Architecture pattern

Build a resilient three-tier application on AWS

Route requests through an Application Load Balancer to an EC2 or ECS application tier, keep Amazon RDS private, and govern supported recovery points with AWS Backup.

Official AWS sources reviewed 2026-07-25.

Architecture flow

  1. Isolate tiers: Public and private subnets, routes, and security groups define network paths.
  2. Accept traffic: An Application Load Balancer sends requests to healthy application targets.
  3. Run the application: EC2 instances or ECS tasks execute stateless application logic.
  4. Persist relational data: The private application tier connects to RDS over the database port.
  5. Govern recovery: AWS Backup can apply plans and vault controls to supported EC2 and RDS resources.

Text alternative: Inside an Amazon VPC, an Application Load Balancer routes requests to an application tier on Amazon EC2 or Amazon ECS in private subnets. That tier connects to private Amazon RDS. AWS Backup manages supported EC2 and RDS recovery points out of band.

How the services connect

The load balancer is the public request tier; application targets run privately on EC2 or ECS and connect to RDS through narrowly scoped security-group references.

Use multiple Availability Zones where the availability objective requires them, keep application nodes replaceable, and select RDS Multi-AZ separately from read-scaling choices.

AWS Backup is a recovery control plane rather than an inline request hop. Coordinate native and centralized backup settings, lock down vault administration, and prove recovery with restore tests.

Tradeoffs and caveats

  • Familiar separation of web, application, and data concerns with managed routing and database operations.
  • More network, deployment, scaling, patching, and failover decisions than a fully serverless pattern.
  • Multi-AZ capacity, load balancing, compute, database, backups, and inter-AZ transfer can all affect cost.

AWS services in this pattern

Primary AWS sources