Design for new solutions

Deployment strategy

• Infrastructure as code: CloudFormation (templates, change sets, drift detection, StackSets for multi-account, nested stacks, DeletionPolicy, stack policies, custom resources, CloudFormation Guard and hooks), CDK (code that synthesizes to CloudFormation), Terraform where the company already uses it, Service Catalog to let teams launch approved products with constraints and launch roles.
• CI/CD: CodePipeline orchestrates, CodeBuild builds, CodeDeploy deploys (EC2, on-premises, Lambda, ECS), CodeArtifact holds packages, ECR holds images. Third-party Git through CodeConnections. Cross-account pipelines assume roles in target accounts and use a customer managed KMS key for the artifact bucket.
• Deployment patterns and rollback:

• Lambda versions and aliases with weighted alias routing give canary releases. CodeDeploy hooks (BeforeAllowTraffic, AfterAllowTraffic) run tests and roll back on a failed CloudWatch alarm.
• Managed services to cut patching: RDS and Aurora, ECS/EKS on Fargate, Lambda, Elastic Beanstalk, App Runner, MSK, OpenSearch Service, Amazon MQ, Managed Service for Apache Flink. Systems Manager (Patch Manager, State Manager, Automation, Parameter Store, Session Manager) covers instances you must keep.
• Delegating complex work to AWS: Amazon Bedrock and SageMaker instead of self-hosted model servers, Amazon Textract, Rekognition, Transcribe, Comprehend, Translate, Lex, Kendra, Forecast-style services instead of building models. Keywords: “without ML expertise”, “no data scientists” mean prebuilt AI services.
• Upgrade paths: managed version upgrades (RDS blue/green deployments, Aurora minor and major upgrades, EKS control plane versions, OpenSearch blue/green changes), compatibility checks in lower environments first, AWS Application Composer and Well-Architected Tool to review.
• Change management: AWS Config records changes, Systems Manager Change Manager approvals, OpsCenter for operational issues, Service Catalog for governed launches.

Business continuity

• Combine RTO/RPO with the DR ladder from the organizational-complexity notes. Here the question is usually “design for this RTO and RPO”, with these tools:
  • RPO near zero, RTO minutes: active-active (Route 53 latency or weighted records, DynamoDB global tables, Aurora Global Database with write forwarding, S3 multi-Region access points) or warm standby.
  • RTO in hours, tight cost: backup and restore with AWS Backup cross-Region copies, or pilot light.
• Route 53 routing policies:

• Health checks can monitor endpoints, other health checks (calculated) or a CloudWatch alarm (for private resources). Alias records to ALB, CloudFront, API Gateway and S3 websites are free and support “evaluate target health”.
• Route 53 Application Recovery Controller (ARC): readiness checks, routing controls (on/off switches with a highly available data plane, not dependent on a single Region’s control plane) and zonal shift and zonal autoshift for load balancers. The answer for “reliably fail over without depending on the failing Region’s APIs”.
• Global Accelerator gives two static anycast IPs and fast (about 30 second) failover between Regional endpoints with no DNS cache dependency; better than Route 53 when clients cache DNS or need static IPs.
• Data replication: Aurora Global Database, DynamoDB global tables, RDS cross-Region replicas, S3 CRR/SRR with Replication Time Control, S3 Multi-Region Access Points with failover, EFS and FSx replication, ElastiCache Global Datastore, Elastic Disaster Recovery for servers, AWS Backup for everything else including logically air-gapped vaults.
• DR testing: run it, and run it without taking production down. Drills in DRS, Fault Injection Service, Route 53 ARC practice, runbooks in Systems Manager Automation, regular restore tests with AWS Backup restore testing.
• Backup design: automated plans by tag, lifecycle to cold storage, cross-Region and cross-account copies, Vault Lock, backup of EBS, RDS, DynamoDB, EFS, FSx, S3, EC2, VMware and more. Cost: incremental snapshots, lifecycle policies, short retention for non-prod.
• Centralized monitoring to recover proactively: CloudWatch alarms and composite alarms, Synthetics canaries, EventBridge, Health Dashboard events, Systems Manager Automation runbooks, Auto Scaling replacement.

