Common AWS architectures with every connection explained, each with its own Terraform. Open one in the editor, adapt it, and the Terraform follows the diagram.
Full production layout: SPA on S3 + CloudFront, API on ECS Fargate behind an ALB in private subnets across two AZs, Multi-AZ RDS, SES email, WAF, ACM, Secrets Manager, KMS, ECR and CloudWatch.
API Gateway behind WAF with a custom domain, Lambda functions in private subnets across two AZs, DynamoDB through a gateway endpoint and KMS encryption.
S3 behind CloudFront with WAF, an ACM certificate and origin access control. No VPC is needed: nothing runs servers, and the bucket is never public.
Accept work fast, process it in the background in private subnets, fan out events and email customers. Queues and topics are KMS-encrypted.
Internet-facing ALB in public subnets, containers in private subnets with NAT egress, Multi-AZ RDS and Redis in isolated data subnets, secrets and KMS.
Services in private subnets publish domain events to EventBridge; rules route them to consumers that archive, email and audit, all encrypted with KMS.