Chapter 78: DevOps Projects Part 8: Terraform Three-Tier EKS CI Drift CloudFormation Infracost

78.1 Project 55: Three-tier AWS architecture with ALB ASG and RDS

By Ravindra Bagale Last updated: 28 October 2026

Friends, a real web app needs a load balancer, auto-scaled app nodes, and a managed database. Today we sketch that three-tier stack in Terraform: VPC subnets, ALB, launch template, ASG, and RDS notes — with cost warnings before any paid apply.

What you will build in this project

Public subnets for ALB and private for app and data.
ALB and target group HCL.
Launch template plus ASG.
RDS subnet group notes without forced paid apply.

1. Start from a real company story

At Flipkart in Bengaluru, a flash sale hit a single EC2 behind a classic ELB. The box saturated and checkout queued.

Peak loss was rough: about ₹2 crore in abandoned carts that afternoon.

Sana rebuilt the tier with an ALB, an ASG across two AZs, and RDS Multi-AZ as the data tier.

Today we write that three-tier shape in Terraform.

Picture 1: users → ALB → ASG app tier → RDS data tier

Ravindra Bagale's Tip

Students put RDS in a public subnet so they can connect from a laptop. Databases stay private. Use a bastion or VPN. Keep that habit.

2. Start and prepare

Step 1: Why three tiers

Why: Blast radius stays small when web, app, and data are separate. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo the pattern then write HCL folders. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: a1

Type this:

echo 'Tier 1 ALB public; Tier 2 app ASG private; Tier 3 RDS private'

You will see:

Tier 1 ALB public; Tier 2 app ASG private; Tier 3 RDS private

What it means: Pattern.

Example 2: a2

Type this:

echo 'A single EC2 holding app and database fails flash sales'

You will see:

A single EC2 holding app and database fails flash sales

What it means: Anti-pattern.

Example 3: a3

Type this:

echo 'Today we write the HCL shape; paid apply is optional and warned'

You will see:

Today we write the HCL shape; paid apply is optional and warned

What it means: Lab note.

Step 2: Cost gate

Why: Know what bills before apply. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: Write COST.txt and read it aloud. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: b1

Type this:

mkdir -p /tmp/tf55 && printf '%s\n' 'COST WARNING:' '- ALB hourly' '- NAT if used' '- RDS even when idle' '- ASG nodes = desired count x instance' 'Destroy when the lab ends.' > /tmp/tf55/COST.txt && cat /tmp/tf55/COST.txt

You will see:

COST WARNING:

What it means: Cost gate written.

Example 5: b2

Type this:

terraform version 2>/dev/null | head -1 || echo 'Terraform v1.9.0'

You will see:

Terraform v1.9.0

What it means: Terraform ready.

Example 6: b3

Type this:

echo 'Skip terraform apply for RDS until finance or a free-tier plan is clear'

You will see:

Skip terraform apply for RDS until finance or a free-tier plan is clear

What it means: Apply gate.

Step 3: Folder and provider

Why: One stack folder. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: provider in ap-south-1. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: c1

Type this:

printf '%s\n' 'terraform {' '  required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } }' '}' 'provider "aws" { region = "ap-south-1" }' > /tmp/tf55/provider.tf && grep region /tmp/tf55/provider.tf

You will see:

provider "aws" { region = "ap-south-1" }

What it means: Provider set.

Example 8: c2

Type this:

printf '%s\n' '.terraform/' '*.tfstate*' > /tmp/tf55/.gitignore && cat /tmp/tf55/.gitignore

You will see:

.terraform/

What it means: Gitignore.

Example 9: c3

Type this:

echo 'Reuse VPC ids from project 50 outputs or a data source in a real org'

You will see:

Reuse VPC ids from project 50 outputs or a data source in a real org

What it means: VPC reuse tip.

3. Build the main pieces

Step 4: Subnet skeleton

Why: Public for ALB, private for app and data. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: printf subnet locals. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: d1

Type this:

printf '%s\n' 'locals {' '  public_subnet_ids  = ["subnet-pub-a", "subnet-pub-b"]' '  private_app_ids    = ["subnet-app-a", "subnet-app-b"]' '  private_data_ids   = ["subnet-data-a", "subnet-data-b"]' '}' > /tmp/tf55/locals.tf && cat /tmp/tf55/locals.tf

You will see:

private_data_ids

What it means: Subnet id placeholders.

Example 11: d2

Type this:

echo 'Replace placeholders with real subnet ids from your VPC stack outputs'

You will see:

Replace placeholders with real subnet ids from your VPC stack outputs

What it means: Wire tip.

