graph TB
    subgraph iPhone["iPhone"]
        App["VPN Control App"]
        Keychain["`Keychain
        (API Key Storage)`"]
    end

    subgraph AWS["AWS Cloud"]
        subgraph API["API Layer"]
            APIG["API Gateway"]
                subgraph APIK["Authorization"]
                    APIKey["API Key"]
                end
            Lambda["Lambda Function"]
        end
        
        subgraph VPC["VPC (10.0.0.0/16)"]
            subgraph PublicSubnet["Public Subnet (10.0.1.0/24)"]
                EC2["`EC2 Instance 
                (OpenVPN Server)`"]
                EIP["Elastic IP"]
            end
            IGW["Internet Gateway"]
            SG["`Security Group 
            - UDP 1194 (VPN) 
            - TCP 22 (SSH)`"]
        end
        
        subgraph IAM["IAM"]
            Role["Lambda IAM Role"]
        end
    end

    subgraph Internet["Internet"]
        Client["VPN Client"]
    end

    %% App connections
    App -->|"HTTPS API Requests"| APIG
    App <-->|"Store/Retrieve"| Keychain

    %% API Layer connections
    APIG -->|"Validate"| APIK
    APIG -->|"Invoke"| Lambda
    Lambda -->|"Start/Stop/Status"| EC2
    Lambda <-->|"Assume"| Role

    %% VPC connections
    EC2 <-->|"Attach"| EIP
    EC2 -->|"Use"| SG
    PublicSubnet -->|"Route"| IGW
    IGW -->|"Internet Access"| Internet

    %% Client connections
    Client <-->|"VPN Traffic UDP 1194"| EIP

    %% Styles
    classDef aws fill:#FF9900,stroke:#232F3E,color:black;
    classDef service fill:#7AA116,stroke:#232F3E,color:black;
    classDef network fill:#3F8624,stroke:#232F3E,color:white;
    classDef security fill:#DD344C,stroke:#232F3E,color:white;
    classDef client fill:#3B48CC,stroke:#232F3E,color:white;

    class AWS aws;
    class APIG,Lambda,EC2,EIP service;
    class VPC,PublicSubnet,IGW network;
    class SG,Role,APIKey,Keychain security;
    class App,Client client;