The 3-Tier Architecture

A 3-tier architecture splits an application into presentation, business logic and data layers that run and scale separately; it improves security and scalability at the cost of more parts and network hops.

The 3-tier architecture is the default shape of most web applications. It splits the system into three layers, each with one job.

flowchart LR
  B["Browser / mobile"] --> P["Presentation tier: web, static files"]
  P --> L["Logic tier: API, business rules"]
  L --> D["Data tier: database, storage"]
  L --> C["Cache"]
  %% step B: Clients only ever talk to the presentation tier over HTTPS.
  %% step P: The presentation tier serves pages and static assets, often behind a load balancer and CDN.
  %% step L: The logic tier runs business rules: pricing, orders, permissions. It is stateless and scales out.
  %% step D: Only the logic tier can reach the database, which sits in a private network.
  %% step C: A cache next to the logic tier keeps hot reads away from the database.

The tiers

Tier	Runs	Network placement	Scales by
Presentation	Nginx, React/Next.js, CDN	Public subnet / ingress	More web instances, CDN
Logic	API services (Node, Java, Go...)	Private subnet	More stateless instances
Data	PostgreSQL, MySQL, Redis, object storage	Isolated subnet, no internet	Bigger instance, replicas, sharding

Pros

Scalability – each tier scales on its own; the web tier can double for a sale without touching the database.
Security – the database has no public address; firewall rules allow only tier-to-tier traffic.
Reusability and team split – the same API serves the website and the mobile app; teams own tiers.

Cons

Complexity – more components, deployments and network rules.
Performance overhead – every request crosses two or more network hops.
Cost and time – more infrastructure and more coordination.

Security groups as tier boundaries

From	To	Port
Internet	Load balancer	443
Load balancer	Web/API	8080
API	Database	5432
Anything else	Database	denied

This is defence in depth: even if the web tier is compromised, the attacker still cannot reach the database directly from outside.

Traps: putting business logic in the presentation tier (two places to change rules); letting the web tier query the database directly; storing session state in a tier that you then cannot scale out.