Multi-tenant B2B SaaS architecture on AWS combining CloudFront CDN, WAFv2 IP allowlisting, and ALB-based ingress routing to a containerized EKS cluster. Traffic flows from Route 53 DNS through WAFv2 and CloudFront distribution to CloudFront Functions for SPA rewriting, then to S3-backed Angular assets or ALB-routed microservices. The core layer spans two AZs with public subnets hosting NAT gateways and internet gateways, private subnets running EKS managed node groups with legacy go-kit services and hexagonal architecture pods, plus platform namespaces for OPA policy enforcement and Keycloak OIDC. Data layer isolates per-service RDS PostgreSQL instances, encrypted S3 raw payload storage with KMS, and async messaging via SNS topics and SQS queues with dead-letter queues. IRSA federated IAM roles, Secrets Manager, CloudWatch OTel observability, and X-Ray tracing provide security and visibility. Bitbucket Pipelines CI/CD, Terraform state backend, and local development with Docker Compose, LocalStack, and Traefik enable rapid iteration. This architecture demonstrates zero-trust networking, multi-tenancy isolation, and infrastructure-as-code best practices for regulated SaaS workloads. Fork and customize this diagram on Diagrams.so to adapt tenant routing, add additional AZs, or integrate alternative OIDC providers.