Architecture pattern: applications and APIs

Web application architecture: hosting, database, login and CDN

Most web applications follow one proven shape: users reach your app through a CDN, the app runs on a managed platform, and the data lives in a managed database. Here is how the pieces fit, which service plays each part on AWS, Azure and Google Cloud, and what to decide first.

Quick answer

A web application architecture puts a CDN in front of an app that runs on a managed hosting platform, with a managed relational database for data, object storage for uploaded files and a sign-in service for users. DNS, HTTPS certificates, secrets and monitoring surround it. Each cloud has a managed service for every part.

Best forBusiness sites, portals, SaaS products and internal tools with a database and user accounts
Less suited whenA site whose pages never change per visitor, where plain static hosting does the job
Start withOne managed hosting service and one managed database in one region, with HTTPS from day one
Main services on AWSAmazon Route 53, Amazon S3, Amazon Cognito, Amazon CloudFront, AWS Elastic Beanstalk, Amazon RDS
Main services on AzureAzure DNS, Azure Blob Storage, Microsoft Entra External ID, Azure Front Door, Azure App Service, Azure SQL Database
Main services on Google CloudCloud DNS, Cloud Storage, Identity Platform, Cloud CDN, Cloud Run, Cloud SQL

The idea in plain words

A web application is code that runs on a server, reads and writes a database, and sends pages or data to browsers. In the cloud you rarely manage the servers yourself: a managed platform runs your code, and a managed database handles backups and patching.

Around that core sit a few services that nearly every app needs: a CDN to deliver files quickly, object storage for uploads, a sign-in service so you do not build passwords yourself, DNS and HTTPS certificates for your address, secrets storage for keys, and monitoring.

Start simple: one app service, one database and one region. Add caching, queues and more regions only when measurements show you need them.

The architecture

Boxes show the job each part does. Pick a cloud to see the service for each job.

Web application with a database: architecture diagramTwo rows of boxes. The numbered steps below describe the same flow in words.domain and HTTPSuploads and downloadswho is signed inpages and data1. Around the app (parts you will usually want)Domain namePoints your address atthe siteAmazon Route 53Azure DNSCloud DNSFile storageUploads and downloadsAmazon S3Azure Blob StorageCloud StorageSign-inRegisters and signs inusersAmazon CognitoMicrosoft EntraExternal IDIdentity Platform2. Handle a page requestUserOpens your site in abrowserCDNDelivers files nearthe userAmazon CloudFrontAzure Front DoorCloud CDNApp platformRuns your applicationcodeAWS ElasticBeanstalkAzure App ServiceCloud RunDatabaseKeeps customer andorder dataAmazon RDSAzure SQL DatabaseCloud SQLWeb application with a database: architecture diagramBoxes from top to bottom. The numbered steps below describe the same flow in words.domain and HTTPSuploads and downloadswho is signed in1. Around the app (parts you willusually want)Sign-inRegisters and signs in usersAmazon CognitoMicrosoft Entra External IDIdentity PlatformFile storageUploads and downloadsAmazon S3Azure Blob StorageCloud StorageDomain namePoints your address at the siteAmazon Route 53Azure DNSCloud DNS2. Handle a page requestUserOpens your site in a browserCDNDelivers files near the userAmazon CloudFrontAzure Front DoorCloud CDNApp platformRuns your application codeAWS Elastic BeanstalkAzure App ServiceCloud RunDatabaseKeeps customer and order dataAmazon RDSAzure SQL DatabaseCloud SQL↩ pages and data, back to user
Arrows show the direction of the flow, and dashed lines connect the rows. Each box names the main service for that job, taken from CloudBrum's service suggester.

Step by step

  1. A user opens your addressThe browser looks up your domain name in DNS and connects over HTTPS, using a certificate that proves the site is yours.
  2. The CDN answers what it canA CDN serves images, scripts and other files from a location near the user and passes the rest to your app.
  3. The app platform runs your codeA managed hosting platform runs your application, adds copies when traffic grows and replaces unhealthy ones.
  4. Check who is signed inA sign-in service handles registration, passwords, multi-factor sign-in and social login, and tells your app who the user is.
  5. Read and write dataYour code reads and writes a managed relational database, which takes backups and applies patches for you.
  6. Store files separatelyUploads such as photos and documents go to object storage, not the database, and the browser gets short-lived links when needed.
  7. Watch it runMonitoring collects errors, speed and cost, and alerts you before users notice a problem. Keys and passwords stay in a secrets service, not in code.

