Building a Production-Ready 2-Tier Architecture on AWS with Terraform

From Theory to Real-World Infrastructure 🚀

As part of my 30 Days of AWS Terraform challenge, Day 22 was a major milestone where I moved beyond individual resources and built a production-style 2-tier architecture using Terraform.

This project was all about combining networking, security, compute, and database layers into a cohesive and secure system — just like real-world applications.

🏗️ The Goal: Build a Secure 2-Tier Architecture

The objective of this project was to design and deploy:

• Web Tier (Public Layer) → EC2 instances running a Flask application
• Database Tier (Private Layer) → MySQL RDS instance

These two layers communicate securely while maintaining strict isolation from public access.

🔐 Architecture Overview

Web Tier (Public Subnet)

• EC2 instance running Flask app
• Accessible via Internet Gateway
• Uses User Data for automated setup

Database Tier (Private Subnet)

• Amazon RDS (MySQL)
• No public access
• Only accessible from Web Tier via Security Groups

⚙️ Core Infrastructure Components

To support this architecture, I provisioned:

🌐 Networking

• Custom VPC
• Public & Private subnets
• Internet Gateway (for web tier)
• NAT Gateway (for private subnet outbound access)

🔒 Security

• Security Groups with strict rules
• Principle of Least Privilege enforced

🔑 Secrets Management

• AWS Secrets Manager for DB credentials
• No hardcoded sensitive data

🖥️ Compute

• EC2 instance with Flask app
• Automated setup via User Data

🗄️ Database

• RDS MySQL instance in private subnet

🧩 Modular Terraform Architecture

One of the biggest highlights of Day 22 was applying Terraform Modules in a real project.

Instead of one large configuration file, I structured my code into reusable modules:

Module Structure:

• VPC Module → Networking setup
• Security Group Module → Access control
• RDS Module → Database provisioning
• Secrets Module → Credential management
• EC2 Module → Web server deployment

🔄 Data Flow Between Modules

Terraform modules don’t communicate directly — so I used:

• outputs.tf → to expose values
• variables.tf → to pass inputs

Example:

• VPC module outputs subnet IDs
• Root module passes them to EC2 & RDS modules
• Secrets module outputs credentials used by EC2

This pattern ensures:

✔️ Loose coupling
✔️ High reusability
✔️ Clean architecture

🧪 Testing the Application

After deployment, I validated the setup by hitting:

• /health → Application health check
• /db/info → Database connectivity

Seeing the Flask app successfully connect to the RDS instance was a huge win! 🎉

🔐 Security Best Practices Implemented

This project reinforced critical security principles:

✔️ Private Database

• RDS placed in private subnet
• No direct internet exposure

✔️ Controlled Access

• Only EC2 security group can access DB

✔️ Secrets Management

• Credentials stored in AWS Secrets Manager

✔️ Least Privilege

• Minimal permissions across components

💡 Key Learnings from Day 22

• Modules are essential for scalable Terraform projects
• Networking design is critical for security
• Secrets should never be hardcoded
• Private subnets protect sensitive resources
• Testing validates real-world readiness

🧠 Why This Project Matters

This was not just another Terraform lab — it was a real-world architecture simulation.

It taught me how to:

• Design secure systems
• Structure modular IaC
• Connect application & database layers
• Apply DevOps best practices

This is the kind of project that bridges the gap between learning and real engineering.

🚀 What’s Next?

With only 8 days remaining, I’m excited to explore:

• CI/CD integration
• Advanced security practices
• Multi-environment deployments

🎯 Final Thoughts

Day 22 was one of the most practical and rewarding days of this challenge.

It reinforced that:

👉 Good infrastructure is not just functional — it’s secure, modular, and scalable.

If you're learning Terraform, I highly recommend building projects like this to truly understand how cloud systems work.