wtf( )unctionsystem design, drawn
← all problemsNetworkingEasy

Put the tiers where they belong

A team shipped a three-tier app into a single VPC. It works, and it is one misconfigured security group away from a very bad afternoon.

The rule that decides everything here: a subnet is public if — and only if — its route table sends 0.0.0.0/0 to an Internet Gateway. Anything you place in one is reachable from the internet the moment a security group lets it be.

Place the load balancer, the application server and the database into the right subnets.
Components — tap one, then tap a slot on the diagram
?A subnet is public only if its route table points at the internet gateway. Anything you put in one is reachable the moment a security group allows it.

Boundaries, outermost first: VPC (10.0.0.0/16): Internet GW (on the VPC) Availability Zone A: Private subnet (10.0.128.0/20): an empty slot for the app tier, an empty slot for the data tier Public subnet (10.0.0.0/20): an empty slot for the public tier Outside every boundary: Users (the internet) Connections: Users calls Internet GW — HTTPS 443 (step 1) Internet GW calls public tier (step 2) public tier calls app tier — target group (step 3) app tier calls data tier — 5432 (step 4)

Usersthe internet
Internet GWon the VPC