What this prompt does
This prompt frames the AI as a senior AWS solutions architect that specifies a 3-tier web app tightly enough to build, with a real Terraform sketch rather than vague guidance. You provide the [workload], the [region_strategy], and the [compliance] needs. It delivers six layers: edge and routing with Route 53, CloudFront, and an ALB; a compute tier of ECS Fargate or EC2 with an Auto Scaling Group justified for the workload; a data tier of RDS Multi-AZ plus ElastiCache with S3 for objects; a VPC with public and private subnets, NAT gateways, and tight security groups; least-privilege IAM roles per tier; and observability via CloudWatch and X-Ray. Output is a Mermaid diagram followed by a Terraform sketch of the core resources.
The structure works because it forces the day-one decisions that are costly to retrofit later: network segmentation, least-privilege IAM, and a multi-AZ database. [workload] drives the compute choice and sizing, so a high-MAU SaaS gets a different tier and scaling posture than a small internal app. [region_strategy] shapes the VPC layout and availability design across availability zones. [compliance] pushes the IAM scope and encryption requirements, such as encryption at rest and in transit, into the design from the start. The Mermaid diagram gives you the overall shape to sanity-check before the Terraform sketch gives you the buildable core resources to start from.
When to use it
- You are designing a new 3-tier web app on AWS from scratch.
- You want the costly day-one decisions (network, IAM, database) made right.
- You need a Multi-AZ database and private subnets locked in early.
- You want least-privilege IAM roles per tier, not one broad role.
- You need a diagram plus a Terraform sketch, not vague guidance.
- You have compliance needs that shape encryption and access.
Example output
You get a Mermaid architecture diagram showing the edge, compute, and data tiers across the VPC, followed by a Terraform sketch of the core resources: Route 53 and CloudFront and the ALB, the compute tier with autoscaling, RDS Multi-AZ and ElastiCache with S3 for objects, the VPC with public and private subnets and NAT gateways and tight security groups, least-privilege IAM roles per tier, and the CloudWatch and X-Ray observability wiring. It is detailed enough to start building from, not a high-level overview you still have to turn into infrastructure.
Pro tips
- Describe
[workload]concretely (type and scale) so the compute choice and sizing fit. - Set
[region_strategy]clearly; it shapes the VPC and availability design. - State
[compliance]honestly; it drives IAM scope and encryption requirements. - Pin the Multi-AZ database and private subnets first; that is where outages and breaches start.
- Treat the Terraform sketch as a starting point to flesh out, not production-ready as-is.
- Get subnets and least-privilege right up front; retrofitting them under load is expensive.
