Guides

3-Tier Architecture on AWS: Nginx, PHP-FPM and MySQL in a Custom VPC (Full Project)

By Ravindra Bagale, AWS & DevOps trainer · LinkedIn · Published: 29 September 2026 · Last updated: 30 September 2026

A 3-tier architecture on AWS puts Nginx (web tier) in a public subnet, PHP-FPM (app tier) in a private subnet, and MySQL (database tier) in another private subnet of a custom VPC. Nginx forwards .php requests with fastcgi_pass 10.0.2.10:9000, PHP-FPM listens on port 9000 and connects to MySQL on port 3306, and security groups are chained: web-sg → app-sg → db-sg. A bastion host gives SSH access and a NAT gateway gives the private servers outbound internet for installs.

# web server: /etc/nginx/default.d/php-app.conf
index index.php index.html;
location ~ \.php$ {
    fastcgi_pass 10.0.2.10:9000;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name;
}

; app server: /etc/php-fpm.d/www.conf
listen = 0.0.0.0:9000
listen.allowed_clients = 10.0.1.10

# db server: /etc/my.cnf.d/mariadb-server.cnf, under [mysqld]
bind-address = 0.0.0.0

web-sg: HTTP 80 / HTTPS 443 from 0.0.0.0/0, SSH 22 from bastion-sg
app-sg: TCP 9000 from web-sg,               SSH 22 from bastion-sg
db-sg:  MySQL 3306 from app-sg,             SSH 22 from bastion-sg

What do I need before building the 3-tier project?

• An AWS account, a key pair (society-key) and about two hours. Region in the examples: ap-south-1.
• Basic SSH through a bastion: How to SSH into a private EC2 through a bastion.
• A cost check: four t3.micro/t2.micro instances, a NAT gateway (billed per hour and per GB) and its Elastic IP. Delete everything at the end (Step 8).

How does a request travel through the three tiers?

How do I build a 3-tier Nginx, PHP and MySQL setup step by step?

Step 1 — Build the network

Create a custom VPC society-vpc 10.0.0.0/16 with:

Create the NAT gateway in web-public-1a with an Elastic IP. For production you would repeat the subnets in a second AZ (6 subnets), and an RDS DB subnet group needs subnets in at least 2 AZs.

Step 2 — Create the chained security groups

Create them in this order, because each one refers to the previous one:

Step 3 — Launch four Amazon Linux 2023 instances

Note each private IP. This guide assumes web 10.0.1.10, app 10.0.2.10, db 10.0.3.10; replace them with yours. Load your key with ssh-add society-key.pem and reach private servers with ssh -J ec2-user@<BASTION_PUBLIC_IP> ec2-user@<PRIVATE_IP>.

Step 4 — Database tier: MariaDB (MySQL-compatible)

On db:

sudo dnf install mariadb105-server -y
sudo service mariadb start
sudo systemctl enable mariadb       # systemctl: the modern equivalent, enable = start at boot
sudo mysql_secure_installation
sudo nano /etc/my.cnf.d/mariadb-server.cnf     # under [mysqld] add: bind-address = 0.0.0.0
sudo service mariadb restart
sudo ss -tlnp | grep 3306

0.0.0.0 listens on all interfaces; db-sg still allows only app-sg. You can use 10.0.3.10 instead. Then sudo mysql and run:

CREATE DATABASE appdb;
CREATE USER 'app'@'10.0.2.%' IDENTIFIED BY 'Society@Pass123';
GRANT SELECT, INSERT ON appdb.* TO 'app'@'10.0.2.%';
USE appdb;
CREATE TABLE students (id INT AUTO_INCREMENT PRIMARY KEY, name VARCHAR(100) NOT NULL, city VARCHAR(50) NOT NULL);
INSERT INTO students (name, city) VALUES ('Aarav Patil','Pune'), ('Sneha Deshmukh','Nagpur'), ('Rohan Kulkarni','Nashik');
EXIT;

'app'@'10.0.2.%' allows the user only from the app subnet. Use your own password.

Step 5 — App tier: PHP-FPM on port 9000

On app:

sudo yum install php-fpm php-mysqlnd -y
sudo sed -i 's|^listen = .*|listen = 0.0.0.0:9000|' /etc/php-fpm.d/www.conf
sudo sed -i 's|^;*listen.allowed_clients = .*|listen.allowed_clients = 10.0.1.10|' /etc/php-fpm.d/www.conf
grep -E '^listen' /etc/php-fpm.d/www.conf
sudo service php-fpm start
sudo systemctl enable php-fpm
sudo ss -tlnp | grep 9000

By default PHP-FPM listens on a Unix socket, which only local programs can use. Nginx is on another server, so it must listen on TCP 9000, and listen.allowed_clients must be the Nginx server's private IP.

With FastCGI, the PHP files must exist on the PHP server, because Nginx only sends the file path. Create the folder with sudo mkdir -p /var/www/html, then /var/www/html/db.php (for example with sudo nano):

<?php
$pdo = new PDO("mysql:host=10.0.3.10;dbname=appdb;charset=utf8mb4", "app", "Society@Pass123",
               [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);

and /var/www/html/index.php:

<?php
require __DIR__ . "/db.php";
$rows = $pdo->query("SELECT id, name, city FROM students ORDER BY id")->fetchAll(PDO::FETCH_ASSOC);
?>
<!DOCTYPE html>
<html><head><meta charset="utf-8"><title>Students</title><link rel="stylesheet" href="/style.css"></head>
<body><h1>Students list</h1>
<table><tr><th>ID</th><th>Name</th><th>City</th></tr>
<?php foreach ($rows as $r): ?>
<tr><td><?= $r["id"] ?></td><td><?= htmlspecialchars($r["name"]) ?></td><td><?= htmlspecialchars($r["city"]) ?></td></tr>
<?php endforeach; ?>
</table><p>Served by PHP on <?= htmlspecialchars(gethostname()) ?></p></body></html>

sudo chown root:apache /var/www/html/db.php
sudo chmod 640 /var/www/html/db.php    # the password file: readable by root and PHP-FPM (group apache) only

Step 6 — Web tier: Nginx with fastcgi_pass

On web (install Nginx only; do not install php-fpm here):

sudo yum install nginx -y
sudo service nginx start
sudo systemctl enable nginx
sudo nano /etc/nginx/default.d/php-app.conf     # paste the Nginx block from the Quick answer
sudo touch /usr/share/nginx/html/index.php      # empty placeholder so "index index.php" matches
echo 'body{font-family:Arial;max-width:700px;margin:40px auto}td,th{border:1px solid #999;padding:6px}' | sudo tee /usr/share/nginx/html/style.css
sudo nginx -t
sudo service nginx reload

The empty index.php on the web server lets the index directive pick /index.php for /; the real file runs on the app server. Static files (style.css, images) stay on the Nginx server. Always sudo nginx -t before reloading.

Simpler alternative: run Apache with PHP on the app server (sudo yum install httpd php php-mysqlnd -y), allow TCP 80 from web-sg in app-sg, and in Nginx use location / { proxy_pass http://10.0.2.10; proxy_set_header Host $host; }. Then all files live on the app server.

Step 7 — Test every hop

Open http://<WEB_PUBLIC_IP>/: you should see the Students list with three rows. 🎉

Step 8 — Clean up

Terminate the four instances → delete the NAT gateway (wait for Deleted) → release the Elastic IP → Delete VPC (removes subnets, route tables, IGW, NACLs, security groups).

How do I fix 3-tier errors?

Ghabru naka 😅 — these are the usual ones: