Three-tier app in a VPC architecture
The same three-tier shape drawn the way AWS actually organises it: edge in a public subnet, app and data in a private one, and the pieces that live outside the VPC outside the box.
Every resource, and what it costs.
Projections from August 2026 list prices for always-on resources. Connect an account and these become the figures your provider actually bills.
| Node | Type | What it is | Projected |
|---|---|---|---|
| Route 53 | Network | 1 zone + queries | $1.00/mo |
| CloudFront | CDN | 500 GB egress · inside the 1 TB free tier | no direct cost |
| Load balancer (ALB) | Network | 1 ALB + light LCU usage | $23/mo |
| NAT gateway | Network | 1 gateway + 100 GB | $37/mo |
| App service ×3 | Compute | 3 × 1 vCPU · 2 GB | $108/mo |
| Primary database | Database | db.t4g.large · multi-AZ · 100 GB | $215/mo |
| ElastiCache Redis | Database | cache.t4g.small | $25/mo |
| User uploads | Storage | 100 GB standard | $3.00/mo |
| CloudWatch logs | External | 30 GB ingested | $18/mo |
| prod-vpc · 10.0.0.0/16 | group | — | — |
| public · 10.0.1.0/24 | group | — | — |
| private · 10.0.2.0/24 | group | — | — |
Agent steps are priced from provider-reported token usage once the agent runs, not estimated. Guardrails cost nothing and are the reason a runaway agent cannot. One row shows from because those services bill by usage, so the total is a scenario at the stated volumes, not a quote.
Similar templates.
Three-tier web application
The default shape: load balancer, containerised app tier, managed Postgres, cache and asset storage.
Serverless API
HTTP API with function compute and a key-value store. Scales to zero; the floor is the gateway.
Static site on CDN
Marketing site or SPA served from object storage behind a CDN, with DNS and a WAF in front.
Open Three-tier app in a VPC on the canvas.
It loads as an editable graph. Connect an account or instrument an agent and the projected figures above become measured ones.