How I Built a Terraform AWS 3-Tier Platform — Modules, VPC, and Least-Privilege Security Groups

#aws #devops #terraform #cloud

I recently built a complete AWS 3-tier infrastructure using Terraform —
fully modular, no console clicks, reproducible from a single terraform apply.

Here's the architecture, the key decisions, and what I learned.

Why 3-Tier?

Separating infrastructure into tiers isn't just good architecture theory —
it's a practical pattern that improves security, scalability, and maintainability.

Tier 1 (Presentation): Public-facing EC2 running Nginx via Docker
Tier 2 (Application): Private EC2 running business logic — no internet exposure
Tier 3 (Infrastructure): VPC, subnets, IGW, route tables, security groups

Networking Design

VPC:            10.0.0.0/16
Public Subnet:  10.0.1.0/24   # frontend (internet-facing)
Private Subnet: 10.0.11.0/24  # backend (isolated)

The public subnet connects via Internet Gateway.
The private subnet has no route to the internet — by design.

Modular Terraform Structure

No giant main.tf. Three clean modules:
modules/
├── vpc/ → VPC, subnets, IGW, route tables
├── sg/ → security groups per tier

└── ec2/ → instances + SG attachments

Least Privilege Security Groups

# Frontend: accessible from internet
ingress: 8080, 22 from 0.0.0.0/0

# Backend: ONLY reachable from frontend SG
ingress: 3000 from frontend_sg_id (NOT from 0.0.0.0/0)