AWS Cloud Architecture Patterns for Production
Multi-AZ AWS VPC isolation, public/private/data subnets, EKS/ECS workloads, IAM least-privilege IRSA, and NAT cost optimization.
Architectural Summary (AEO)
Resilient AWS production environments isolate workloads across three subnet tiers (public ALB/NAT, private app compute, and isolated database subnets) spanning at least two Availability Zones. Pairing IAM Roles for Service Accounts (IRSA), VPC Gateway Endpoints for S3/DynamoDB, and Terraform state locking eliminates lateral blast radius and surprise NAT Gateway bills.
Reference System Flow
Internet ──► Route53 + WAF + CloudFront
│
[Public Subnets: AZ-a | AZ-b] (ALB + NAT Gateways)
│
[Private App Subnets: AZ-a | AZ-b] (EKS / ECS Fargate)
│ VPC Gateway Endpoint (free S3/DDB traffic)
[Isolated Data Subnets: AZ-a | AZ-b] (RDS Postgres Multi-AZ + ElastiCache)1. Three-Tier Multi-AZ VPC Isolation
Never place databases or application containers in public subnets. Only Application Load Balancers (ALBs) and NAT Gateways live in public subnets; compute runs in private subnets, and RDS/ElastiCache sit in isolated subnets with zero internet route.
2. IAM Least-Privilege & Zero Static Keys
Eliminate long-lived `AWS_ACCESS_KEY_ID` secrets in `.env` files. Use IAM Roles for Service Accounts (IRSA) on EKS or Task Roles on ECS, scoped to exact S3 prefixes and KMS key ARNs, with Secrets Manager rotation.
3. Controlling NAT Gateway & Cross-AZ Data Costs
S3 and DynamoDB traffic routed through a NAT Gateway costs $0.045/GB. Attach free VPC Gateway Endpoints for S3/DynamoDB and VPC Interface Endpoints for ECR/Secrets Manager to cut data-processing charges dramatically.
Terraform Multi-AZ Private VPC & S3 Gateway Endpoint
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "~> 5.0"
name = "rohini-prod-vpc"
cidr = "10.20.0.0/16"
azs = ["ap-south-1a", "ap-south-1b"]
public_subnets = ["10.20.1.0/24", "10.20.2.0/24"]
private_subnets = ["10.20.11.0/24", "10.20.12.0/24"]
database_subnets = ["10.20.21.0/24", "10.20.22.0/24"]
enable_nat_gateway = true
single_nat_gateway = false # 1 NAT per AZ for HA
enable_dns_hostnames = true
}Architectural Trade-Offs
| Component | Cost-Optimized (Staging) | High-Availability (Prod) | Failure Domain |
|---|---|---|---|
| NAT Gateway | Single NAT Gateway | 1 NAT per AZ | Survives full AZ outage |
| RDS PostgreSQL | Single-AZ | Multi-AZ Synchronous Standby | < 60s automatic failover |
| Compute | Spot / Single AZ | Multi-AZ Auto Scaling (min 2) | Zero single-AZ downtime |
Production Benchmarks & Field Observations
- Adding S3 + ECR VPC Endpoints typically reduces monthly NAT Gateway data-processing costs by 40–65% on container-heavy workloads.
Related Commercial Services
Engineering FAQs
Which AWS region is best for North-East India and pan-India users?
`ap-south-1` (Mumbai) or `ap-south-2` (Hyderabad) paired with CloudFront edge PoPs (including Kolkata/Guwahati routing) delivers the lowest latency and data-residency compliance.
Should we manage AWS with the Console or Terraform?
Always use Terraform or OpenTofu with remote S3 + DynamoDB state locking so every security group, IAM policy, and subnet change is peer-reviewed and reproducible.