Defense-in-depth AWS architecture implements multiple security layers from edge to data tier using AWS Shield, WAF, and Network Firewall at the perimeter. Traffic flows through CloudFront CDN to an Application Load Balancer in a public DMZ subnet, routing to EC2 instances in a private app tier that connect to encrypted RDS Aurora and ElastiCache Redis in an isolated data tier. Security monitoring spans GuardDuty for threat detection, Security Hub for CSPM, CloudTrail for audit logs, and Macie for S3 data classification, with IAM Identity Center and Cognito MFA enforcing zero-trust access. Fork this diagram on Diagrams.so to customize security group rules, add compliance controls, or adapt the three-tier topology for your regulated workloads.