AWS Diagram Guide

AWS three-tier architecture diagram: every icon in the web, app, and data tier

By the engineer who builds Datadef, from client work on data platforms · Reviewed August 21, 2026

The three-tier web application is the most drawn AWS diagram in existence, and the most inconsistently drawn. Some versions show three subnets, some show three services, some put the load balancer inside the app tier. This page fixes the shape: which service belongs in which tier, which official icon each one uses, and what a reviewer will ask that the picture should already answer.

Try it free
7 min readFor engineers drawing the standard AWS web application before a design review

See it as a diagram

Everything below, as a diagram you can edit. Describe yours and see it in seconds.

308/2000• 3 credits left
Try:

No account needed · Editable canvas, not a picture

The three tiers are not three subnets

A tier is a logical layer: presentation, application logic, data. A subnet is a placement decision. They correlate but they are not the same axis, and conflating them produces the diagram where a reader cannot tell whether the middle box is a subnet, a service, or a team.

The layout that survives review is a grid. Tiers are the rows, availability zones are the columns. The web tier row holds CloudFront and the load balancer, the application row holds the compute in private subnets, the data row holds the database in isolated subnets with no route to the internet gateway. Each private row appears once per availability zone, which is exactly how the resiliency question gets answered without a sentence.

Two availability zones is the right default for the diagram even when you run three. The point of drawing more than one is to show that the subnets, the Auto Scaling group, and the database standby are spread; a third identical column adds width and no information. If you run three, say so in a label on the VPC zone.

The icon for every box

Front door: Route 53 for DNS, CloudFront for the CDN, AWS WAF attached to the distribution or the load balancer, and AWS Certificate Manager for the TLS certificate. Certificate Manager is worth drawing on the listener rather than floating in a corner, because where TLS terminates is a real architectural fact.

Web and application tier: Elastic Load Balancing for the ALB, EC2 for instances, EC2 Auto Scaling for the group, and Fargate or ECS instead of EC2 when the compute is containers. S3 holds the static assets that CloudFront serves, which is why S3 appears in the web tier and again in the data tier on plenty of real systems.

Data tier: RDS or Aurora for the relational store, ElastiCache in front of it when there is a cache, and Secrets Manager beside the application tier for the database credentials. Network plumbing has its own icons: VPC, internet gateway, NAT gateway, and route tables, all of which ship in the AWS set as resource icons rather than service icons.

Datadef carries 439 AWS icons inside a library of 2,098 files, so every service named above resolves by typing its name. Type the abbreviation instead and results get less reliable: the index stores aliases per icon, so sqs and vpc land exactly, while a bare s3 falls through to name similarity and offers S3 on Outposts. If you only need the file, the AWS icon collection has it, and the per-service pages like the EC2 icon carry the naming variants people actually search.

Service icons and resource icons are different things

AWS publishes filled category-coloured squares for services and lighter line-art marks for resources inside them. An Application Load Balancer, a NAT gateway, and an Auto Scaling group are resource icons; EC2, RDS, and CloudFront are service icons. Mixing them is fine, but use the resource icon when the box is a specific thing you created. See which icon for which AWS service.

Answer the four questions reviewers always ask

Where does TLS terminate. Put the certificate on the listener and label the listener port. If TLS terminates at CloudFront and the origin connection is also HTTPS, draw both legs and say so, because the alternative implies plaintext inside your own network.

Can the database be reached from the internet. Show the database subnets with no internet gateway route and no public IP, and draw egress for the application tier through the NAT gateway rather than through the database row. A route table label does this better than a paragraph in a wiki.

What happens when one availability zone fails. The Auto Scaling group spanning both columns and the RDS standby in the second column answer it visually. If the standby is a read replica rather than a Multi-AZ standby, label it, because failover behaviour differs and readers will assume the safer one.

Where do secrets live. One Secrets Manager node next to the application tier, with an arrow to the database, closes a whole class of review questions about hardcoded credentials.

Draw it once, then stop redrawing it

Describe the stack in a sentence and Datadef places the real icons, the subnets, and the availability zone columns on an editable canvas. Move nodes, rename them, add the pieces the description missed, then export to PNG or JPEG for the deck.

If the stack is defined in Terraform, connect the repository instead. Read-only access to GitHub, GitLab, or Azure DevOps, a branch or a tag, and every .tf file is parsed as text: no terraform init, no state file, no cloud credentials. Directories of .tf files become module units, a unit nobody references as a module source is a root stack, and references inside expressions resolve to the resources they reach, which is the edge set of the real architecture. Variables and locals are followed rather than evaluated, so the parser chases what a value is wired to and never tries to compute it.

Three of those behaviours matter specifically for a three-tier diagram. Multiplicity is resolved rather than ignored: a subnet resource with count over a list of availability zones comes back as a real number, and where a for_each is driven by a variable bound differently per environment the node carries the honest per-environment count, drawn as "per subnet_cidrs (DEV 2, QUAL 1)" instead of a single misleading box. IAM roles, policy attachments and security group associations are classified as wiring and never become nodes, because on a three-tier stack they outnumber the tiers. And a subnet points at its VPC through a container attribute, so containment is drawn as nesting rather than as an arrow. See repo to diagram for the rest of the parse.

One markdown line puts the live image in the service README, so the picture in the repo is the current one rather than a screenshot from launch week.

FAQ

Should a three-tier AWS diagram show subnets?

Yes, because the subnet placement is what makes the tiers real. Public subnets for the load balancer, private subnets for the application compute, isolated subnets with no internet gateway route for the database. Draw availability zones as columns so each private tier appears once per zone.

Which icon do I use for an Application Load Balancer?

The Application Load Balancer resource icon, which sits under Elastic Load Balancing alongside separate Network, Gateway and Classic marks. AWS ships one Elastic Load Balancing icon at the service tier, so a diagram using that square is not wrong, only less precise about which of the balancer types is in play. Searching the service tier for "ALB" finds nothing, which is why people assume the mark is missing.

How many availability zones should the diagram show?

Two is enough to communicate that subnets, compute, and the database are spread across zones. Drawing a third identical column adds width without adding information. If the real deployment uses three or more, put the count in a label on the VPC boundary.

Do the internet gateway and NAT gateway belong on the diagram?

Yes. They are the two nodes that answer where traffic enters and how private compute reaches the internet, which is the most common question asked about a three-tier layout. Both ship as resource icons in the official AWS set. Draw egress from the application tier through the NAT gateway rather than through the database row, and label the route table, which settles the question faster than a paragraph in a wiki.

What is the difference between an AWS service icon and a resource icon?

Service icons are the filled squares coloured by product category and represent the service itself. Resource icons are lighter line-art marks representing something you create inside a service, such as an Application Load Balancer, a NAT gateway, or an Auto Scaling group. Use the resource icon when the box on your canvas is a specific created thing.