on AWS create VPC create 2 subnets, one for public network, one for private network create internet gw and connect to public network create nat gateway, and connect to private network create ec2 instance without public ip, only private subnet create a LB (check Application Load Balancer or Network Load Balancer) publish a service over LB, ie nginx