AWS Well-Architected reference designs for 5 infrastructure projects, built with Draw.io using official AWS icons
3-AZ, zero-SPOF architecture with EC2 Auto Scaling, RDS Multi-AZ failover (<2 min RTO), CloudFront CDN, WAF (OWASP/SQLi rules), KMS CMK encryption at rest, IMDSv2, and SSM Session Manager (no bastion hosts, no SSH). Survives the loss of any single Availability Zone with no manual intervention.
3 AZs, RDS Multi-AZ failover <2 min, Auto Scaling on CPU + request metrics. Survives any single AZ loss.
WAF (OWASP/SQLi), KMS CMK, IMDSv2, SSM (no SSH), S3 OAC, zero public S3 ACLs
CloudFront edge caching reduces origin load ~60% | ElastiCache offloads DB reads
CloudFront global CDN, ElastiCache session store, ALB connection draining
Enterprise governance across 4 OUs and 10+ accounts. Transit Gateway hub-and-spoke for network isolation, IAM Identity Center SSO (SAML 2.0, MFA enforced), 8 Service Control Policies, delegated GuardDuty and Security Hub, and CloudTrail centralised to an immutable Log Archive account with MFA-Delete enabled.
SCPs are the primary guardrail: deny root API calls, block public S3 ACLs, require IMDSv2, enforce region boundaries
Transit Gateway with non-overlapping CIDRs; network account owns all routing (single failure domain for routing changes)
One identity source (IAM Identity Center); CloudTrail centralised to Log Archive with MFA-Delete S3 bucket
OU structure supports 100s of accounts; new account vending via Account Factory takes <15 min
Full CRUD REST API at 90% lower cost than EC2+RDS. Five Lambda functions on Graviton2/arm64 (−20% cost vs x86), API Gateway HTTP API, DynamoDB PAY_PER_REQUEST with GSI, AWS X-Ray distributed tracing, and GitHub Actions OIDC CI/CD, eliminating all long-lived secrets. CloudWatch alarms on Duration P99, error rate, and throttle count.
Graviton2 arm64 = 20% cheaper than x86; HTTP API = $1/M vs REST $3.50/M; DynamoDB PAY_PER_REQUEST = zero idle cost
OIDC eliminates GitHub secrets; Lambda IAM role scoped to one DynamoDB table; X-Ray traces all invocations
Deploy pipeline blocks on integration test failure; CloudWatch alarms on p99, error rate >1%, throttle count
Lambda cold start <300 ms (Python + Graviton2); DynamoDB single-digit ms reads; GSI enables query by status
Three-tier architecture (presentation, application, data) across 3 Availability Zones in us-east-1 with an active-passive warm standby in us-west-2. Route 53 health-check failover (10s intervals, 60s DNS TTL), RDS cross-region read replica promotable in ~1 min, S3 Cross-Region Replication, and a pre-scaled ASG enable automated failover with RTO < 15 min and RPO < 5 min. Total cost: ~$750/mo primary + ~$200/mo DR.
Route 53 health checks every 10s. 3 consecutive failures trigger DNS failover (60s TTL). RDS read replica promotes in ~1 min. ASG scales to capacity automatically on failover load.
ALB-SG: inbound 443 from CloudFront prefix list only · App-SG: port 8080 from ALB-SG only · DB-SG: port 3306 from App-SG only · Cache-SG: port 6379 from App-SG only. No direct internet access to any compute or data layer.
Primary us-east-1: ~$750/mo. DR warm standby us-west-2: ~$200/mo (30% of primary). S3/DynamoDB VPC Gateway Endpoints eliminate NAT charges for AWS service traffic. Graviton2 on RDS + ElastiCache.
CodePipeline rolling deploy with 20% min healthy + auto-rollback on failure. GuardDuty auto-isolation via Lambda. CloudTrail immutable audit log (Object Lock). Quarterly DR drill exercise documented.
Defence-in-depth across five layers: perimeter (WAF OWASP rules, CloudFront, Security Groups, NACLs), identity (IAM least-privilege, Permission Boundaries, IMDSv2, Secrets Manager 30-day rotation), data protection (KMS CMK, TLS 1.2+/ACM), detection (GuardDuty ML, Security Hub CIS benchmark, Config, Inspector), and automated response (EventBridge → Lambda isolation in <60 seconds).
WAF OWASP rules at edge; CloudFront enforces HTTPS; Security Groups use least-privilege; NACLs as stateless backstop
Permission Boundaries + SCPs prevent privilege escalation; IMDSv2 blocks SSRF; Secrets Manager rotates creds every 30 days
GuardDuty ML + Config >150 rules + Inspector CVE scanning all feed Security Hub (CIS benchmark score)
Security Hub → EventBridge → Lambda auto-isolates compromised EC2 (quarantine SG); SNS alerts on-call within seconds