Chapter 46: Terraform 3-Tier Architecture Multi-AZ with ALBs Auto Scaling Bastion NAT and RDS

46.1 Multi-AZ 3-tier architecture: the picture and the file layout

By Ravindra Bagale · Last updated: 25 October 2026

Story. Suppose we are on a Netflix-style platform team running an online shop that must stay up even if one whole AWS data centre zone goes down. Every tier therefore runs in two Availability Zones, AZ-a and AZ-b. Users reach an internet-facing load balancer in the public subnets; it sends traffic to a web Auto Scaling group in private web subnets; the web servers call an internal load balancer that spreads requests over an app Auto Scaling group; and the app writes to an RDS database that has a standby copy in the other zone plus a read replica for reports. Admins enter only through a bastion jump server. This lesson is the map; each next lesson builds one part of it.

Steps

1. Study the picture: two zones, four subnet layers.
2. Create the folder layout shown.
3. Create an SSH key pair with ssh-keygen; keep the private key on your laptop with chmod 400.
4. Write versions.tf and variables.tf.
5. Run terraform init.

File layout

three-tier-multi-az/
├── versions.tf
├── variables.tf
├── network.tf        # VPC, 8 subnets, IGW, 2 NAT, route tables
├── security.tf       # 6 security groups chained
├── bastion.tf        # key pair + jump server
├── web.tf            # internet-facing ALB + web launch template + web ASG
├── app.tf            # internal ALB + app launch template + app ASG
├── db.tf             # DB subnet group + Multi-AZ RDS + read replica
├── outputs.tf
└── userdata/
    ├── web.sh.tftpl
    └── app.sh

# ---- versions.tf ----
terraform {
  required_version = ">= 1.6"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = var.region
}

# ---- variables.tf ----
variable "region" {
  type    = string
  default = "ap-south-1"
}

variable "project" {
  type    = string
  default = "shop3t"
}

variable "vpc_cidr" {
  type    = string
  default = "10.40.0.0/16"
}

variable "my_ip_cidr" {
  description = "Your public IP with /32, the only address allowed to SSH to the bastion"
  type        = string
  validation {
    condition     = can(cidrhost(var.my_ip_cidr, 0)) && endswith(var.my_ip_cidr, "/32")
    error_message = "Give a single address such as 203.0.113.10/32."
  }
}

variable "public_key_path" {
  type    = string
  default = "~/.ssh/shop3t.pub"
}

variable "instance_type" {
  type    = string
  default = "t3.micro"
}

variable "db_username" {
  type    = string
  default = "appadmin"
}

What each line does

• required_providers { aws = { version = "~> 5.0" } } — Pins the AWS provider to any 5.x release.
• provider "aws" { region = var.region } — Every resource is created in the region from variables.tf (Mumbai, ap-south-1, by default).
• variable "project" default = "shop3t" — A prefix for every name, so resources are easy to find and never clash.
• variable "vpc_cidr" default = "10.40.0.0/16" — The whole VPC range; subnets are carved from it.
• variable "my_ip_cidr" — Your own IP; the only source allowed to SSH to the bastion. No default, so Terraform asks.
• validation { ... endswith(var.my_ip_cidr, "/32") } — Rejects 0.0.0.0/0 or a wide range by mistake.
• variable "public_key_path" — Path to your SSH public key. The private key never goes into Terraform.
• variable "db_username" — The master user name. The password is generated by RDS.

When it is green.

$ ssh-keygen -t ed25519 -f ~/.ssh/shop3t -N ""
$ terraform init
Terraform has been successfully initialized!

When it is red.

$ terraform plan -var my_ip_cidr=0.0.0.0/0
Error: Invalid value for variable
  Give a single address such as 203.0.113.10/32.

Fix. The validation stopped an SSH rule open to the world. Find your IP with curl -s https://checkip.amazonaws.com and pass it with /32.

