Multi-AZ three-tier web app on AWS with Route 53 DNS, CloudFront CDN, WAF, and Shield protecting static assets in S3 and dynamic traffic through an ALB. Application tier spans two AZs with Auto Scaling Groups of EC2 t3.medium instances in private subnets, backed by RDS PostgreSQL primary-replica across AZs and ElastiCache clusters for session caching. CloudWatch monitors EC2 and RDS performance, Secrets Manager secures database credentials, and automated backups protect the primary database. This architecture demonstrates AWS best practices for fault tolerance, auto-scaling, and defense-in-depth security. Fork and customize this diagram on Diagrams.so to match your VPC CIDR blocks, instance types, or add additional services like SQS or SNS. Consider adding VPC Flow Logs and GuardDuty for enhanced security visibility in production deployments.