InsideEdgeInsideEdge
Download App
Stop 14 · Build Your Cloud PortfolioProjects · 1/7

Deploy a 3-Tier Web Application on AWS / Azure / GCP

Part of the Cloud Computing Roadmap

In short

Interviewers ask about this project most. A web tier, an app tier and a database, each in its own subnet, each talking only to its neighbour. Build it once, explain it for years.

The flagship portfolio piece — deploy a realistic application with a web tier, application tier, and database tier, wiring together compute, networking, and database services from earlier phases.

The blob character carries a tray of food from a kitchen hatch, with grain sacks stored behind.

Think of it like this

Front, kitchen, store room

At a busy dhaba, waiters take orders out front. Cooks work in the kitchen and never walk to tables. Only the cooks fetch rice and dal from the locked store room. Customers never see the store room at all.

Watch it happen

One request through three tiers

Browser
Load balancer
App tier
Database

GET /menu (HTTPS)

1/6Only the load balancer sits in a public subnet. It's the single door from the internet.

The big ideas

What you need to know

Three tiers, three subnets

Public subnet for the load balancer, private subnets for app servers and the database, across two availability zones.

Security groups chain

Each tier accepts traffic only from the tier in front of it. Nothing reaches the database from the internet.

No passwords in code

Keep the database password in a secrets manager and let the app read it through its IAM role.

Diagram plus README

An architecture diagram and a short README on why you chose each piece matter as much as the code.

See it in code

Walk through the code

hcl
1resource "aws_vpc_security_group_ingress_rule" "app_from_alb" {2  security_group_id            = aws_security_group.app.id3  referenced_security_group_id = aws_security_group.alb.id4  ip_protocol                  = "tcp"5  from_port                    = 80806  to_port                      = 80807}8 9resource "aws_vpc_security_group_ingress_rule" "db_from_app" {10  security_group_id            = aws_security_group.db.id11  referenced_security_group_id = aws_security_group.app.id12  ip_protocol                  = "tcp"13  from_port                    = 543214  to_port                      = 543215}

1/4App servers accept traffic whose source is the load balancer's security group.

The trickiest part to get right: rules that point at other security groups, not IP ranges. Azure and GCP have similar ideas with NSGs and firewall tags.

Save yourself the pain

Common mistakes

Oops

Putting the database in a public subnet so you can connect from your laptop easily.

Do this instead

Keep it private. Connect through a bastion, SSM Session Manager or a short-lived tunnel.

Oops

Leaving the whole stack running after the demo and getting a surprise bill.

Do this instead

Build it with IaC, take screenshots and a short video, then destroy it. Rebuild for interviews.

Your mission

First milestone: the network

~45 min

Quick check

Why should the database security group allow traffic from the app tier's security group instead of a CIDR range?

Go deeper

  1. 1Design a proper 3-tier architecture: load-balanced web tier, app tier, and a managed database.
  2. 2Deploy it for real, not just as a diagram — including networking, security groups, and IAM roles.
  3. 3Write a README explaining your architecture decisions and how it would scale.

More projects at this stop

Serverless API ProjectInfrastructure as Code Project (Multi-Environment)Highly Available Architecture ProjectCost-Optimized Migration Case StudyMonitoring & Alerting Setup ProjectPortfolio Website or GitHub Showcase

Stuck on this topic? Ask an Insider

Get 1:1 guidance from people who've walked this exact path — on the InsideEdge app.

Download
InsideEdge