What: every term in plain English

• Availability Zone (AZ) — One or more data centres inside a region with its own power and network. Mumbai (ap-south-1) has three: ap-south-1a, 1b and 1c.
• multi-AZ — Every tier has a copy in at least two zones, so one zone going dark does not stop the app.
• 3-tier architecture — Web (presentation), app (business logic) and database (data) layers, each in its own subnets and security group.
• internet-facing ALB — An Application Load Balancer with a public DNS name, placed in public subnets, that receives user traffic.
• internal ALB — A load balancer with only private IPs, reachable only inside the VPC. Web servers call the app tier through it.
• Auto Scaling group (ASG) — A group that keeps a set number of EC2 servers alive, replaces sick ones and adds more under load.
• bastion host — A small jump server in a public subnet. Admins SSH to it first, then hop to private servers.
• read replica — A read-only copy of the database that serves reports and heavy reads, so the primary stays fast.

Example 1: Turn the picture into a resource checklist

At Flipkart design reviews, the architect first lists every box on the diagram. The list becomes the checklist you compare with terraform plan, so nothing is forgotten and nothing extra sneaks in.

1. Look at the picture from top to bottom.
2. Write one line per box with its count.
3. Add the totals; compare with the plan later.

Network   : 1 VPC, 8 subnets, 1 IGW, 2 EIP, 2 NAT, 4 route tables, 8 associations
Security  : 6 security groups + their rules
Bastion   : 1 key pair, 1 EC2
Web tier  : 1 external ALB, 1 target group, 1 listener, 1 launch template, 1 ASG, 1 policy
App tier  : 1 internal ALB, 1 target group, 1 listener, 1 launch template, 1 ASG, 1 policy
Database  : 1 DB subnet group, 1 primary (Multi-AZ), 1 read replica

terraform plan -out tfplan | tail -n 1

Output

Plan: 62 to add, 0 to change, 0 to destroy.

What it shows: If your count is very different from the checklist, a for_each map or a rule block is missing. Find it before you apply.

Example 2: Create the folder and empty files in one go

Infosys project templates keep one concern per file. A reviewer looking for NAT routes opens network.tf and nothing else.

1. Create the folder and the userdata sub-folder.
2. Touch every file.
3. List the tree.

mkdir -p three-tier-multi-az/userdata && cd three-tier-multi-az
touch versions.tf variables.tf network.tf security.tf bastion.tf web.tf app.tf db.tf outputs.tf
touch userdata/web.sh.tftpl userdata/app.sh
find . -type f | sort

Output

./app.tf
./bastion.tf
./db.tf
./network.tf
./outputs.tf
./security.tf
./userdata/app.sh
./userdata/web.sh.tftpl
./variables.tf
./versions.tf
./web.tf

What it shows: Boot scripts live in userdata/ and are loaded with templatefile() and filebase64(), so no script is pasted inside HCL.

Example 3: Make the SSH key safely

Banks such as HDFC never let a private key enter Terraform or Git. Only the public key goes to AWS; the private key stays on your laptop with owner-only permission.

1. Generate an ed25519 key pair.
2. Lock the private key with chmod 400.
3. Point var.public_key_path at the .pub file.

ssh-keygen -t ed25519 -f ~/.ssh/shop3t -N "" -C "shop3t-lab"
chmod 400 ~/.ssh/shop3t
ls -l ~/.ssh/shop3t ~/.ssh/shop3t.pub

Output

-r-------- 1 ravi ravi 411 Oct 25 07:40 /home/ravi/.ssh/shop3t
-rw-r--r-- 1 ravi ravi  98 Oct 25 07:40 /home/ravi/.ssh/shop3t.pub

What it shows: 400 means only you can read the private key. SSH refuses keys that other users can read.

Example 4: Find your own IP for the bastion rule

Opening SSH to 0.0.0.0/0 is the number one finding in security audits at companies like Paytm. We allow only your single address.

1. Ask the AWS check service for your IP.
2. Add /32.
3. Pass it with -var or a tfvars file.

MYIP=$(curl -s https://checkip.amazonaws.com)
echo "my_ip_cidr = \"$MYIP/32\"" > lab.auto.tfvars
cat lab.auto.tfvars

Output

my_ip_cidr = "203.0.113.10/32"

What it shows: Files ending in .auto.tfvars are loaded automatically, so you do not need to type -var every time. Add it to .gitignore.