Example 12: d3

Type this:

echo 'Two AZs minimum for ALB and ASG in production'

You will see:

Two AZs minimum for ALB and ASG in production

What it means: HA tip.

Step 5: ALB HCL

Why: Public entry point. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: aws_lb and listener sketch. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: e1

Type this:

printf '%s\n' 'resource "aws_lb" "app" {' '  name               = "shop-alb"' '  load_balancer_type = "application"' '  internal           = false' '  subnets            = local.public_subnet_ids' '  security_groups    = ["sg-alb"]' '  tags = { Name = "shop-alb", Tier = "web" }' '}' > /tmp/tf55/alb.tf && cat /tmp/tf55/alb.tf

You will see:

load_balancer_type = "application"

What it means: ALB resource.

Example 14: e2

Type this:

printf '%s\n' 'resource "aws_lb_target_group" "app" {' '  name     = "shop-app-tg"' '  port     = 80' '  protocol = "HTTP"' '  vpc_id   = "vpc-shop"' '  health_check { path = "/health" matcher = "200" }' '}' >> /tmp/tf55/alb.tf && grep target_group /tmp/tf55/alb.tf | head -1

You will see:

resource "aws_lb_target_group" "app" {

What it means: Target group with health check.

Example 15: e3

Type this:

echo 'Listener forwards 80 to the target group; add 443 with an ACM cert next'

You will see:

Listener forwards 80 to the target group; add 443 with an ACM cert next

What it means: Listener tip.

Step 6: Launch template

Why: App AMI and user data tip. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: aws_launch_template. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: f1

Type this:

printf '%s\n' 'resource "aws_launch_template" "app" {' '  name_prefix   = "shop-app-"' '  image_id      = "ami-al2023"' '  instance_type = "t3.micro"' '  vpc_security_group_ids = ["sg-app"]' '  user_data = base64encode("#!/bin/bash\necho ok > /var/www/html/health")' '  tag_specifications {' '    resource_type = "instance"' '    tags = { Name = "shop-app", Tier = "app" }' '  }' '}' > /tmp/tf55/lt.tf && wc -l /tmp/tf55/lt.tf

You will see:

12 /tmp/tf55/lt.tf

What it means: Launch template written.

Example 17: f2

Type this:

echo 'image_id should be a data.aws_ami id in a finished stack'

You will see:

image_id should be a data.aws_ami id in a finished stack

What it means: AMI tip.

Example 18: f3

Type this:

echo 'user_data installs the app agent — keep secrets out of user_data'

You will see:

user_data installs the app agent — keep secrets out of user_data

What it means: Secret tip.

4. Automate and verify

Step 7: ASG HCL

Why: Desired capacity across AZs. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: aws_autoscaling_group. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: g1

Type this:

printf '%s\n' 'resource "aws_autoscaling_group" "app" {' '  name                      = "shop-app-asg"' '  min_size                  = 2' '  max_size                  = 6' '  desired_capacity          = 2' '  vpc_zone_identifier       = local.private_app_ids' '  health_check_type         = "ELB"' '  health_check_grace_period = 60' '  launch_template { id = aws_launch_template.app.id version = "$Latest" }' '  target_group_arns = [aws_lb_target_group.app.arn]' '}' > /tmp/tf55/asg.tf && grep desired /tmp/tf55/asg.tf

You will see:

desired_capacity          = 2

What it means: ASG with ELB health check.

Example 20: g2

Type this:

echo 'health_check_type ELB uses the target group health path'

You will see:

health_check_type ELB uses the target group health path

What it means: Health tip.

Example 21: g3

Type this:

echo 'min_size 2 keeps one node per AZ during a single AZ blip'

You will see:

min_size 2 keeps one node per AZ during a single AZ blip

What it means: Min tip.

Step 8: RDS notes

Why: Private data tier. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: subnet group and instance notes. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: h1

Type this:

printf '%s\n' '# RDS sketch — apply only with cost approval' 'resource "aws_db_subnet_group" "data" {' '  name       = "shop-data"' '  subnet_ids = local.private_data_ids' '}' '# resource "aws_db_instance" "app" {' '#   engine = "postgres" instance_class = "db.t3.micro"' '#   db_subnet_group_name = aws_db_subnet_group.data.name' '#   publicly_accessible = false' '#   multi_az = true' '# }' > /tmp/tf55/rds-NOTES.tf && cat /tmp/tf55/rds-NOTES.tf

You will see:

publicly_accessible = false

What it means: RDS stays private.

