CloudLab — Multi-AZ 3-Tier Enterprise AWS Infrastructure (Terraform)

CloudLab is a production-grade, highly available, and Zero-Trust 3-Tier Cloud Infrastructure blueprint built on Amazon Web Services (AWS) using Terraform (Infrastructure as Code).

Designed following the AWS Well-Architected Framework, CloudLab isolates public entrypoints, application container runtimes, and relational database tiers across multiple Availability Zones while enforcing strict IAM principle of least privilege and zero-egress data vaults.

🏛️ Master Architecture Diagram

flowchart TD
    subgraph PublicInternet["🌐 Public Internet"]
        Client["Users / Clients"]
    end

    subgraph AWSCloud["AWS Region (us-east-1)"]
        subgraph VPC["VPC (CIDR: 10.0.0.0/16)"]
            IGW["Internet Gateway (IGW)"]

            subgraph AZA["Availability Zone A (us-east-1a)"]
                subgraph PublicAZA["Public Subnet AZ-A (10.0.1.0/24)"]
                    ALB_A["ALB Node A"]
                    NAT_A["NAT Gateway A"]
                end

                subgraph PrivateAppAZA["Private App Subnet AZ-A (10.0.11.0/24)"]
                    EC2_A["EC2 App Instance 1\n(Docker Engine / Port 8080)"]
                end

                subgraph PrivateDBAZA["Private DB Subnet AZ-A (10.0.21.0/24)"]
                    RDS_Primary[("RDS PostgreSQL Primary\n(Port 5432)")]
                end
            end

            subgraph AZB["Availability Zone B (us-east-1b)"]
                subgraph PublicAZB["Public Subnet AZ-B (10.0.2.0/24)"]
                    ALB_B["ALB Node B"]
                    NAT_B["NAT Gateway B"]
                end

                subgraph PrivateAppAZB["Private App Subnet AZ-B (10.0.12.0/24)"]
                    EC2_B["EC2 App Instance 2\n(Docker Engine / Port 8080)"]
                end

                subgraph PrivateDBAZB["Private DB Subnet AZ-B (10.0.22.0/24)"]
                    RDS_Standby[("RDS PostgreSQL Standby\n(Multi-AZ Replica)")]
                end
            end

            subgraph StorageMonitoring["Supporting Cloud Services"]
                S3_Bucket["Amazon S3 Storage Bucket\n(Encrypted Assets / Backups)"]
                CloudWatch["AWS CloudWatch & Alarm Topic\n(Logs & Metrics Monitoring)"]
                SSM["AWS Systems Manager (SSM)\n(SSH-less Terminal Access)"]
            end
        end
    end

    %% Inbound Web Traffic Flow
    Client -->|HTTP Port 80 / HTTPS 443| IGW
    IGW --> ALB_A
    IGW --> ALB_B

    %% Load Balancing to EC2 App Instances
    ALB_A -->|Port 8080| EC2_A
    ALB_A -->|Port 8080| EC2_B
    ALB_B -->|Port 8080| EC2_A
    ALB_B -->|Port 8080| EC2_B

    %% Database Operations
    EC2_A -->|Port 5432| RDS_Primary
    EC2_B -->|Port 5432| RDS_Primary
    RDS_Primary == Multi-AZ Sync Replication ==> RDS_Standby

    %% Outbound Traffic & Management
    EC2_A -.->|Outbound Internet via NAT| NAT_A -.-> IGW
    EC2_B -.->|Outbound Internet via NAT| NAT_B -.-> IGW
    SSM -.->|Encrypted SSM Tunnel| EC2_A
    SSM -.->|Encrypted SSM Tunnel| EC2_B
    EC2_A -.->|Uploads / Assets| S3_Bucket
    EC2_B -.->|Uploads / Assets| S3_Bucket