Services side by side

The main service for each job on each cloud, with a second option where one exists. Names checked on 23 October 2026.

JobAWSAzureGoogle Cloud
DNS and domain names
  • Amazon Route 53DNS, health checks, routing policies and domain registration
  • Azure DNSHosts your DNS zones on Azure
  • App Service Domains
  • Cloud DNSReliable, low-latency authoritative DNS
Object storage (files, images, backups)
  • Amazon S3Durable object storage for files, images, backups and data lakes
  • Azure Blob StorageObject storage for unstructured data, with hot, cool and archive tiers
  • Cloud StorageObject storage with Standard, Nearline, Coldline and Archive classes
Customer sign-up and login
  • Amazon CognitoUser sign-up and sign-in, social login, MFA and tokens for your apps
  • Microsoft Entra External IDCustomer identity for apps; replaces Azure AD B2C for new projects
  • Identity PlatformCustomer sign-in for apps, built on Firebase Authentication
CDN (fast delivery to users worldwide)
  • Amazon CloudFrontGlobal CDN with edge locations in India and worldwide
  • Azure Front DoorGlobal CDN with load balancing and a web application firewall
  • Cloud CDNCDN for sites behind Cloud Load Balancing
  • Media CDN
Web app or API hosting (managed platform)
  • AWS Elastic BeanstalkUpload code (Java, .NET, Node.js, PHP, Python, Ruby, Go or Docker); AWS sets up servers, scaling and load balancing
  • Amazon ECS Express Mode
  • Azure App ServiceManaged hosting for .NET, Java, Node.js, Python and PHP, with autoscale and deployment slots
  • Azure Container Apps
  • Cloud RunDeploy a container or source code; scales to zero and bills per request
  • App Engine
Relational (SQL) database
  • Amazon RDSManaged MySQL, PostgreSQL, MariaDB, SQL Server, Oracle and Db2
  • Amazon Aurora
  • Azure SQL DatabaseManaged SQL Server engine with a serverless option
  • Azure Database for PostgreSQL
  • Cloud SQLManaged MySQL, PostgreSQL and SQL Server
  • AlloyDB for PostgreSQL
Monitoring, metrics and alertsOptional
  • Amazon CloudWatchMetrics, alarms, dashboards and logs for AWS resources and apps
  • Azure MonitorMetrics, alerts, logs and Application Insights in one service
  • Cloud Monitoring (Google Cloud Observability)Metrics, dashboards and alerting, with Managed Service for Prometheus
HTTPS and TLS certificatesOptional
  • AWS Certificate ManagerFree public TLS certificates with automatic renewal for AWS services
  • App Service managed certificatesFree managed certificate for custom domains on App Service
  • Azure Key Vault certificates
  • Certificate ManagerGoogle-managed TLS certificates for load balancers
Store secrets (passwords, API keys)Optional
  • AWS Secrets ManagerStores, rotates and retrieves secrets such as database passwords
  • Azure Key VaultSecrets, keys and certificates in one managed vault
  • Secret ManagerStores and versions API keys, passwords and certificates
Send email (transactional or bulk)Optional
  • Amazon SESLow-cost transactional and marketing email with high deliverability
  • Azure Communication Services EmailSends transactional and bulk email from your own domain
  • Partner email service (SendGrid, Mailgun)Google Cloud does not offer its own bulk email service; use a partner, available in Cloud Marketplace

Common variations

  • Traffic is mostly files, such as images and downloads. Serve them through the CDN from object storage, so your app only handles real requests.
  • Pages must stay fast for users in many countries. Add copies of the app in more regions behind a global entry point, and decide where the database lives.
  • Slow tasks such as reports or emails. Move them to a queue and background workers, so the page responds at once.
  • A very small site or a prototype. A static site with a few functions may be enough. See the static website pattern.