Security controls

• Least privilege IAM: roles over users, no long-lived keys, permission boundaries for delegated admins, conditions (aws:PrincipalOrgID, aws:SourceVpce, aws:SourceIp, aws:MultiFactorAuthPresent, aws:RequestedRegion), attribute-based access control with tags (aws:PrincipalTag equals aws:ResourceTag) so one policy scales across projects, Access Analyzer policy generation, instance profiles for EC2, task roles for ECS, IRSA or EKS Pod Identity for pods, IAM Roles Anywhere for workloads outside AWS.
• Network flows: security groups (stateful, allow-only, can reference other security groups, no explicit deny); NACLs (stateless, numbered rules, allow and deny, subnet level, ephemeral ports). Use security group references for tier-to-tier rules, NACL deny rules to block specific IPs. Subnet tiers: public (ALB, NAT), private (app), isolated (data).
• Service endpoints: gateway endpoints for S3 and DynamoDB, interface endpoints for most other services, endpoint policies, PrivateLink for your own services, S3 access points with VPC-only network origin.
• Attack mitigation for large web apps:
  • CloudFront and Route 53 absorb volumetric traffic at the edge; put the origin behind CloudFront only (origin access control for S3, a prefix list or custom header for ALB origins).
  • AWS Shield Standard is on by default. Shield Advanced adds layer 3/4/7 detection, DDoS response team, cost protection and health-based detection; protect Elastic IPs, CloudFront, Route 53, ALB, Global Accelerator.
  • AWS WAF web ACLs on CloudFront, ALB, API Gateway, AppSync, Cognito user pools: managed rule groups, rate-based rules, Bot Control, Account Takeover Prevention, geo match, IP sets. Logs to S3, CloudWatch Logs or Firehose.
  • Firewall Manager for organization-wide policies. Network Firewall for stateful inspection in VPCs.
  • Auto Scaling and over-provisioned capacity absorb application layer spikes.
• Encryption at rest: S3 SSE-S3, SSE-KMS (per-request KMS cost; S3 Bucket Keys reduce it), SSE-C, client-side; EBS encryption (enable by default per Region), RDS and Aurora (decided at creation; encrypt an unencrypted DB by copying a snapshot with a key), DynamoDB (always encrypted), EFS and FSx, Redshift, OpenSearch, SQS and SNS server-side encryption. CloudHSM for dedicated FIPS 140-2 Level 3 single-tenant HSMs.
• In transit: TLS everywhere, ACM, mutual TLS on ALB and API Gateway, Site-to-Site VPN, MACsec, S3 and RDS enforcement of TLS.
• Credential management: Secrets Manager (rotation for RDS, Redshift, DocumentDB natively, replication across Regions, cross-account via resource policy), Parameter Store, IAM Identity Center, Cognito, temporary STS credentials.
• Managed security services: GuardDuty (threat detection from CloudTrail, VPC flow, DNS, S3, EKS, Lambda, malware protection), Security Hub (aggregation and standards such as CIS and FSBP), Inspector (EC2, ECR, Lambda vulnerabilities), Macie (S3 sensitive data), Detective (investigation), Config, Audit Manager.
• Patch management: Systems Manager Patch Manager with patch baselines, patch groups, maintenance windows and organization-wide patch policies through Quick Setup; Inspector finds missing patches; EC2 Image Builder produces patched golden AMIs on a schedule; immutable infrastructure means replacing instances with a new AMI instead of patching in place; container images rebuilt from patched base images and scanned in ECR.

Reliability

• High availability means spreading across at least two AZs (three for quorum systems), stateless tiers behind load balancers, Auto Scaling across AZs, health checks with replacement, and managed Multi-AZ data stores.
• Load balancers: ALB (HTTP/HTTPS, path and host rules, WebSockets, Lambda targets, OIDC and Cognito auth), NLB (TCP/UDP/TLS, static IP per AZ, millions of requests per second, PrivateLink provider), GWLB (appliances), Classic (legacy). Cross-zone load balancing is on by default for ALB, off for NLB.
• Auto Scaling policies: target tracking (default choice), step, simple, scheduled, predictive scaling; lifecycle hooks, warm pools to cut launch time, instance refresh, mixed instances policy with Spot and On-Demand and capacity-optimized allocation, attribute-based instance selection. Cooldown and warm-up avoid flapping. Scale on queue depth per instance for SQS workers.
• Data store HA: RDS Multi-AZ instance (one standby, synchronous), Multi-AZ DB cluster (two readable standbys, faster failover), Aurora (six copies across three AZs, up to 15 replicas, failover about 30 seconds), DynamoDB (three AZs; PITR and global tables), ElastiCache Multi-AZ with automatic failover, OpenSearch with three AZs, S3 (three or more AZs; One Zone classes are a single AZ), EFS (Regional), EBS (single AZ - use snapshots or app replication).
• Loose coupling: SQS (standard at-least-once with best-effort ordering; FIFO exactly-once, ordered per message group, 300 transactions/s without batching and 3,000 with, higher with high throughput mode; visibility timeout; dead-letter queues; 14 days retention max), SNS (pub/sub fan-out, FIFO topics, message filtering), EventBridge (event bus, schedules, Pipes, schema registry, archive and replay, cross-account), Step Functions (Standard up to one year, exactly-once; Express up to five minutes, at-least-once, high volume; Distributed Map), Kinesis and MSK for streams. SNS plus SQS fan-out is the default for independent consumers.
• Design for failure: timeouts, retries with exponential backoff and jitter, circuit breakers, idempotent consumers, bulkheads, health checks that don’t depend on downstream services, graceful degradation, static stability (keep running without calling the control plane).
• Service quotas: quotas are per Region and per account; Service Quotas console and API raise them, with CloudWatch alarms on usage. Common ones: Lambda concurrency 1,000 per Region by default (reserved concurrency carves out a share, provisioned concurrency pre-warms), API Gateway 10,000 requests/second per Region default and 29-second integration timeout, EC2 vCPU quotas per family, VPC peering 125 per VPC, ENIs per instance, 5 VPCs per Region by default (adjustable), Elastic IPs 5 per Region, S3 3,500 PUT and 5,500 GET per second per prefix, Kinesis 1 MB/s or 1,000 records/s per shard on write, DynamoDB partition 3,000 RCU and 1,000 WCU. In multi-account designs, many accounts spread quota pressure.
• Operating HA: planned failovers (RDS reboot with failover), Route 53 health checks, Fault Injection Service, game days, runbooks.

