AWS VPC with public/private subnets

{
  "nodes": [
    { "id":"net","type":"ellipse","label":"Internet","x":40,"y":180,"fill":"#dbeafe","stroke":"#2563eb" },
    { "id":"igw","type":"rect","label":"IGW","x":220,"y":180,"fill":"#fed7aa","stroke":"#c2410c" },
    { "id":"alb","type":"rect","label":"ALB (public)","x":420,"y":180,"fill":"#fed7aa","stroke":"#c2410c" },
    { "id":"e1","type":"rect","label":"EC2 (private)","x":620,"y":80,"fill":"#ede9fe","stroke":"#6d28d9" },
    { "id":"e2","type":"rect","label":"EC2 (private)","x":620,"y":280,"fill":"#ede9fe","stroke":"#6d28d9" },
    { "id":"rds","type":"rect","label":"RDS (multi-AZ)","x":840,"y":180,"fill":"#fef3c7","stroke":"#a16207" },
    { "id":"nat","type":"rect","label":"NAT GW","x":420,"y":380,"fill":"#fee2e2","stroke":"#b91c1c" }
  ],
  "edges": [
    { "id":"a","source":"net","target":"igw" },
    { "id":"b","source":"igw","target":"alb" },
    { "id":"c","source":"alb","target":"e1" },
    { "id":"d","source":"alb","target":"e2" },
    { "id":"e","source":"e1","target":"rds","label":"SQL" },
    { "id":"f","source":"e2","target":"rds","label":"SQL" },
    { "id":"g","source":"e1","target":"nat","label":"egress" },
    { "id":"h","source":"e2","target":"nat","label":"egress" },
    { "id":"i","source":"nat","target":"igw" }
  ]
}