Try this in the service suggester

Managed platform or your own virtual servers?

A managed hosting platform runs and patches the servers for you. The alternative is to rent virtual servers and run the web server and updates yourself, shown in the table.

 AWSAzureGoogle Cloud
Virtual servers (VMs)
  • Amazon EC2Resizable virtual servers, Linux or Windows, in many sizes
  • Azure Virtual MachinesLinux or Windows VMs; Azure Hybrid Benefit lets you reuse Windows and SQL Server licences
  • Compute EngineVirtual machines, including custom machine sizes

Managed hosting platform

Good

  • No servers to patch
  • Scales and heals automatically
  • Quick to deploy

Watch out

  • Less control of the operating system
  • Platform limits on runtimes and settings
  • Cost can rise with scale

Your own virtual servers

Good

  • Full control of software and settings
  • Runs almost anything, including older software
  • Predictable cost for steady load

Watch out

  • You patch, secure and scale the servers
  • More to monitor and automate
  • More effort before the first release
A common path. Start on a managed platform. Use virtual servers only for software that cannot run there.

Keep in mind

  • Start in one region. Pick a region close to your users and keep data there unless your rules say otherwise. In India, check which regions each cloud offers for the services you need.
  • Backups and recovery. Turn on automatic backups and test a restore. Decide how much data loss and downtime you can accept, because it shapes the design.
  • Security basics. Use HTTPS everywhere, keep the database off the public internet, give each part only the access it needs, and keep keys in a secrets service.
  • Sign-in. Do not build your own password system. Use a sign-in service with multi-factor sign-in, and plan for password resets and account recovery.
  • Cost. The usual costs are the app platform, the size of the database and data sent to users. Set a budget alert, start small and review after a month of real traffic.
  • Personal data. Accounts mean personal data, which privacy laws such as the GDPR, the CCPA and India's DPDP Act regulate. Collect only what you need, protect it and be able to delete it on request.
  • Changes without downtime. Use a pipeline that tests and releases small changes, with a quick way to roll back.
A starting point, not a design review. This is a general pattern. Your documents, users, rules and budget decide the real design. Confirm features, limits, pricing and regions on each provider's own pages. CloudBrum is independent of AWS, Microsoft and Google.

Words used on this page

Services in this pattern that have changed

Cloud providers rename and retire services often. These affect the parts above. Checked on 23 October 2026.

  • AWS Closed to new customers AWS App Runner stopped accepting new customers on 30 April 2026. AWS recommends Amazon ECS Express Mode for new container web apps. Details
  • AWS Retiring Amazon Pinpoint ends support on 30 October 2026. SMS, voice and push continue as AWS End User Messaging; for email AWS recommends Amazon SES. Details
  • Azure Closed to new customers Azure AD B2C has not been sold to new customers since 1 May 2025. Microsoft Entra External ID is the replacement for new projects. Details

Sources and further reading

Check details such as features, limits, prices and regions in the providers' own documentation.

Announcements about the changed services above

Frequently asked questions

What is a three-tier web application?

It splits an app into a presentation tier (what users see), an application tier (your code) and a data tier (the database). Cloud web apps follow this shape, usually with a CDN in front and a managed service for each tier.

Which database should I choose for a web app?

Start with a managed relational (SQL) database unless your data is clearly documents or key-value pairs. It is familiar, supports transactions and suits most business apps.

Do I need a CDN?

A CDN helps when users are spread out or you serve many files, because it delivers them from nearby and takes load off your app. A small site with few visitors can add one later.

Can I host a web app for free?

Each cloud has free tiers or credits that can run a small app for a while, but limits and end dates apply. Compare them on CloudBrum's free tier comparison page and set budget alerts.

How do I make a web app highly available?

Run at least two copies of the app in separate zones, use a database with a standby copy in another zone, and put a load balancer or CDN in front. Test a failure on purpose.

Want this reviewed for your case?

CloudBrum architects can adapt this pattern to your documents, users, rules and budget, and estimate the cost. Nothing is sent until you choose.

Building something else?

Describe it in plain words and get matching services on all three clouds.

Service suggester → Cloud consulting →