Terraform #10 — Capstone: 3-Tier Production Infrastructure

Goal: Pull everything from modules 00-09 together into a complete, real project — a 3-tier web infrastructure, multi-environment, reusable modules, ready for CI/CD.

Architecture overview

                              Internet
                                 │
                          ┌──────▼───────┐
                          │  ALB (public)│   ← Tier 1: Load Balancer
                          └──────┬───────┘
              ┌──────────────────┼──────────────────┐
        ┌─────▼─────┐      ┌─────▼─────┐       (public subnets, 2+ AZ)
        │ NAT GW AZ1│      │ NAT GW AZ2│
        └─────┬─────┘      └─────┬─────┘
   ┌──────────┼───────────────── ┼──────────┐
   │   ┌──────▼──────┐    ┌───────▼─────┐    │  ← Tier 2: App (EC2/ASG)
   │   │ App EC2 AZ1 │    │ App EC2 AZ2 │    │     (private subnets)
   │   └──────┬──────┘    └───────┬─────┘    │
   │          └──────────┬────────┘          │
   │               ┌─────▼─────┐             │  ← Tier 3: Database (RDS)
   │               │ RDS (Multi│             │     (isolated private subnets)
   │               │   -AZ)    │             │
   │               └───────────┘             │
   └─────────────────  VPC  ─────────────────┘

The 3 tiers:

1. Web/LB tier — ALB in public subnets, accepts traffic from the internet.
2. App tier — EC2/Auto Scaling Group in private subnets, runs the application.
3. Data tier — RDS in isolated private subnets, only reachable from the app tier.

Project structure (applying modules 06 + 07)

10-capstone-project/hands-on/
├── modules/                        # REUSABLE MODULES
│   ├── network/                    # VPC, subnets, IGW, NAT, route tables
│   ├── security/                   # security groups for all 3 tiers
│   └── compute/                    # ALB + launch template + ASG
├── environments/
│   ├── dev/                        # dev config (small, cheap)
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── outputs.tf
│   │   ├── backend.tf
│   │   └── terraform.tfvars
│   └── prod/                       # prod config (HA, larger)
│       └── ...
├── tests/
│   └── network.tftest.hcl          # tests for the network module
└── ARCHITECTURE.md                 # design details + extension challenges

What knowledge gets applied where

Running it

⚠️ The project uses the AWS provider. It can run against LocalStack (partial support) or real AWS (remember to destroy!). You can also run terraform validate and plan to learn without actually applying anything.

cd 10-capstone-project/hands-on/environments/dev
 
# Learn without spending anything: just validate + plan
terraform init
terraform validate
terraform plan          # needs credentials; see ARCHITECTURE.md for LocalStack
 
# Full apply (real AWS) — remember to destroy when done
terraform apply
terraform destroy

Reference material

• ARCHITECTURE.md — walks through each module, explains design decisions, and lists capstone challenges for extending the project.
• Each module has its own README with full input/output documentation.

✅ Module 10 completion criteria

• Can read and explain all three modules (network/security/compute) and what each resource does.
• terraform validate passes cleanly for both dev and prod.
• Can explain the differences between the dev and prod configurations.
• Can point to where each module (01-09) is applied in the project.
• Completed at least 3 capstone challenges from ARCHITECTURE.md.
• (If using real AWS) Successfully applied, accessed the ALB, and destroyed everything cleanly.

After finishing: review with the Cheat Sheet, work through the Interview Questions, grade yourself on the Skill Checklist.