Put the tiers where they belong
A team shipped a three-tier app into a single VPC. It works, and it is one misconfigured security group away from a very bad afternoon.
The rule that decides everything here: a subnet is public if — and only if — its route table sends 0.0.0.0/0 to an Internet Gateway. Anything you place in one is reachable from the internet the moment a security group lets it be.
Boundaries, outermost first: VPC (10.0.0.0/16): Internet GW (on the VPC) Availability Zone A: Private subnet (10.0.128.0/20): an empty slot for the app tier, an empty slot for the data tier Public subnet (10.0.0.0/20): an empty slot for the public tier Outside every boundary: Users (the internet) Connections: Users calls Internet GW — HTTPS 443 (step 1) Internet GW calls public tier (step 2) public tier calls app tier — target group (step 3) app tier calls data tier — 5432 (step 4)