Example 5: Let validation block a wide open rule

A validation block catches the mistake at plan time, before any security group exists. Reviewers at Zomato add these to every shared module.

1. Add validation to my_ip_cidr.
2. Try a bad value.
3. Read the error, then use your /32.

variable "my_ip_cidr" {
  description = "Your public IP with /32"
  type        = string
  validation {
    condition     = endswith(var.my_ip_cidr, "/32") && var.my_ip_cidr != "0.0.0.0/32"
    error_message = "Give a single address such as 203.0.113.10/32."
  }
}

terraform plan -var my_ip_cidr=10.0.0.0/8

Output

Error: Invalid value for variable
  on variables.tf line 12:
  Give a single address such as 203.0.113.10/32.

What it shows: Validation runs before Terraform talks to AWS, so the mistake costs nothing.

Example 6: Estimate the cost before you build

Two NAT gateways, two ALBs and a Multi-AZ RDS cost real money every hour. Teams at Razorpay check the rough cost first and always destroy labs the same day.

1. List the hourly items.
2. Multiply by the hours you will keep the lab.
3. Plan to destroy at the end.

Item                      Count   Approx per hour (ap-south-1)
NAT gateway               2       about 0.056 USD each
Application Load Balancer 2       about 0.024 USD each
RDS db.t3.micro Multi-AZ  1       about 0.04 USD
RDS read replica          1       about 0.02 USD
EC2 t3.micro              5       about 0.011 USD each

Output

Roughly 0.30 USD per hour for the whole stack, plus data transfer.
A 3 hour lab costs about 1 USD. Forgetting it for a month costs about 220 USD.

What it shows: The numbers are approximate; check the AWS pricing page for today. The lesson: destroy when you finish.

Command cheat sheet

Verify: did it work?

1. Folder has 11 files

   find . -type f | wc -l
   

   Output

   11
   

2. Key is locked

   stat -c %a ~/.ssh/shop3t
   

   Output

   400
   

3. Init worked

   terraform init | tail -n 1
   

   Output

   Terraform has been successfully initialized!
   

When it is red 1

Error: Invalid value for variable
  Give a single address such as 203.0.113.10/32.

Cause. my_ip_cidr is not a single /32 address.

Fix, step by step

1. Run curl -s https://checkip.amazonaws.com.
2. Add /32 and plan again.

When it is red 2

Permissions 0644 for '/home/ravi/.ssh/shop3t' are too open.

Cause. The private key can be read by other users.

Fix, step by step

1. Run chmod 400 ~/.ssh/shop3t.
2. SSH again.

When it is red 3

Error: Unsupported availability zone

Cause. The region you chose has a zone name that is not offered for this account.

Fix, step by step

1. Read zones from the aws_availability_zones data source.
2. Do not hard-code zone names.

Cleanup

terraform destroy -auto-approve
rm -f lab.auto.tfvars

Practice tasks

Homework: try at home

Recap

• Two zones, four subnet layers.
• External ALB for users, internal ALB for the app tier.
• Separate ASGs per tier.
• Bastion SSH from one /32 only.
• Estimate cost and destroy the same day.

FAQ

Why two zones and not three?

Two is the minimum for high availability and keeps the lab cheap. Production often uses three.

Why a separate internal ALB?

It lets web and app tiers scale and fail independently.

Can I skip the bastion?

Yes, if you use Session Manager. The bastion is shown because many companies still use it.

Is the private key ever in state?

No. Only the public key is uploaded.

Interview questions

1. What makes an architecture multi-AZ?

   Every tier, including the database, has capacity in at least two Availability Zones.

2. Why put web servers in private subnets?

   Users reach them only through the ALB, so the servers are never directly exposed.

3. What is the job of an internal ALB?

   To spread traffic from the web tier across app servers inside the VPC.

4. Where does a bastion live?

   In a public subnet, with SSH allowed only from known admin IPs.

Samajla ka?

Ravi Sir's Cards for this lesson

Revision cardInterview card

मराठी cards