Single-AZ web architecture combining CloudFront CDN, WAF protection, and bastion host access pattern for secure AWS deployments. Users connect through CloudFront for static content delivery via S3, while WAF filters traffic before reaching the Internet Gateway. The bastion host in the public subnet provides secure SSH access to application servers in the private subnet, which communicate with RDS databases in an isolated data layer. This design demonstrates defense-in-depth with network segmentation across three subnets within a single availability zone. Fork and customize this diagram on Diagrams.so to adapt subnet sizing, instance types, or add multi-AZ redundancy for production workloads.