Performance

• Compute selection: instance families (general M/T, compute C, memory R/X, storage I/D, accelerated P/G/Inf/Trn, HPC Hpc), Graviton (Arm) for better price-performance, burstable T with credits, placement groups (cluster for low latency within one AZ, spread for isolation across racks, partition for big distributed systems), Enhanced networking and EFA for HPC and ML, Nitro. Lambda for event-driven bursts (15-minute limit, 10 GB memory, 10 GB /tmp), containers for long-running and portable, EC2 for custom OS or licensing.
• Storage selection:

• Purpose-built databases:

• Caching, buffering and replicas: CloudFront (edge caching, Lambda@Edge and CloudFront Functions), API Gateway caching, DAX, ElastiCache in front of databases, read replicas for read scaling, RDS Proxy to pool connections from Lambda, SQS/Kinesis as buffers, S3 Transfer Acceleration for uploads, Global Accelerator for TCP/UDP anycast performance, S3 multipart upload for large objects, byte-range fetches for reads.
• Elasticity: target tracking on CPU, request count per target, or custom metrics; Aurora Serverless v2, DynamoDB on-demand or auto scaling, Lambda concurrency, Fargate, Kinesis on-demand mode, EMR managed scaling.
• Large-scale access patterns: read-heavy (cache, replicas, CDN), write-heavy (partition keys with high cardinality, sharding, queues), spiky (serverless, buffers), global (CloudFront, Global Accelerator, global tables, Aurora Global), analytical (Redshift, Athena, Lake Formation, Glue).
• Monitoring performance: CloudWatch metrics, Logs Insights, Application Signals, X-Ray, Container Insights, Performance Insights for RDS, Compute Optimizer, Contributor Insights. Rightsizing: measure first (CloudWatch with memory metrics from the agent), then change size or family.

Cost optimization for new designs

• Rightsize and choose cheaper resources: Graviton, Spot for fault-tolerant tiers, serverless for variable load, Aurora Serverless v2 for unpredictable databases, scale in to zero when possible, stop dev environments on schedule (Instance Scheduler).
• Pricing models: baseline steady state through Savings Plans or Reserved Instances, variable load On-Demand, interruptible Spot. RDS and ElastiCache and OpenSearch and Redshift have reserved nodes. DynamoDB has reserved capacity for provisioned mode. Compute Savings Plans follow you through instance changes and into Fargate and Lambda.
• Storage tiering:

Lifecycle rules move and expire objects. EBS snapshots archive tier; EFS Infrequent Access and Archive; DynamoDB Standard-IA table class.

• Data transfer: inbound is free; same-AZ private traffic is free; cross-AZ costs per GB each way; cross-Region and internet out cost more. NAT gateways charge per GB processed, so add gateway endpoints for S3 and DynamoDB. CloudFront egress is cheaper than direct from the Region, and traffic from origin to CloudFront is free. Keep chatty tiers in one AZ only when availability allows; use VPC endpoints; compress; cache; use Direct Connect for large steady transfer.
• Managed offerings often lower total cost by removing operations work even when the unit price is higher.
• Controls for awareness: Budgets with actions (apply an SCP or stop instances at a threshold), Cost Anomaly Detection, tags and cost categories, SCPs that deny expensive instance types, Service Catalog constraints, quotas.