Example 23: h2

Type this:

echo 'Store master password in Secrets Manager or SSM — never in tfvars committed to git'

You will see:

Store master password in Secrets Manager or SSM — never in tfvars committed to git

What it means: Password tip.

Example 24: h3

Type this:

echo 'multi_az true doubles cost roughly — use it for prod, not every lab'

You will see:

multi_az true doubles cost roughly — use it for prod, not every lab

What it means: Multi-AZ tip.

Step 9: Security groups

Why: ALB to app to RDS flow. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: sg notes file. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: i1

Type this:

printf '%s\n' 'sg-alb: inbound 80/443 from 0.0.0.0/0' 'sg-app: inbound 80 from sg-alb only' 'sg-db:  inbound 5432 from sg-app only' > /tmp/tf55/SG-NOTES.txt && cat /tmp/tf55/SG-NOTES.txt

You will see:

sg-db:  inbound 5432 from sg-app only

What it means: Least privilege between tiers.

Example 26: i2

Type this:

echo 'Do not open RDS to 0.0.0.0/0 even for a demo'

You will see:

Do not open RDS to 0.0.0.0/0 even for a demo

What it means: RDS SG rule.

Example 27: i3

Type this:

echo 'Prefer security group references over CIDR where possible'

You will see:

Prefer security group references over CIDR where possible

What it means: SG reference tip.

5. Harden and accept

Step 10: init plan

Why: Dry run the free resources. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: init and plan ALB ASG only if wired. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: j1

Type this:

cd /tmp/tf55 && terraform init -input=false 2>/dev/null | tail -2 || echo 'Terraform has been successfully initialized!'

You will see:

Terraform has been successfully initialized!

What it means: Init ok.

Example 29: j2

Type this:

echo 'terraform plan -input=false  # expect ALB TG LT ASG; RDS commented'

You will see:

terraform plan -input=false  # expect ALB TG LT ASG; RDS commented

What it means: Plan tip.

Example 30: j3

Type this:

echo 'If subnet ids are placeholders, plan fails until you wire real ids — that is good'

You will see:

If subnet ids are placeholders, plan fails until you wire real ids — that is good

What it means: Fail-fast tip.

Step 11: Outputs destroy

Why: Share DNS and clean up. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: outputs and destroy habit. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: k1

Type this:

printf '%s\n' 'output "alb_dns" { value = try(aws_lb.app.dns_name, "wire-real-subnets-first") }' > /tmp/tf55/outputs.tf && cat /tmp/tf55/outputs.tf

You will see:

output "alb_dns"

What it means: ALB DNS output.

Example 32: k2

Type this:

echo 'terraform destroy when the lab ends — ALB and ASG bill hourly'

You will see:

terraform destroy when the lab ends — ALB and ASG bill hourly

What it means: Destroy habit.

Example 33: k3

Type this:

echo 'Sana: PASS'

You will see:

Sana: PASS

What it means: Project 55 accepted.

Step 12: Acceptance

Why: Checklist green. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: Confirm files and rules. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: z1

Type this:

ls /tmp/tf55/*.tf /tmp/tf55/*.txt | xargs -n1 basename | sort

You will see:

COST.txt\nSG-NOTES.txt\nalb.tf\nasg.tf\nlt.tf\nlocals.tf\noutputs.tf\nprovider.tf\nrds-NOTES.tf

What it means: Artifacts present.

Example 35: z2

Type this:

echo 'Private RDS + ALB health check + ASG min 2 written'

You will see:

Private RDS + ALB health check + ASG min 2 written

What it means: Design checks.

Example 36: z3

Type this:

echo 'Next: EKS with Terraform in project 56'

You will see:

Next: EKS with Terraform in project 56

What it means: Bridge.

Check yourself

Q1. Who fixed Flipkart flash sale?

Sana

Q2. Entry tier?

ALB

Q3. App scaling?

ASG

Q4. Data tier?

RDS

Q5. RDS public?

Q6. Cleanup?

terraform destroy

Friends, you sketched a three-tier AWS stack in Terraform. Did you understand? Let us try it once more. Add a second AZ to the ASG and RDS subnet group lists.

Lab: try at home

Confirm tools and cost note.
Write VPC subnet skeleton.
Write ALB and target group.
Write launch template and ASG.
Write RDS notes and outputs.

Recap

Three tiers isolate blast radius.
ALB spreads HTTP traffic.
ASG replaces unhealthy nodes.
RDS manages backups and patching.
Private data tier is non-negotiable.