AWS Architecture Reference

AWS Architecture Reference

Comprehensive guide for AWS services, patterns, and Well-Architected Framework implementation.

Well-Architected Framework

Six Pillars

1. Operational Excellence

   • Infrastructure as Code (CloudFormation, CDK, Terraform)
   • Continuous integration/deployment
   • Observability (CloudWatch, X-Ray)
   • Runbooks and playbooks
   • Game days and failure injection

2. Security

   • Identity and Access Management (IAM)
   • Detective controls (GuardDuty, Security Hub)
   • Infrastructure protection (VPC, security groups, NACLs)
   • Data protection (KMS, encryption at rest/transit)
   • Incident response automation

3. Reliability

   • Multi-AZ deployments
   • Auto Scaling groups
   • Route 53 health checks and failover
   • Backup and restore (AWS Backup)
   • Chaos engineering (AWS FIS)

4. Performance Efficiency

   • Right-sizing with Compute Optimizer
   • Caching strategies (CloudFront, ElastiCache)
   • Database optimization (RDS Performance Insights)
   • Serverless architectures
   • Global content delivery

5. Cost Optimization

   • Reserved Instances and Savings Plans
   • Spot Instances for fault-tolerant workloads
   • S3 Intelligent-Tiering and lifecycle policies
   • Right-sizing recommendations
   • Cost allocation tags and budgets

6. Sustainability

   • Region selection for renewable energy
   • Serverless to minimize idle resources
   • Efficient data storage patterns
   • Resource utilization optimization

Core Services Architecture

Compute

EC2 (Elastic Compute Cloud)

• Instance families: General (t3, m5), Compute (c5), Memory (r5), GPU (p3, g4)
• Auto Scaling: Target tracking, step scaling, scheduled scaling
• Placement groups: Cluster, partition, spread
• Best practices: Use latest generation, right-size, enable detailed monitoring

Lambda

• Invocation models: Synchronous, asynchronous, event source mapping
• Concurrency: Reserved, provisioned, burst limits
• Layers for shared dependencies
• Best practices: Keep functions small, use environment variables, set timeouts

ECS/EKS (Container Services)

• ECS: Fargate for serverless, EC2 for control
• EKS: Managed Kubernetes with AWS integration
• Service mesh: App Mesh for observability
• Best practices: Use Fargate for simplicity, EKS for portability

Elastic Beanstalk

• Managed platform for web apps
• Auto-scaling and load balancing included
• Support for multiple languages and Docker

Storage

S3 (Simple Storage Service)

• Storage classes: Standard, IA, One Zone-IA, Glacier, Deep Archive
• Lifecycle policies for automatic tiering
• Versioning and MFA delete for protection
• Cross-region replication for DR
• Best practices: Enable versioning, use lifecycle policies, block public access

EBS (Elastic Block Store)

• Volume types: gp3 (general), io2 (IOPS), st1 (throughput), sc1 (cold)
• Snapshots to S3 for backup
• Encryption by default
• Best practices: Use gp3 for most workloads, enable encryption

EFS (Elastic File System)

• NFSv4 file system for shared access
• Performance modes: General purpose, Max I/O
• Throughput modes: Bursting, provisioned
• Best practices: Use lifecycle management, enable encryption

FSx

• FSx for Windows File Server (SMB)
• FSx for Lustre (HPC workloads)
• FSx for NetApp ONTAP
• FSx for OpenZFS

Database

RDS (Relational Database Service)

• Engines: MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, Aurora
• Multi-AZ for high availability
• Read replicas for scalability
• Automated backups and point-in-time recovery
• Best practices: Use Aurora for performance, enable Multi-AZ, use read replicas

Aurora

• MySQL and PostgreSQL compatible
• 5x MySQL, 3x PostgreSQL performance
• Global databases for cross-region DR
• Serverless v2 for variable workloads
• Best practices: Use Aurora Serverless for unpredictable workloads

DynamoDB

• NoSQL key-value and document database
• On-demand or provisioned capacity
• Global tables for multi-region replication
• DynamoDB Streams for change data capture
• Best practices: Use on-demand for unpredictable traffic, implement GSI carefully

ElastiCache

• Redis or Memcached in-memory caching
• Cluster mode for Redis scalability
• Best practices: Use for session storage, API caching

Networking

VPC (Virtual Private Cloud)

• CIDR planning: Avoid overlaps, plan for growth
• Subnets: Public (IGW), private (NAT), isolated (no internet)
• Route tables and routing decisions
• Security groups (stateful) and NACLs (stateless)
• Best practices: Use /16 for VPC, /24 for subnets, plan IP space

Route 53

• DNS service with health checks
• Routing policies: Simple, weighted, latency, failover, geolocation
• Best practices: Use alias records, enable DNSSEC

CloudFront

• Global CDN with edge locations
• Origin types: S3, ALB, custom origins
• Lambda@Edge for request/response manipulation
• Best practices: Enable compression, use field-level encryption

VPN and Direct Connect

• Site-to-Site VPN for encrypted tunnels
• Direct Connect for dedicated bandwidth
• Transit Gateway for hub-and-spoke topology
• Best practices: Use Direct Connect for high bandwidth, Transit Gateway for complex routing

API Gateway

• REST APIs, HTTP APIs, WebSocket APIs
• Throttling and quotas
• Integration with Lambda, HTTP endpoints, AWS services
• Best practices: Use HTTP APIs for lower cost, implement caching

Security

IAM (Identity and Access Management)

