A typical three-tier web application on AWS runs in one VPC spread over two Availability Zones. This cloud network diagram shows the subnets, gateways, route tables and security groups that decide what can talk to what. A second view traces the actual packet paths in and out.
1. The Diagram
VPC and AZs. The outer box is the VPC with its /16 CIDR. Inside, two Availability Zones (separate data centers) each get an identical set of subnets so one AZ can fail.
Public subnets. A subnet is public only because its route table sends 0.0.0.0/0 to the Internet Gateway. The load balancer nodes and NAT gateways live here.
Private app subnets. Instances have no public IP. Their route table sends internet-bound traffic to the NAT gateway in the same AZ (dashed yellow), so they can download patches but cannot be reached from outside.
Private data subnets. The database has only the local route. RDS keeps a synchronous standby in the second AZ.
Security groups. The yellow-outlined boxes carry stateful security groups that reference each other: internet to ALB on 443, ALB to app on 8080, app to DB on 5432. Nothing else is open.
2. How to Read It
Cloud diagrams nest boundaries: region, VPC, AZ, subnet. Colour the subnet borders by reachability (green public, blue private) and put the route tables on the page, because routing, not location, decides what is public.
A common mistake is drawing the NAT gateway in a private subnet or sharing one NAT gateway across both AZs; the second works but means an AZ outage also cuts the other AZ off from the internet. Reviewers should be able to trace every arrow to a route-table line and a security-group rule.
3. Variant: Packet Paths
The same network drawn as flows rather than containers. Inbound HTTPS reaches only the load balancer; outbound traffic from private instances leaves through NAT; a direct connection to a private instance fails because there is neither a public IP nor a route.
4. Pros, Cons, and When to Use
Pros
Shows high availability: every tier appears once per AZ.
Makes the public/private split explicit and reviewable.
Security group references document least-privilege access.
Matches Terraform or CloudFormation resources nearly one-to-one.
Familiar to cloud engineers and auditors.
Cons
Nested boxes eat space; three AZs or many tiers get crowded.
NACLs, endpoints and peering are often left off.
Hard to keep in sync with infrastructure-as-code without generation.
Provider-specific; translating to Azure or GCP changes the shapes.
When to use
Design reviews and security reviews of a new workload.
Explaining why a host can or cannot reach the internet.
When not to use
Multi-account landing zones (use a higher-level account/Transit Gateway view).
Request-level behaviour (use a sequence diagram).
5. As Diagrams-as-Code
Python diagrams library (mingrammer), which draws with the official AWS icons:
from diagrams import Cluster, Diagram
from diagrams.aws.network import ALB, InternetGateway, NATGateway
from diagrams.aws.compute import EC2
from diagrams.aws.database import RDS
with Diagram("VPC 10.0.0.0/16", direction="TB"):
igw = InternetGateway("IGW")
with Cluster("VPC 10.0.0.0/16"):
for az in ("a", "b"):
with Cluster(f"AZ us-east-1{az}"):
with Cluster("public"):
alb, nat = ALB(f"ALB {az}"), NATGateway(f"NAT {az}")
with Cluster("private app"):
app = EC2(f"app {az}")
with Cluster("private data"):
db = RDS("primary" if az == "a" else "standby")
igw >> alb >> app >> db
app >> nat >> igw