Module 1: Review Architecting Concepts - Advanced Architecting on AWS

🏛️ Well-Architected Framework — 6 Pillars

Pillar	Focus	Key Question
Operational Excellence	Run & monitor systems	How do you evolve operations?
Security	Protect data & systems	How do you detect & respond to events?
Reliability	Recover from failures	How do you manage change & failure?
Performance Efficiency	Use resources efficiently	How do you select the right resources?
Cost Optimization	Avoid unnecessary costs	How do you manage spending?
Sustainability	Minimize environmental impact	How do you reduce downstream impact?

Analogy: Think of the 6 pillars as the foundation of a building — neglect any one and the structure becomes unstable. Each pillar reinforces the others.

📐 General Design Principles

Stop guessing capacity: Auto-scale based on demand instead of pre-provisioning
Test at production scale: Create full-scale test environments on demand, then tear down
Automate to make experimentation easier: IaC enables repeatable deployments
Allow for evolutionary architectures: Design for change, not permanence
Drive architecture using data: Use metrics and observability to inform decisions
Improve through game days: Simulate failures (Chaos Engineering) regularly

Advanced context: At scale, these principles become critical. You can't manually manage 50+ accounts — automation and data-driven decisions are non-negotiable.

🔐 Shared Responsibility Model

🌍 AWS Global Infrastructure

🌐

33+ Regions

Geographic areas with multiple isolated data centers

🏢

100+ AZs

One or more discrete data centers with redundant power/networking

📡

600+ Edge Locations

CloudFront PoPs + Regional Edge Caches for low-latency delivery

Key for this course: Understanding Regions vs. AZs vs. Edge is foundational. We'll design architectures spanning multiple Regions (Module 8) and extending to the Edge (Module 13).

🗺️ Region Selection Criteria

Compliance: Data residency & sovereignty requirements (e.g., GDPR → eu-west-1)
Latency: Proximity to end users — lower latency = better UX
Service Availability: Not all services available in all Regions
Cost: Pricing varies by Region (US East typically cheapest)

Factor	Weight	Example
Data Sovereignty	High (blocker)	Healthcare → must stay in-country
Latency to Users	High	APAC users → ap-southeast-1
Service Features	Medium	New services launch in us-east-1 first
Pricing	Low-Medium	São Paulo 30-50% more than Virginia

💻 Demo: Well-Architected Tool

View a Well-Architected Review

# List Well-Architected workloads
aws wellarchitected list-workloads --query 'WorkloadSummaries[].{Name:WorkloadName,Risk:RiskCounts}'

# Get a lens review
aws wellarchitected get-lens-review \
  --workload-id "abc123def456" \
  --lens-alias "wellarchitected" \
  --query 'LensReview.PillarReviewSummaries[].{Pillar:PillarName,Risk:RiskCounts}'

# List available lenses (WAF, SaaS, Serverless, etc.)
aws wellarchitected list-lenses --query 'LensSummaries[].{Name:LensName,ARN:LensArn}'

Instructor tip: Use the WA Tool to review a sample workload and show how pillar risks are identified and tracked over time.

🧪 Knowledge Check

Q1: Which pillar of the Well-Architected Framework was added most recently (2021)?

A) Security B) Cost Optimization C) Sustainability D) Reliability

C) Sustainability — Added in December 2021, it focuses on minimizing environmental impact through efficient resource usage, right-sizing, and managed services.

Q2: In the Shared Responsibility Model, who is responsible for patching the guest OS on an EC2 instance?

A) AWS B) The customer C) Shared responsibility D) The ISV

B) The customer — For IaaS services like EC2, the customer manages the guest OS, including patching and hardening. AWS manages the underlying hypervisor and hardware.

📝 Module 1 Summary

Well-Architected Framework

6 pillars: Ops Excellence, Security, Reliability, Perf Efficiency, Cost Optimization, Sustainability

Design Principles

Automate, test at scale, allow evolution, data-driven, game days

Global Infrastructure

33+ Regions, 100+ AZs, 600+ Edge locations. Choose Region by compliance, latency, services, cost.

Key Takeaway

Every architecture decision in this course maps back to these pillars. They're your evaluation framework.

🎯 Demo: S3 Gateway Endpoint from Private Subnet

Access S3 from an EC2 in a private subnet — no NAT Gateway needed

Step 1: Create the VPC Gateway Endpoint for S3

# Get your VPC ID and route table ID for the private subnet
VPC_ID="vpc-0abc123def456"
PRIVATE_RT="rtb-0private123"

# Create the S3 Gateway Endpoint
aws ec2 create-vpc-endpoint \
  --vpc-id $VPC_ID \
  --service-name com.amazonaws.us-east-1.s3 \
  --route-table-ids $PRIVATE_RT \
  --region us-east-1

# Verify — you'll see a new route in your route table (pl-xxxxx → vpce-xxxxx)
aws ec2 describe-route-tables --route-table-ids $PRIVATE_RT \
  --query "RouteTables[0].Routes[?GatewayId!='local']" --output table

Step 2: Ensure EC2 has an IAM Role with S3 access

# Attach an instance profile with S3 access to your EC2
aws ec2 associate-iam-instance-profile \
  --instance-id i-0abc123def456 \
  --iam-instance-profile Name=EC2-S3-Access-Role

# Or verify existing role
aws ec2 describe-instances --instance-ids i-0abc123def456 \
  --query "Reservations[0].Instances[0].IamInstanceProfile.Arn"

Step 3: SSH into EC2 and test S3 access

# Connect via SSM (no SSH needed for private instances)
aws ssm start-session --target i-0abc123def456

# Once inside the EC2:
aws s3 ls                              # List buckets
aws s3 ls s3://my-bucket/              # List objects
aws s3 cp s3://my-bucket/file.txt .    # Download file
echo "Hello from private subnet" > test.txt
aws s3 cp test.txt s3://my-bucket/     # Upload file

Step 4: (Optional) Restrict endpoint with policy

# Restrict the endpoint to only allow access to specific buckets
aws ec2 modify-vpc-endpoint --vpc-endpoint-id vpce-0abc123 \
  --policy-document '{
    "Statement": [{
      "Sid": "AllowSpecificBucket",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }]
  }'

Key point: Gateway endpoints are free, add a route to your route table, and traffic stays on the AWS private network — never touches the internet. No NAT Gateway costs!

Module 1: Reviewing Architecting Concepts

🎯 Module Objectives