Key Engineering & Architectural Highlights

1. Zero-Trust 3-Tier Network Isolation & Security Group Chaining

Strict Subnet Tiering: Network is partitioned into 6 subnets across 2 Availability Zones (us-east-1a, us-east-1b):
- Public Subnets (10.0.1.0/24, 10.0.2.0/24): Hosts Application Load Balancers and NAT Gateways.
- Private App Subnets (10.0.11.0/24, 10.0.12.0/24): Hosts EC2 backend containers with zero public IP addresses.
- Private DB Subnets (10.0.21.0/24, 10.0.22.0/24): Hosts RDS PostgreSQL database nodes.
Security Group Chaining: Replaces static IP rules with security group ID references (ALB SG -> EC2 SG -> RDS SG).
Zero Database Egress: The database firewall contains zero egress rules, ensuring a compromised database server cannot initiate outbound connections to external internet hosts.

2. High Availability & Automated Failover

Multi-AZ Application Load Balancer: Distributes client HTTP traffic across EC2 application servers in multiple data centers with automated / health checks and 30-second connection draining.
Multi-AZ RDS PostgreSQL Replication: Primary database synchronously mirrors data block changes to a standby database instance in a secondary Availability Zone. Automatic DNS failover occurs in 60–120 seconds with zero data loss (RPO = 0).

3. SSH-Less Operations & IMDSv2 Hardening

Port 22 Eliminated: Completely removes SSH keys (.pem) and Port 22 from firewalls. Developers manage private EC2 servers via AWS Systems Manager (SSM Session Manager) over an encrypted outbound HTTPS tunnel.
IMDSv2 Enforced: Instance Metadata Service v2 requires session tokens (X-aws-ec2-metadata-token), eliminating SSRF credential theft vulnerabilities.

4. Automated Secret Management & Data Encryption

AWS Secrets Manager: Database passwords generated cryptographically via random_password are stored as JSON secrets in AWS Secrets Manager.
Encryption at Rest & Transit: Enforces AES256 / KMS storage encryption across EBS root volumes, S3 storage buckets, and PostgreSQL parameters (rds.force_ssl = 1).

5. Automated GitHub Actions CI/CD Pipelines

terraform-lint.yml: Automates terraform fmt -check and terraform validate across dev, staging, and prod stacks.
terraform-plan.yml: Generates speculative execution plans on Pull Requests targeting main and posts formatted comments to PR threads.
terraform-apply.yml: Automated continuous deployment to dev on push to main with environment protection gates for staging and prod.

📸 Deployment & Verification Screenshots

Note

Below are empirical runtime proof screenshots from live AWS deployment and local Terraform execution. See docs/images/README.md for the complete screenshots directory catalog.

🌟 Core Deployment Milestones

Verification Stage	Screenshot Preview	Description
1. Terraform Execution		Successful `terraform apply` execution terminal log in `infra/environments/dev` provisioning 52 resources.
2. Live Application via ALB		Live browser access to `http://<alb-dns-name>` showing HTTP 200 OK NGINX container response.
3. VPC Network Topology		AWS Console Resource Map showing 6 isolated subnets across 2 AZs, 5 route tables, IGW, and NAT GW.
4. ALB Routing & Target Health		HTTP:80 Listener -> Routing Rule -> Target Group -> 2 Healthy Multi-AZ EC2 instances.

🔍 Expand Detailed AWS Console Verification by Architectural Tier (11 Additional Proofs)

1. Compute & Containers Tier

Component	Screenshot	Description
EC2 Multi-AZ Instances		Both app instances (`cloudlab-dev-app-ec2-1` and `cloudlab-dev-app-ec2-2`) active across `us-east-1a` & `us-east-1b` with private-only IPs and 3/3 checks passed.

2. Database Tier

Component	Screenshot	Description
RDS PostgreSQL Multi-AZ		Provisioned `cloudlab-dev-postgres` instance running PostgreSQL on `db.t4g.micro` with public accessibility disabled.

3. Security Tier

Component	Screenshot	Description
Zero-Trust Security Groups		Chained firewalls (`ALB SG -> EC2 SG -> DB SG`) with zero egress allowed from database instances.

