All inbound requests starts here, the internet facing input services. This layer is the HTTPS entrypoint, every request after this point is decrypted and routed to the specific application. These services comes with a default HTTPS endpoint and a SSL/TLS certificate.

These services provide a domain like this:

This layer we define where the app will be hosted, what traffict it will accept and with what our container can do inside our AWS. A container uses our VPC and a availability zone to be hosted.

The security group is the layer where we define what traffic it will accept, the IAM role is the layer where we define what the container can do inside our AWS and the IAM policy is the layer where we define what the container can do inside our AWS.

The compute layer is the layer where the application is running, a place to execute your Docker images stored in ECR as containers. The three main types of compute resources are Lambda, Fargate and EC2.

EC2 is a machine that you can SSH into it and directly run commands like `docker run ...`, analogous to the local machine, it can host multiple containers as long as you have the needed RAM, CPU, storage and ENI for every container.

Fargate is a “automatic” EC2 instantiator where you dont need to care about any configuration, just provide the Docker image and things like port mapping. This instance will run a single container that needs to be stateless and idempotent.

Lambda is a serverless compute service, a event processor, it will instantiate a Docker container for each individual event, process it and then terminate the container after some time. This quirk affects deeply the way you need to design your application, since you need to make it stateless and idempotent.

The reply of the service can be simply routed back as a default action to the API gateway or load balancer given that the container can be routed back to the load balancer and have the correct security group permissions.

The Internet Gateway is needed for non-serverless services in your VPC if they need to access the internet or be accessed from the internet without a load balancer or API gateway, like a direct connection to RDS or SSH connection.

The NAT Gateway is needed for a non-serverless services in a private subnet to access the internet, one way flow.