How to Build a 3-Tier Architecture in AWS with VPC, NAT Gateway and RDS

By Ravindra Bagale, trainer · LinkedIn · Last updated: 18 October 2026

1. Why three tiers

Why: suppose we are building a photo-sharing app. If the web page, the business code and the database all run on one public server, one hole in the web server exposes the database too, and you can't grow one part without growing everything.

1. Web tier: the only tier the internet can reach. It receives the browser's request.
2. App tier: the business code (here PHP). It has no public IP.
3. Database tier: the data. Only the app tier can talk to it.
4. Each tier sits in its own subnet with its own security group, so an attacker who reaches the web server still can't reach the database directly.

The idea of tiers and chained security groups is in What Is AWS VPC and How to Calculate CIDR IP Ranges. Here we build it.

2. The plan on paper

What we build (Region us-east-1):

Worked example: why these four CIDRs don't overlap

1. A /20 holds 4,096 IPs, which is 16 values of the 3rd octet.
2. WebSubnet: 10.0.0.0 to 10.0.15.255.
3. AppSubnet starts at the next IP: 10.0.16.0 to 10.0.31.255.
4. DBSubnet: 10.0.32.0 to 10.0.47.255.
5. DBSubnet2: 10.0.48.0 to 10.0.63.255.
6. Usable in each: 4,096 − 5 = 4,091.

The binary method is in How to Create Public and Private Subnets in AWS VPC.

3. Step 1: the VPC, subnets and the public route table

1. VPC > Your VPCs > Create VPC, VPC only, name ThreeTierVpc, CIDR 10.0.0.0/16, tenancy Default.
2. Subnets > Create subnet: create WebSubnet, AppSubnet and DBSubnet from the table.
3. Internet gateways > Create: ThreeTierIGW, then Actions > Attach to VPC ThreeTierVpc.
4. Route tables > Create: ThreeTierPublicRouteTable, add route 0.0.0.0/0 → ThreeTierIGW.
5. Subnet associations: associate only WebSubnet.
6. App and DB subnets stay on the main route table, which has only the local route, so they are private.

4. Step 2: the web server

1. Launch an Amazon Linux 2023 instance WebServer in WebSubnet, Auto-assign public IP enabled.
2. Security group web-sg: SSH 22 and HTTP 80 from 0.0.0.0/0 (for practice; in real work limit SSH to your own IP).
3. Connect and install Nginx:

sudo yum install nginx -y sudo service nginx start

1. Open http://<web-public-ip>/: the Nginx welcome page loads.

5. Step 3: the app server

1. Launch AppServer in AppSubnet, Auto-assign public IP disabled.
2. Security group app-sg: SSH 22 and HTTP 80 with source = web-sg (the web server's security group). Using the security group, not the web server's IP, keeps working even if the web server is replaced.
3. Your laptop can't reach it: it has no public IP.

How to log in: use the web server as a jump host. The clean way keeps the key on your laptop:

ssh -J ec2-user@<web-public-ip> ec2-user@<app-private-ip>

Why this is safer than copying the key to the web server is in How to Access a Private EC2 with a Bastion Host and NAT Gateway.

6. Step 4: a NAT gateway so the app server can install software

Why: sudo yum install php -y on the app server fails: its route table has no way to the internet.

1. NAT gateways > Create NAT gateway: name ThreeTierNAT, subnet WebSubnet (a public subnet), connectivity Public, Allocate Elastic IP.
2. Route tables > Create: ThreeTierPrivateRouteTable, route 0.0.0.0/0 → ThreeTierNAT, associate AppSubnet.
3. The NAT gateway has no route table of its own. The route to it lives in the private subnet's route table.
4. On the app server, install and start PHP and Nginx:

sudo yum install php -y sudo yum install nginx -y sudo service php-fpm start sudo service nginx start

1. In /usr/share/nginx/html/, remove index.html and create index.php:

```

App tier

```

1. Test on the app server itself: curl http://localhost/index.php prints the PHP page.

How the NAT gateway translates addresses is in How to Access a Private EC2 with a Bastion Host and NAT Gateway.

7. Step 5: the web server forwards to the app server

1. On the web server, edit /etc/nginx/nginx.conf. Inside the server block, set:

location / { proxy_pass http://<app-private-ip>:80; }

1. Check and reload:

sudo nginx -t sudo service nginx reload

1. Open http://<web-public-ip>/ in the browser: you now see the PHP page that runs on the private app server.

8. The NAT gateway only for installs

Why: a NAT gateway is charged for every hour it exists and for every GB it processes, and its Elastic IP is charged too. The app server needs the internet only when it installs or updates software.

1. Create the NAT gateway and the 0.0.0.0/0 route.
2. Install the software. Check the internet with ping google.com or curl -I https://aws.amazon.com.
3. Delete the NAT gateway, release its Elastic IP, and remove the route (it becomes a blackhole route).
4. Next time you need updates, create it again.

In production, servers usually keep the NAT gateway, because they patch often and pull packages at boot.

9. Zonal vs regional NAT gateway

1. Zonal NAT gateway (the classic one): lives in one public subnet in one AZ. If that AZ fails, private servers in other AZs lose their way out. For high availability you create one zonal NAT gateway per AZ, and each AZ's private route table points to its own.
2. Regional NAT gateway (available since November 2025): one NAT gateway for the whole VPC that automatically expands to the AZs where your workloads run. It doesn't need a public subnet, and you don't edit route tables each time you add an AZ.
3. For this practice build one zonal NAT gateway is enough.

