Three-Tier Web App on AWS with Infrastructure as Code and a Cost Report
Many students have deployed an app by pushing to a hosting platform, and very few have built the network, permissions, database and monitoring underneath one. Take a simple three-tier web app and run it on AWS properly: IAM with least privilege, a VPC with private subnets, containers on ECS, RDS, S3 and CloudFront, and CloudWatch alarms, all defined as code. You finish with a monthly cost report and an environment you can destroy and rebuild in minutes.
Intermediate
A small team, or one strong student willing to learn something new.1 semester · 2 to 3 students
8 to ship
4 optional extrasSuggested stack
What you should ship
- Terraform modules for network, data, compute, edge and monitoring, with remote state and locking
- The app running on ECS Fargate behind an Application Load Balancer, with RDS in private subnets
- S3 and CloudFront serving the front end and uploads, with no publicly accessible bucket
- Least-privilege IAM roles, with a written justification for every policy and security group rule
- A GitHub Actions pipeline that deploys to AWS through OIDC with no stored access keys
- CloudWatch dashboards and alarms for error rate, latency, database health and billing, notifying through SNS
- A timed teardown and rebuild of the staging environment from code
- A cost report with actual spend, projected monthly cost and cost at ten times the traffic
If you have time left
- Multi-AZ RDS with a failover drill and measured downtime
- AWS WAF in front of CloudFront with a rate limiting rule
- Blue-green deployments on ECS with automatic rollback when an alarm fires
- Policy checks on Terraform plans in CI, for example with Checkov or Open Policy Agent
Problem
Cloud accounts built by clicking through the console drift, leak money and cannot be rebuilt. Access keys end up in repositories, databases sit in public subnets, and the first sign of trouble is a bill or a user complaint. The skills that prevent this (networking, identity, infrastructure as code and monitoring) are what cloud and DevOps roles ask for, and course assignments rarely cover them together.
What you build
The application is not the project. Use a small existing app, such as a notes app or a project from an earlier course, with a front end, an API and a database. The project is everything around it:
- A VPC across two availability zones with public and private subnets.
- An Application Load Balancer in the public subnets and the API on ECS Fargate in private subnets. EC2 with an Auto Scaling group is an acceptable alternative.
- RDS PostgreSQL in private subnets, reachable only from the API's security group.
- S3 for user uploads and the static front end, served through CloudFront.
- IAM roles with least privilege for every component and for the deployment pipeline.
- Secrets in Secrets Manager or SSM Parameter Store, never in files in the repository.
- CloudWatch logs, dashboards and alarms that email the team through SNS.
- A CI/CD pipeline in GitHub Actions that authenticates to AWS with OIDC instead of long-lived access keys.
Suggested architecture
- Terraform for all infrastructure, split into modules for network, data, compute, edge and monitoring. AWS CDK is a reasonable alternative; pick one.
- Separate state per environment in a remote backend with locking.
- A staging environment identical to production except for size.
- Alarms on what users feel: the 5xx rate at the load balancer, p95 latency, database CPU and free storage, plus a billing alarm.
Milestones by month
- Month 1: account hygiene (MFA on the root user, a budget alarm, named users or SSO), Terraform basics, the network module.
- Month 2: database, compute and load balancer, with the app running end to end in staging.
- Month 3: S3 and CloudFront, secrets, CI/CD with OIDC, CloudWatch dashboards and alarms.
- Month 4: failure drills, cost report, full teardown and rebuild, documentation and demo.
How it will be assessed
- A live, timed teardown and rebuild of staging from code.
- Failure drills: stop a running task, ship a broken deployment, put the database under test load, and show which alarm fired and how you recovered.
- A security review written by the team, justifying every IAM permission and security group rule.
- A cost report built from Cost Explorer and the AWS Pricing Calculator: actual spend during the project, projected monthly cost at the current size, and at ten times the traffic, with the largest line items explained.
Pitfalls
- NAT gateways and idle load balancers are charged by the hour. Understand the pricing before you create them, and destroy staging when you are not using it.
- Read the current AWS Free Tier terms before starting and set a budget alarm on day one. Ask your university whether it offers AWS Academy or student credits.
- Using the root user, or an administrator policy for the pipeline.
- Making changes in the console "just this once". The next terraform apply will undo them or fight them.
- Spending the semester on the application code.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.