Also, all databases and app servers should be private, accessed by a bastion server. The only thing the outside should be able to reach are the load balancers/reverse proxies.