Multi-AZ three-tier web app combining Route 53 DNS, CloudFront CDN, WAF, and Shield for global delivery and DDoS protection. Application tier spans two availability zones with Auto Scaling Groups of EC2 t3.medium instances behind Application Load Balancers, while data tier uses RDS PostgreSQL primary-replica pairs and ElastiCache clusters for read scaling and fault tolerance. Private subnets isolate app and database tiers, NAT Gateways enable outbound connectivity, and Secrets Manager secures credentials. CloudWatch monitors performance, CloudTrail audits API activity, and S3 stores automated backups for disaster recovery. Fork this diagram to customize instance types, subnet ranges, or add additional regions for your production workload.