Multi-tier VPC architecture for a threat modeling application leveraging AWS WAF, CloudFront CDN, and Application Load Balancer in the public access layer. Three Fargate services—API, Threat Model Engine, and Document Processor—run in private subnets within an ECS cluster, communicating with Aurora Serverless PostgreSQL, ElastiCache Redis, and S3 document storage. Security is enforced through Secrets Manager, KMS encryption, IAM policies, Cognito authentication, and observability via CloudWatch, CloudTrail, and GuardDuty. This architecture demonstrates defense-in-depth with network isolation, encrypted data at rest and in transit, and centralized logging for compliance and incident response.