10. Step 6: the DB subnet group

Why: RDS needs a DB subnet group with subnets in at least two AZs, so that it can place a standby in another AZ if you turn on Multi-AZ.

1. Subnets > Create subnet: DBSubnet2, us-east-1a, 10.0.48.0/20.
2. RDS > Subnet groups > Create DB subnet group: ThreeTierDBSubnetGroup, VPC ThreeTierVpc, subnets DBSubnet (1c) and DBSubnet2 (1a).

11. Step 7: create the RDS MySQL database

1. RDS > Create database > Standard create, engine MySQL, template Free tier.
2. DB identifier database-1, master username root, and your own strong password (never put it on a page or in code you share).
3. Instance class db.t3.micro or db.t4g.micro, storage 20 GB gp2, storage autoscaling up to 1000 GB.
4. VPC ThreeTierVpc, subnet group ThreeTierDBSubnetGroup, Public access: No.
5. New security group db-sg. Create database and wait until it is Available.

Why RDS instead of MySQL on your own EC2, and Multi-AZ vs read replicas, are in Amazon RDS Multi-AZ vs Read Replicas Explained.

12. Step 8: connect from the app server

1. On the app server install the MariaDB client:

sudo yum install mariadb105 -y

1. Connect: mysql -h <rds-endpoint> -u root -p.
2. If it hangs and then says it can't connect, the database security group is blocking you. Add to db-sg an inbound rule MYSQL/Aurora, TCP 3306, source app-sg.
3. Now the connection works. Create the database and a table:

CREATE DATABASE insta; USE insta; CREATE TABLE IF NOT EXISTS users ( id INT AUTO_INCREMENT PRIMARY KEY, username VARCHAR(100) NOT NULL, password VARCHAR(255) NOT NULL, mobile VARCHAR(20) NOT NULL ); SHOW TABLES; SELECT * FROM users;

1. For PHP pages to talk to MySQL, the app server also needs the PHP MySQL driver: sudo yum install php-mysqlnd -y, then sudo service php-fpm restart.

The chain of security groups:

1. web-sg: 80 from 0.0.0.0/0.
2. app-sg: 80 from web-sg.
3. db-sg: 3306 from app-sg.

Each tier accepts traffic only from the tier in front of it. A PHP form that writes into a table like this is built in How to Create a Registration Form in PHP and MySQL.

13. Where do photos and videos go: EBS vs S3

Why: suppose we are Instagram and store 100 TB of reels. Putting them on EBS disks of the app servers would be the wrong tool.

Worked example: an 8 GB EBS root volume that holds 2 GB of files is still billed for 8 GB. In S3 you pay for the 2 GB.

So the database (in RDS) stores the text data and the file's name or URL, and the photo or video itself goes to S3.

S3 gateway endpoint: a private server would normally reach S3 through the NAT gateway and pay NAT data charges. A gateway VPC endpoint for S3 adds a route in your route table that sends S3 traffic straight to S3 on AWS's network. Gateway endpoints for S3 have no extra charge.

14. IaaS, PaaS and SaaS

1. IaaS (Infrastructure as a Service), for example EC2: AWS gives you the virtual hardware. You install and patch the operating system, the database engine and your app.
2. PaaS (Platform as a Service), for example RDS: AWS runs and patches the OS and the MySQL engine and takes backups. You manage the data, tables and users.
3. SaaS (Software as a Service), for example Gmail: the whole application is ready. You just sign in and use it.
4. S3 is a fully managed storage service: you only upload and download objects, and AWS runs everything behind it.

15. When something goes wrong

1. The web page shows 502 Bad Gateway: Nginx on the web server can't reach the app server. Check the private IP in proxy_pass, that Nginx and php-fpm run on the app server, and that app-sg allows 80 from web-sg.
2. yum install hangs on the app server: no route to a NAT gateway, or the NAT gateway was deleted (blackhole route).
3. mysql -h ... times out: db-sg doesn't allow 3306 from app-sg, or you connect from a server outside the VPC while Public access is No.
4. RDS refuses the subnet group: it needs subnets in at least two AZs.
5. The bill is higher than expected: a NAT gateway or an unattached Elastic IP is still there. Delete what you don't use.

Next step: the production-style version of this build, with two Availability Zones, load balancers and Auto Scaling, click by click: How to Build a 3-Tier Architecture in AWS Step by Step (VPC, ALB, Auto Scaling, RDS).

16. The whole class on one page

1. Three tiers: web (public), app (private), database (private), each with its own subnet and security group.
2. VPC 10.0.0.0/16; /20 subnets at 10.0.0.0, 10.0.16.0, 10.0.32.0, 10.0.48.0.
3. Only the web subnet's route table has 0.0.0.0/0 → IGW.
4. The private app server is reached with ssh -J through the web server.
5. Nginx on the web server sends requests to the app server with proxy_pass.
6. A NAT gateway in a public subnet gives private servers a way out; the route is in the private route table.
7. A NAT gateway costs money every hour; for practice, create it for installs and delete it after.
8. Zonal NAT = one AZ; regional NAT = one gateway that follows your workloads across AZs.
9. RDS needs a DB subnet group with subnets in at least two AZs; keep Public access at No.
10. Security groups chain: 80 from web-sg, 3306 from app-sg.
11. Media goes to S3 (pay per GB stored), not EBS (pay for provisioned size); an S3 gateway endpoint avoids NAT charges.
12. IaaS = EC2, PaaS = RDS, SaaS = Gmail.

17. Try at home

Recap

Quick revision cards

Revise this lesson in two minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens its lesson.

More cards: Ravi Sir's Cards.