Building Production-Ready AWS Three-Tier Architecture with Terraform and GitOps

Modern web applications demand scalable, secure, and maintainable infrastructure. This project demonstrates how to deploy a complete three-tier architecture on AWS using Terraform with professional CI/CD workflows.

What You'll Build

A production-ready architecture featuring:

• Web Tier: Application Load Balancer with SSL termination and Auto Scaling Groups
• Application Tier: EC2 instances running PHP web application in private subnets
• Database Tier: RDS MySQL with Multi-AZ support and encrypted storage

Key Features

🔒 Security First

• Private subnets for application and database tiers
• AWS Secrets Manager integration for database credentials
• OIDC authentication (no long-term AWS keys)
• Security groups with least-privilege access

🚀 GitOps Workflow

• Environment-specific branches (env/dev, env/staging, env/prod)
• Automated Terraform validation and planning on PRs
• Manual approval gates for production deployments
• Safe destroy workflows with confirmation requirements

📊 Infrastructure as Code

• Modular Terraform design for reusability
• Remote state management with S3 and DynamoDB
• Environment-specific configurations
• Comprehensive output values

Project Structure

aws-three-tier-terraform-cicd/ ├── .github/workflows/ │ └── terraform.yaml # CI/CD pipeline ├── docs/ │ └── MANUAL_WORKFLOWS.md # Manual workflow documentation ├── infra/envs/ │ ├── dev/ # Development environment config │ │ └── terraform.tfvars # Dev-specific variables │ ├── staging/ # Staging environment config │ │ └── terraform.tfvars # Staging-specific variables │ ├── prod/ # Production environment config │ │ └── terraform.tfvars # Production-specific variables │ ├── main.tf # Main infrastructure configuration │ ├── variables.tf # Input variables │ ├── locals.tf # Local values │ └── versions.tf # Terraform and provider versions ├── modules/ │ ├── application/ # Application tier module │ │ ├── main.tf # Application module implementation │ │ ├── variables.tf # Application module variables │ │ └── outputs.tf # Application module outputs │ └── network/ # Network tier module │ ├── main.tf # Network module implementation │ ├── variables.tf # Network module variables │ └── outputs.tf # Network module outputs └── scripts/ # Helper scripts 

Quick Start

1. Fork the repository and configure GitHub secrets:

 DB_PASSWORD # Database password AWS_ROLE_ARN # OIDC role ARN 

For detailed instructions on setting up OIDC authentication and configuring the Terraform backend, see: one-click-aws-terraform-backend-gitops-oidc

1. Set GitHub variables:

 AWS_REGION # Target AWS region TF_BACKEND_* # Terraform backend config 

1. Configure environment by copying terraform.tfvars.example:

 region = "us-west-2" env_name = "dev" certificate_arn = "arn:aws:acm:..." domain_name = "yourdomain.com" 

1. Deploy using GitOps:
   • Create PR to environment branches → Terraform format check, validation, and plan
   • Merge to env/dev → Deploy to development
   • Merge to env/staging → Deploy to staging
   • Merge to env/prod → Deploy to production (with manual approval)

CI/CD Pipeline Highlights

The GitHub Actions workflow provides:

• Automated Planning: Terraform plans run on every PR with results commented
• Environment Isolation: Separate workspaces for dev/staging/prod
• Security Gates: Manual approval required for production changes
• Safe Destruction: Multi-step confirmation for infrastructure teardown

Database Security

Credentials are handled through multiple security layers:

1. GitHub Secrets store the master password
2. AWS Secrets Manager receives the password via CI/CD
3. IAM Roles allow EC2 instances to retrieve credentials
4. No Hardcoding - passwords never appear in code or state

Production Considerations

• Configure DNS manually (project doesn't create Route53 records)
• Enable VPC Flow Logs for network monitoring
• Use remote state backend for team collaboration

Why This Approach Works

This architecture pattern provides:

• Scalability: Auto Scaling Groups handle traffic spikes
• Security: Multi-layered security with private networking
• Reliability: Multi-AZ deployment with load balancing
• Maintainability: Modular Terraform with GitOps workflows
• Cost Efficiency: Environment-specific scaling configurations

Ready to deploy enterprise-grade infrastructure? Check out the full repository for complete implementation details.