4. Load Balancing Tier

Component	Screenshot	Description
ALB Configuration		Internet-facing Application Load Balancer active with dual-AZ public subnet mappings.
Target Group		Target group (`cloudlab-dev-app-tg`) on port 8080 showing 2 healthy registered targets.

5. Networking Tier

Component	Screenshot	Description
VPC Configuration		VPC `cloudlab-dev-vpc` (`10.0.0.0/16`) with DNS resolution and DNS hostnames enabled.
Route Tables		Partitioned route tables for public, private app (via NAT), and private DB subnets.
NAT Gateway		Managed NAT Gateway in public subnet AZ-1 with dedicated Elastic IP for outbound updates.
Internet Gateway		Attached Internet Gateway providing public ingress to the ALB.

6. Monitoring & Alerting Tier

Component	Screenshot	Description
CloudWatch Alarms		Metric alarms for EC2 CPU utilization, ALB 5xx errors, and RDS free storage.
SNS Alert Topic		Confirmed email subscription for real-time infrastructure alarm notifications.

📁 Repository Directory Structure

cloudlab/
├── infra/
│   ├── modules/                       # Reusable infrastructure blueprints
│   │   ├── networking/                # [Implemented] VPC, 6 Subnets, IGW, NAT Gateways, Route Tables
│   │   ├── security/                  # [Implemented] ALB, EC2, RDS Security Groups & SSM IAM Profile
│   │   ├── compute/                   # [Implemented] EC2 Application Hosts, Dynamic AMI, Docker Bootstrap
│   │   ├── database/                  # [Implemented] RDS PostgreSQL Multi-AZ, Parameter Group, Secrets Manager
│   │   ├── alb/                       # [Implemented] Application Load Balancer, Target Group, HTTP Listener
│   │   ├── storage/                   # [Implemented] Amazon S3 Bucket, Public Access Block, Versioning & Lifecycle
│   │   └── monitoring/                # [Implemented] CloudWatch Log Groups, Metric Alarms, SNS Alerts
│   │
│   └── environments/                  # Environment deployment orchestrators
│       ├── dev/                       # [Implemented] Dev environment stack (Single shared NAT GW)
│       ├── staging/                   # [Implemented] Staging environment stack (Multi-AZ NAT GWs)
│       └── prod/                      # [Implemented] Production environment stack (Multi-AZ NAT GWs & Deletion Protection)
│
├── docs/                              # Architecture specifications & infrastructure standards
│   ├── architecture.md                # 5-stage network & subnet blueprint
│   ├── security.md                    # Zero-Trust security perimeter & IAM policy specs
│   └── structure.md                   # Repository design standards
│
└── .github/workflows/                 # [Implemented] GitHub Actions CI/CD Pipelines (terraform-lint, terraform-plan, terraform-apply)

📊 Infrastructure Module Input / Output Matrix

Module	Core Inputs	Primary Outputs	Key Design Rationale
`networking`	`vpc_cidr`, `availability_zones`, `public/private_subnet_cidrs`	`vpc_id`, `public_subnet_ids`, `private_app_subnet_ids`, `private_db_subnet_ids`	Creates 3-tier isolated IP boundaries across Multi-AZs.
`security`	`vpc_id`, `app_port`	`alb_security_group_id`, `ec2_security_group_id`, `db_security_group_id`, `ec2_iam_instance_profile_name`	Enforces Zero-Trust SG chaining and SSM SSH-less management.
`compute`	`private_app_subnet_ids`, `ec2_security_group_id`, `iam_instance_profile_name`	`instance_ids`, `private_ips`, `ami_id_used`	Deploys stateless EC2 hosts with IMDSv2 and Docker application bootstrap.
`database`	`private_db_subnet_ids`, `db_security_group_id`, `instance_class`	`db_instance_endpoint`, `db_instance_address`, `db_secretsmanager_secret_arn`	Deploys Multi-AZ RDS PostgreSQL with SSL enforcement & Secrets Manager integration.
`alb`	`vpc_id`, `public_subnet_ids`, `alb_security_group_id`, `ec2_instance_ids`	`alb_dns_name`, `alb_arn`, `target_group_arn`	Provides public HTTP load balancing, health checks, and connection draining.
`storage`	`environment`, `bucket_prefix`, `enable_versioning`	`s3_bucket_id`, `s3_bucket_arn`, `s3_bucket_domain_name`	Provisions private encrypted S3 bucket with Glacier cold storage archiving.
`monitoring`	`environment`, `log_retention_days`, `alert_email`	`sns_topic_arn`, `ec2_log_group_arn`, `alb_log_group_arn`	Configures CloudWatch metric alarms (CPU, 5xx, Storage) and log retention.

