advanced
Scenario & brief A three-tier system (web → app → data ) was deployed flat: every tier is
public and its security group trusts the entire VPC . One compromised host
can reach anything.
Segment it correctly:
ALB internet-facing; web, app, and database all in private
subnets ,each tier's security group accepts traffic only from the tier in front of
it (web ← ALB, app ← web, data ← app),
the database must be encrypted at rest and not reachable from the
internet , and
private subnets egress through a NAT gateway .
2,000 rps peak p99 ≤ 200ms 99.95% avail durability: critical budget $200/mo
public · ← internet
$22/mo
public · ← vpc
—
public · ← vpc
—
public · ← vpc
—
disabled
—
Load Balancer Web Tier App Tier Data Tier NAT Gateway Subnet placement
Public subnet Private subnet
Allowed ingress (security group)
Internet VPC only
System health
Erupting · SLA breach
Budget $200/mo · within budget
Requirements
Load balancer is internet-facing — internet-facing (need internet-facing) Web tier in a private subnet — public subnet (need private subnet) App tier in a private subnet — public subnet (need private subnet) Data tier in a private subnet — public subnet (need private subnet) Web tier accepts only from the ALB — from vpc (need only from alb) App tier accepts only from the web tier — from vpc (need only from web) Data tier accepts only from the app tier — from vpc (need only from app) Database not reachable from the internet — isolated (need not internet-reachable) Database encrypted at rest — plaintext (need encrypted at rest) Private subnets egress via NAT — no NAT (need private egress via NAT) Advisor
Web tier in a private subnet: Move it to the private subnet. App tier in a private subnet: Move it to the private subnet. Data tier in a private subnet: Move it to the private subnet. Web tier accepts only from the ALB: Restrict the security group to accept traffic only from alb. App tier accepts only from the web tier: Restrict the security group to accept traffic only from web. Data tier accepts only from the app tier: Restrict the security group to accept traffic only from app. Discussion top newest oldest
Sign in to join the discussion.
No comments yet. Be the first to start the discussion.
For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.
