AWS Interview DropIntermediate TierScenario+25 XP on read

Design the subnets and routing for a standard three-tier web application: a public web layer, a private application layer, and a private database layer.

Core Summary

Three tiers, three subnet groups, each with a route table that only grants the access that tier actually needs. The database subnet shouldn't be able to reach the internet at all, the app subnet gets outbound-only through NAT, and only the web subnet has a real route to the internet gateway. Everything else follows from that one rule.

Hints

Hint 1: One subnet tier per trust boundary, not per Availability Zone alone

Hint 2: The database tier needs no route to the internet at all, not even outbound

Hint 3: Security Groups reference each other by ID, not by CIDR, so the design survives IP changes