Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Build a classic 3-tier architecture in your own VPC: public subnets with an Application Load Balancer (and EC2 in an Auto Scaling Group, or a single instance), and private subnets holding an RDS database that is NOT publicly reachable. Lock it down with security groups (the app SG can reach the DB SG; the DB has no public ingress), give the EC2 an IAM role (no hard-coded keys), and route private-subnet egress through a NAT Gateway. Free-Tier sizing; tear down after.
Public/private subnets done right; RDS in private subnets, not internet-reachable; NAT for private egress; correct route tables.
SGs are least-privilege (app→DB only; no 0.0.0.0/0 to the DB); the instance uses an IAM role, not static keys.
App fronted by an ALB; ASG (or multi-AZ intent) for availability; health checks configured.
Free-Tier-conscious sizing; resources documented and removed (watch NAT Gateway cost).
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A 3-tier web app in a VPC with EC2 + RDS ## Goal Build a classic 3-tier architecture in your own VPC: public subnets with an Application Load Balancer (and EC2 in an Auto Scaling Group, or a single instance), and private subnets holding an RDS database that is NOT publicly reachable. Lock it down with security groups (the app SG can reach the DB SG; the DB has no public ingress), give the EC2 an IAM role (no hard-coded keys), and route private-subnet egress through a NAT Gateway. Free-Tier sizing; tear down after. ## Acceptance criteria - [ ] VPC & networking: Public/private subnets done right; RDS in private subnets, not internet-reachable; NAT for private egress; correct route tables. - [ ] Security groups & IAM: SGs are least-privilege (app→DB only; no 0.0.0.0/0 to the DB); the instance uses an IAM role, not static keys. - [ ] Compute & HA: App fronted by an ALB; ASG (or multi-AZ intent) for availability; health checks configured. - [ ] Cost & teardown: Free-Tier-conscious sizing; resources documented and removed (watch NAT Gateway cost). ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.