Scaling Policy: CPU > 70% = scale out
├── Scaling Policy: CPU < 30% = scale in
└── Instances in PRIVATE subnets

App Servers (EC2/Containers)
├── Run business logic
├── Connect to data tier
├── Stateless design (session in ElastiCache)
└── Access internet via NAT Gateway

VPC CIDR: 10.0.0.0/16 (65,536 IPs)

Availability Zone A                 Availability Zone B
─────────────────────               ─────────────────────
Public Subnet A                     Public Subnet B
10.0.1.0/24                         10.0.2.0/24
├── Internet Gateway                ├── Internet Gateway
├── NAT Gateway A                   ├── NAT Gateway B
├── ALB (internet-facing)           ├── ALB (internet-facing)
└── Bastion Host (optional)         └── Bastion Host (optional)

Private Subnet A (App)              Private Subnet B (App)
10.0.11.0/24                        10.0.12.0/24
├── Internal ALB                    ├── Internal ALB
├── App Server EC2                  ├── App Server EC2
└── Route: 0.0.0.0/0 → NAT-A        └── Route: 0.0.0.0/0 → NAT-B

Private Subnet A (DB)               Private Subnet B (DB)
10.0.21.0/24                        10.0.22.0/24
├── RDS Primary                     ├── RDS Standby (Multi-AZ)
├── ElastiCache Primary             ├── ElastiCache Replica
└── No internet route needed        └── No internet route needed

SG-ALB-Public (Internet-Facing ALB)
├── Inbound:  TCP 443 from 0.0.0.0/0 (HTTPS from internet)
├── Inbound:  TCP 80  from 0.0.0.0/0 (HTTP - redirect to HTTPS)
└── Outbound: TCP 80  to SG-Web-Tier

SG-Web-Tier (Web Servers)
├── Inbound:  TCP 80  from SG-ALB-Public
├── Outbound: TCP 80  to SG-ALB-Internal
└── Outbound: TCP 443 to 0.0.0.0/0 (for external APIs)

SG-ALB-Internal (Internal ALB)
├── Inbound:  TCP 80  from SG-Web-Tier
└── Outbound: TCP 8080 to SG-App-Tier

SG-App-Tier (Application Servers)
├── Inbound:  TCP 8080 from SG-ALB-Internal
├── Outbound: TCP 3306 to SG-Database (MySQL)
├── Outbound: TCP 6379 to SG-Cache (Redis)
└── Outbound: TCP 443  to 0.0.0.0/0 (via NAT)

SG-Database (RDS)
├── Inbound:  TCP 3306 from SG-App-Tier ONLY
└── Outbound: None required

SG-Cache (ElastiCache)
├── Inbound:  TCP 6379 from SG-App-Tier ONLY
└── Outbound: None required

INTERNET-FACING ALB (for Web Tier)
├── Scheme: internet-facing
├── Subnets: Public subnets (2+ AZs)
├── Security Group: SG-ALB-Public
├── Listeners:
│   ├── HTTPS:443 → Web Target Group
│   └── HTTP:80 → Redirect to HTTPS
└── Target Group:
    ├── Type: instance
    ├── Protocol: HTTP
    ├── Port: 80
    └── Health Check: /health

INTERNAL ALB (for App Tier)
├── Scheme: internal
├── Subnets: Private subnets (2+ AZs)
├── Security Group: SG-ALB-Internal
├── Listeners:
│   └── HTTP:80 → App Target Group
└── Target Group:
    ├── Type: instance
    ├── Protocol: HTTP
    ├── Port: 8080
    └── Health Check: /api/health

{
  "AutoScalingGroupName": "app-tier-asg",
  "PolicyName": "cpu-target-tracking",
  "PolicyType": "TargetTrackingScaling",
  "TargetTrackingConfiguration": {
    "PredefinedMetricSpecification": {
      "PredefinedMetricType": "ASGAverageCPUUtilization"
    },
    "TargetValue": 70.0,
    "ScaleInCooldown": 300,
    "ScaleOutCooldown": 60
  }
}

Serverless Three-Tier:

PRESENTATION TIER
├── Amazon S3
│   └── Static website hosting (React/Vue/Angular)
├── Amazon CloudFront
│   └── CDN + HTTPS + caching
└── Amazon Route 53
    └── DNS with health checks

APPLICATION TIER
├── Amazon API Gateway
│   ├── REST or HTTP APIs
│   ├── Request validation
│   ├── Rate limiting
│   └── Authorization (Cognito/Lambda)
├── AWS Lambda
│   ├── Business logic functions
│   ├── Auto-scales to demand
│   └── Pay per invocation
└── Amazon Cognito
    └── User authentication

DATA TIER
├── Amazon DynamoDB
│   ├── On-demand or provisioned
│   ├── Single-digit ms latency
│   └── Global tables for multi-region
└── Amazon S3
    └── Object storage for files

HIGH AVAILABILITY CHECKLIST:

✓ VPC spans 2+ Availability Zones
✓ Each tier has subnets in each AZ
✓ ALB configured for all AZs
✓ Auto Scaling Group spans all AZs
✓ RDS Multi-AZ enabled
✓ ElastiCache with replicas in different AZs
✓ NAT Gateway in each AZ (for resilience)
✓ Route 53 health checks configured

PRESENTATION TIER
├── 443 (HTTPS) - ALB listener
├── 80 (HTTP) - Redirect to HTTPS
└── 22 (SSH) - Bastion only

APPLICATION TIER
├── 8080 (HTTP) - App server
├── 8443 (HTTPS) - Secure app
└── Custom API ports

DATA TIER
├── 3306 (MySQL/Aurora)
├── 5432 (PostgreSQL)
├── 6379 (Redis)
├── 11211 (Memcached)
└── 27017 (MongoDB/DocumentDB)