Design a secure VPC for a 3-tier web application (Web, App, Database).

In Simple Words: Span across at least 2 Availability Zones (AZs) for high availability:

• Public Subnet: Connected to an Internet Gateway (IGW). Hosts Public Application Load Balancers (ALB) and NAT Gateways.
• Private Subnet (App Tier): Hosts backend containers/EC2. Outbound internet access goes through the NAT Gateway. No inbound access from the public internet.
• Isolated Private Subnet (Database Tier): Hosts Aurora/RDS databases. Route table has no route to the internet (neither IGW nor NAT). Accessible only by the App Tier on port 5432.

# Database security group allowing inbound ONLY from Application security group:
resource "aws_security_group" "db_sg" {
  name   = "db-security-group"
  vpc_id = aws_vpc.main.id

  ingress {
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.app_sg.id] # Source is App SG!
  }
}