A fully deployed, production-style 3-tier web application on AWS, built from scratch with network isolation, SSL/TLS, automated database backups, and DNS management.
This project implements a classic Web → App → Database architecture split across two VPCs, following AWS security best practices and the principle of defence in depth.
| Layer | Technology |
|---|---|
| DNS | Amazon Route53 + Hostinger |
| SSL/TLS | AWS Certificate Manager (ACM) |
| Web/Proxy | Nginx on Amazon Linux 2023 (EC2) |
| Application | Apache Tomcat 9 + Java (EC2) |
| Database | Amazon RDS - MariaDB |
| Backup | AWS Lambda (Python 3.12) + S3 |
| Scheduling | Amazon EventBridge |
| Notifications | Amazon SNS (Email) |
| Encryption | AWS KMS (Customer Managed Key) |
| IAM | Custom Roles & Least-Privilege Policies |
| Monitoring | CloudWatch Logs |
- Custom Domain + HTTPS → Domain registered on Hostinger, DNS managed via Route53, SSL certificate provisioned through ACM with DNS validation
- VPC Isolation → Compute and data layers separated across two VPCs with no public internet exposure for the app or database tier
- Reverse Proxy → Nginx terminates public HTTPS connections and forwards to Tomcat internally over port 8080
- Private App Server → Tomcat runs with no public IP; only reachable from the proxy via private IP
- Automated Daily Backups → EventBridge triggers a Lambda snapshot function nightly, a second Lambda exports the snapshot to S3, and SNS sends an email confirmation on completion
- Encryption at Rest → RDS and S3 backup exports encrypted using a customer-managed KMS key
- NAT Gateway → Allows private EC2 instances to pull OS updates/packages without inbound exposure
User Browser
│ (types nikhilesh.sbs)
▼
Hostinger → Route53 NS lookup
│
▼
Route53 A Record → Proxy Server Public IP
│
▼
Nginx (port 443, SSL termination via ACM cert)
│ (forwards internally)
▼
Tomcat App Server (port 8080, private IP only)
│ (DB query over VPC Peering)
▼
Amazon RDS MariaDB (port 3306, private only)
│ (response returns same path)
▼
User Browser (encrypted HTTPS response)
EventBridge Scheduler (2:00 AM daily)
│
▼
snapshot-lambda → Creates RDS Snapshot
│
▼
EventBridge Export Rule (triggered on snapshot event)
│
▼
export-lambda → Exports snapshot to S3 (KMS encrypted)
│
▼
EventBridge Complete Rule (triggered on export completion)
│
▼
SNS Topic → Email Notification (backup confirmed)
│
▼
CloudWatch Logs (Lambda execution audit trail)
| Component | Exposure | Justification |
|---|---|---|
| Nginx (Proxy) | Public - ports 80 & 443 | Sole controlled entry point |
| Tomcat (App Server) | Private - no public IP | Hides business logic from internet |
| Amazon RDS | Private - port 3306 only | Only accessible from app server SG via VPC Peering |
| NAT Gateway | Outbound only | Private servers can reach internet; no inbound |
| VPC Peering | Internal only | Cross-VPC traffic never leaves AWS backbone |
| Security Groups | Least privilege | Only specific ports and source IPs permitted |
├── scripts-policies/
│ ├── application-commands.txt # Tomcat install & deployment commands
│ ├── database-commands.txt # RDS schema & seed SQL
│ ├── proxy-commands.txt # Nginx install & config commands
│ ├── export-lambda.txt # Lambda code: RDS snapshot export to S3
│ ├── snapshot-lambda.txt # Lambda code: RDS snapshot creator
│ ├── export-policy.txt # IAM policy: S3/RDS export permissions
│ ├── export-role-trust-policy.txt # IAM trust policy: RDS export role
│ ├── lambda-policy.txt # IAM policy: Lambda execution permissions
│ ├── eventbridges-requirements.txt # EventBridge rule event patterns
│ └── backup-key.txt # KMS key configuration reference
├── 3tier_app_architecture.png # Full architecture diagram
├── AWS_3Tier_Application_Guide.pdf # Complete step-by-step deployment guide
└── README.md
| Resource | Name | Details |
|---|---|---|
| VPC 1 | MyVPC-1 | 10.0.0.0/24 - Compute |
| VPC 2 | MyVPC-2 | 11.0.0.0/24 - Data |
| EC2 Proxy | proxy-server | t3.micro, Amazon Linux 2023, public subnet |
| EC2 App | application-server | t3.micro, Amazon Linux 2023, private subnet |
| RDS | database | db.t3.micro, MariaDB, private subnet |
| S3 Bucket | nik-rds-backup | RDS snapshot exports, KMS encrypted |
| KMS Key | backup-key | Customer-managed, symmetric |
| Lambda 1 | sanpshot-lambda | Python 3.12, creates RDS snapshot |
| Lambda 2 | export-lambda | Python 3.12, exports snapshot to S3 |
| SNS Topic | database-export | Email notification on backup completion |
| Domain | nikhilesh.sbs | Hosted on Hostinger, DNS via Route53 |
A full step-by-step deployment guide with screenshots is available in AWS_3Tier_Application_Guide.pdf, covering:
- VPC & Network Setup (VPCs, subnets, IGWs, NAT Gateway, route tables, VPC Peering)
- EC2 & RDS Setup (security groups, Nginx proxy, Tomcat app server, MariaDB RDS)
- Route53 & SSL/TLS (hosted zone, nameserver update, ACM certificate, DNS A record)
- Backup & Automation (S3, KMS, IAM roles, Lambda functions, EventBridge, SNS)
Note: Whole infrastructure is deployed on AWS Asia Pacific (Mumbai) region → ap-south-1
- Multi-VPC architecture with VPC Peering
- Public/private subnet design with NAT Gateway
- Reverse proxy pattern (Nginx → Tomcat)
- Infrastructure security via Security Groups and least-privilege IAM
- Serverless automation with Lambda + EventBridge
- Encrypted backups with KMS and S3
- DNS management and SSL/TLS certificate provisioning on AWS