• Principle of least privilege
• Roles for applications, not access keys
• MFA for privileged users
• Service Control Policies (SCPs) for organization-wide controls
• Best practices: Use roles, enable MFA, rotate credentials

KMS (Key Management Service)

• Customer managed keys (CMKs)
• Automatic key rotation
• Envelope encryption pattern
• Best practices: Enable automatic rotation, use grants for temporary access

Secrets Manager

• Automatic rotation for RDS credentials
• Versioning and rollback
• Best practices: Rotate secrets regularly, use VPC endpoints

Security Hub

• Centralized security findings
• CIS AWS Foundations Benchmark
• Integration with GuardDuty, Inspector, Macie

GuardDuty

• Threat detection using ML
• Monitors CloudTrail, VPC Flow Logs, DNS logs

Architecture Patterns

High Availability

Multi-AZ Pattern

- Application Load Balancer across 3 AZs
- Auto Scaling group with instances in each AZ
- RDS Multi-AZ for database
- S3 for static assets (11 9's durability)

Multi-Region Pattern

- Route 53 with health checks and failover
- CloudFront for global distribution
- Aurora Global Database for <1s RPO
- S3 Cross-Region Replication

Serverless Architecture

API-Driven Pattern

API Gateway -> Lambda -> DynamoDB
              |
              v
          EventBridge -> Lambda (async processing)

Event-Driven Pattern

S3 Event -> Lambda -> Process -> SNS
                                  |
                                  v
                              Multiple subscribers

Microservices on AWS

Container-Based

ALB -> ECS Fargate (multiple services)
    |
    v
Service Discovery (Cloud Map)
    |
    v
RDS/DynamoDB per service

Service Mesh

App Mesh for traffic management
X-Ray for distributed tracing
CloudWatch Container Insights

Data Lake Architecture

Data Sources -> Kinesis Data Streams
                      |
                      v
              Kinesis Firehose
                      |
                      v
                S3 (raw bucket)
                      |
                      v
        Glue ETL or Lambda processing
                      |
                      v
            S3 (processed bucket)
                      |
                      v
          Athena/Redshift Spectrum
                      |
                      v
              QuickSight dashboards

Migration Strategies (6Rs)

1. Rehost (Lift-and-Shift)

   • AWS Application Migration Service (MGN)
   • Minimal changes, quick migration
   • Use for legacy apps with compliance constraints

2. Replatform (Lift-Tinker-and-Shift)

   • Migrate to RDS instead of self-managed databases
   • Use Elastic Beanstalk instead of custom app servers
   • Small optimizations during migration

3. Repurchase (Drop-and-Shop)

   • Move to SaaS (e.g., Salesforce, Workday)
   • Reduce maintenance burden

4. Refactor/Re-architect

   • Modernize to serverless or containers
   • Highest effort, highest benefit
   • Use for competitive advantage applications

5. Retire

   • Decommission unused applications
   • Reduce attack surface and costs

6. Retain

   • Keep on-premises temporarily
   • Migrate later or keep for regulatory reasons

Landing Zone Design

AWS Control Tower

• Multi-account strategy (AWS Organizations)
• Account factory for standardization
• Guardrails for governance (SCPs)
• Centralized logging (CloudTrail, Config)

Account Structure

Root
├── Security OU
│   ├── Log Archive Account
│   └── Security Tooling Account
├── Infrastructure OU
│   ├── Network Account (Transit Gateway, VPN)
│   └── Shared Services Account
└── Workloads OU
    ├── Production Account
    ├── Staging Account
    └── Development Account

Network Design

Transit Gateway (hub)
    |
    ├── Production VPC
    ├── Staging VPC
    ├── Development VPC
    └── On-premises (Direct Connect/VPN)

Cost Optimization Strategies

Compute Savings

• Compute Savings Plans (up to 66% savings)
• EC2 Reserved Instances (1-year or 3-year)
• Spot Instances for batch/fault-tolerant workloads
• Lambda: Reduce memory if possible, use reserved concurrency

Storage Savings

• S3 Intelligent-Tiering for unpredictable access
• Lifecycle policies to Glacier/Deep Archive
• EBS gp3 instead of gp2 (20% cheaper, better performance)
• Delete unused snapshots and volumes

Database Savings

• Aurora Serverless v2 for variable workloads
• RDS Reserved Instances
• DynamoDB on-demand for unpredictable workloads
• Read replicas in same region to reduce cross-AZ data transfer

Monitoring and Alerting

• AWS Cost Explorer for analysis
• AWS Budgets for alerts
• Cost Anomaly Detection
• Trusted Advisor for recommendations

Disaster Recovery

RPO and RTO Targets

• Backup and Restore: Hours RPO/RTO (lowest cost)
• Pilot Light: Minutes RPO, hours RTO
• Warm Standby: Seconds RPO, minutes RTO
• Multi-Site Active/Active: Near-zero RPO/RTO (highest cost)

Implementation

• AWS Backup for centralized backup management
• Aurora Global Database for cross-region replication
• S3 Cross-Region Replication
• Route 53 health checks and failover routing
• Regular DR testing with CloudFormation/Terraform

Monitoring and Observability

CloudWatch

• Metrics: Standard (5 min) and detailed (1 min)
• Alarms with SNS notifications
• Logs Insights for log analysis
• Dashboards for visualization

X-Ray

• Distributed tracing for microservices
• Service map visualization
• Trace annotations and metadata

AWS Config

• Resource inventory and change tracking
• Compliance rules evaluation
• Relationship tracking between resources