AWS Interview DropIntermediate TierScenario+25 XP on read
Design the subnets and routing for a standard three-tier web application: a public web layer, a private application layer, and a private database layer.
Core Summary
Three tiers, three subnet groups, each with a route table that only grants the access that tier actually needs. The database subnet shouldn't be able to reach the internet at all, the app subnet gets outbound-only through NAT, and only the web subnet has a real route to the internet gateway. Everything else follows from that one rule.
Hints
Hint 1: One subnet tier per trust boundary, not per Availability Zone alone
Hint 2: The database tier needs no route to the internet at all, not even outbound
Hint 3: Security Groups reference each other by ID, not by CIDR, so the design survives IP changes