👤 USER
opens the app in their browser
☁️ VPC · 10.0.0.0/16
your private network on AWS
🌍 INTERNET GATEWAY
connects VPC to the public internet
🌐 PUBLIC SUBNET · 10.0.1.0/24
route to 0.0.0.0/0 via IGW
🖥️ EC2 Web Server
Nginx · public IP · port 80/443
🛡️ web-sg: allow 80, 443 from world
🔒 PRIVATE SUBNET · 10.0.2.0/24
no route to internet
🗄️ RDS MySQL · Multi-AZ
port 3306 · auto-failover
🛡️ db-sg: allow 3306 from web-sg only
⚡
+ Lambda · Serverless extension
S3 → Lambda image resizer wired separately. No EC2, no servers.