Multi-AZ 3-Tier Web App on ECS (Terraform + GitHub Actions CI/CD)


Overview

A multi-AZ 3-tier AWS architecture — ECS, RDS, and ALB — provisioned end-to-end with Terraform, using remote S3 state management.

You can find the code files in this GITHUB REPO. To run it you will need:

  • AWS account with sufficient permissions (IAM, ECS, RDS, ALB, VPC, ECR)
  • Terraform (CLI installed locally, or in CI)
  • AWS CLI (configured with credentials/profile)
  • Docker (to build the Flask app image)
  • GitHub account (for the repo and Actions workflow)
  • An S3 bucket + backend config (for remote Terraform state — or the bootstrap config to create one)
  • GitHub Actions secrets configured (e.g. TF_VAR_db_password, AWS OIDC role ARN)

Check out the project's readme file for instructions on how to download it and run it on your machine


Architecture

Network Topology components

  • VPC (main network boundary, e.g. 10.0.0.0/16)
  • Internet Gateway (IGW) — entry/exit point for internet traffic
  • 2 public subnets (one per AZ) — host the ALB and NAT Gateways
  • 2 private subnets (app tier, one per AZ) — host the ECS tasks
  • 2 private subnets (data tier, one per AZ) — host the RDS primary and standby
  • 2 NAT Gateways (one per AZ) — allow private-subnet outbound internet access (image pulls, etc.)
  • Route tables — public route table (routes to IGW) and separate private route tables per AZ (routes to that AZ's NAT Gateway)
  • Application Load Balancer (ALB) — spans both public subnets, routes traffic to ECS tasks
  • Security groups — one for the ALB (inbound 443/80 from internet), one for ECS tasks (inbound only from ALB SG), one for RDS (inbound only from ECS SG)
  • Multi-AZ deployment — everything duplicated across two Availability Zones (eu-west-1a / eu-west-1b) for high availability

Code Snippets


Terraform: ECS & IAM

									
code coming soon

RDS & Networking

									
code coming soon

CI/CD Workflow

	
Code coming soon

Challenges & Key Takeaways

1: COMING SOON

2: COMING SOON

3: COMING SOON