🚀 How to Deploy (Quick Start Guide)

Prerequisites

Terraform CLI >= 1.5.0
AWS CLI v2 configured with valid credentials (aws configure)
AWS IAM permissions for VPC, EC2, RDS, ALB, S3, IAM, and Secrets Manager.

Local Development Deployment Steps

Clone the Repository:

git clone https://github.com/YashashavGoyal/cloud-lab.git
cd cloud-lab

Navigate to the Target Environment:
```
cd infra/environments/dev
```
Initialize Terraform & Modules:
```
terraform init
```
Validate & Review Execution Plan:
```
terraform validate
terraform plan
```
Deploy Infrastructure:
```
terraform apply
```
Access Application & Clean Up:
- Get the ALB public DNS URL from Terraform output: output.alb_dns_name.
- Open http://<alb-dns-name> in your browser.
- To destroy all provisioned cloud resources:
```
terraform destroy
```

📚 Technical Documentation & Deep Dives

📖 Architecture Specification
🔐 Security & IAM Architecture Specification
🏗️ Repository Structure Specification

📝 License & Author

Author: Yashashav Goyal
License: MIT License

Navigation Menu

Repository navigation

About

Repository files navigation

CloudLab — Multi-AZ 3-Tier Enterprise AWS Infrastructure (Terraform)

🏛️ Master Architecture Diagram

Key Engineering & Architectural Highlights

1. Zero-Trust 3-Tier Network Isolation & Security Group Chaining

2. High Availability & Automated Failover

3. SSH-Less Operations & IMDSv2 Hardening

4. Automated Secret Management & Data Encryption

5. Automated GitHub Actions CI/CD Pipelines

📸 Deployment & Verification Screenshots

🌟 Core Deployment Milestones

1. Compute & Containers Tier

2. Database Tier

3. Security Tier

4. Load Balancing Tier

5. Networking Tier

6. Monitoring & Alerting Tier

📁 Repository Directory Structure

📊 Infrastructure Module Input / Output Matrix

🚀 How to Deploy (Quick Start Guide)

Prerequisites

Local Development Deployment Steps

📚 Technical Documentation & Deep Dives

📝 License & Author

About

Releases

Packages

Contributors

Languages

Name		Name	Last commit message	Last commit date
.github/workflows		.github/workflows
docs		docs
infra		infra
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md

Latest commit

History

Folders and files

Repository files navigation

CloudLab — Multi-AZ 3-Tier Enterprise AWS Infrastructure (Terraform)

🏛️ Master Architecture Diagram

Key Engineering & Architectural Highlights

1. Zero-Trust 3-Tier Network Isolation & Security Group Chaining

2. High Availability & Automated Failover

3. SSH-Less Operations & IMDSv2 Hardening

4. Automated Secret Management & Data Encryption

5. Automated GitHub Actions CI/CD Pipelines

📸 Deployment & Verification Screenshots

🌟 Core Deployment Milestones

1. Compute & Containers Tier

2. Database Tier

3. Security Tier

4. Load Balancing Tier

5. Networking Tier

6. Monitoring & Alerting Tier

📁 Repository Directory Structure

📊 Infrastructure Module Input / Output Matrix

🚀 How to Deploy (Quick Start Guide)

Prerequisites

Local Development Deployment Steps

📚 Technical Documentation & Deep Dives

📝 License & Author

About

Resources

Security policy

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages