53 Internet BITBUCKET CLOUD Pipelines Developer git push --tags End users ~50/day DevOps Engineers admin / SSH aws AWS Cloud Region: ap-southeast-3 (Jakarta) Prod App S3 Bucket Staging App S3 Bucket Dev Backup S3 Bucket Artifacts S3 Bucket {env}/{ver}/bin Route 53 Public Zone aform.…id Route 53 Private Zone Client VPN Endpoint VPC: 172.31.0.0/16 Internet GW NAT GW VPN GW VPC Endpoint gateway · S3 Availability Zone: ap-southeast-3a Public 172.31.165.0/25 PROD Prod App EC2 Nginx · API · Worker blue/green slots t4g.small TLS 443 · public Private 172.31.164.0/25 STAGING Staging App EC2 Nginx · API · Worker prod-mirror t4g.micro VPN-only Private 172.31.164.128/25 STAGING Staging Service EC2 Postgres · Redis RabbitMQ t4g.micro VPN-only Private 172.31.166.0/25 SHARED Runner EC2 Bitbucket runner self-hosted · x86_64 t3.medium VPN-only AWS keys · vars Private 172.31.160.128/25 DEV Dev Service EC2 PG · Redis · RMQ t4g.micro VPN-only SHARED Grafana EC2 Prom · Loki · Tempo t3.medium VPN-only SHARED SonarQube EC2 SAST · quality gate t3.medium VPN-only AZ: 3b 172.31.165.128/25 PROD Prod Service EC2 Postgres Redis · RMQ t4g.small VPN-only AZ: 3c 172.31.160.0/25 DEV Dev App EC2 Nginx · API Worker t4g.micro VPN-only Secrets Manager IAM roles Staging Backup S3 Bucket Grafana S3 Bucket Prod Backup S3 Bucket Dev App S3 Bucket 1