Internal tools behind VPN architecture
Admin and back-office apps reachable only over the VPN, on a single instance with a small database.
Every resource, and what it costs.
Projections from August 2026 list prices for always-on resources. Connect an account and these become the figures your provider actually bills.
| Node | Type | What it is | Projected |
|---|---|---|---|
| Site-to-site VPN | Network | 1 tunnel | $36/mo |
| Tools host | Compute | 2 vCPU · 4 GB | $30/mo |
| Tools database | Database | db.t4g.large · single-AZ · 100 GB | $106/mo |
| Backups | Storage | 100 GB standard | $6.00/mo |
| CloudWatch logs | External | 30 GB ingested | $9.00/mo |
Every figure is a projection from AWS list prices, before anything is built.
Similar templates.
Container behind a load balancer
The smallest thing that serves real traffic: a public load balancer in two availability zones and one Fargate container. About four minutes to create and roughly 4¢ an hour, so it is the cheapest way to find out whether a deploy works end to end.
Three-tier web application
The default shape: load balancer, containerised app tier, managed Postgres, cache and asset storage.
Serverless API
HTTP API with function compute and a key-value store. Scales to zero; the floor is the gateway.
Open Internal tools behind VPN on the canvas.
It loads as an editable graph. Ask Archie to change it, then approve the plan and it is built in your own AWS account.