AWS Well-Architected framework (February 2018 CSAA Exam)

The Well-Architected framework has been developed to help cloud architects build the most secure, high-performing, resilient, and efficient infrastructure possible for their applications. This framework provides a  consistent approach for customers and partners to evaluate architectures,  and provides guidance to help implement designs that will scale with your  application needs over time. Following are the five pillars of well architected framework.

1. Resilient Architecture Pillar (FARMD)
   1. Fault tolerant: Multi AZ RDS, Route 53 failover policies, ELB health checks
   2. High Availability by spreading across Availability Zones (Using ELB with health checks, Route 53 failover routing etc)
   3. Resilient/reliable storage (S3 is inherently reliable. Use multi AZ deployment in RDS for Disaster Recovery)
   4. Multi tier architecture (ELB/CloudFront tier, web/app tier, data tier)
   5. Decouple system components to avoid single point of failure (use SQS/SWF)
2. High performant architecture Pillar (SECRI)
   1. Scalability: Scaling up/down by using proper instance types with desired amount of cpu/memory
   2. Elasticity: Scaling out/in with increase/decrease number of instances, load balancing and auto scaling features
   3. Cacheing (Elasticache, Aurora Cache, Cloud Front with edge locations, S3 transfer acceleration)
   4. Read replicas: High performance DB tier
   5. IOPS: High performance storage (Provisioned IOPS EBS or standard burstable EBS )
3. Security Pillar
   1. WAF, VPC ACLs, Security Groups
   2. Bastion hosts for accessing EC2s in private subnets thru SSH/RDS
   3. NAT gateway/instances for downloading patches from internet for EC2 instances inside private subnets
   4. Principal centric security (IAM policies)
   5. Resource centric security (Bucket policies, origin access identities)
   6. Encryption in flight and at rest
   7. Key rotation, MFA, EC2 instance profiles with IAM roles, STS
4. Cost effective design Pillar
   1. Application tier (spot instances, scaling down, scheduled stop/start)
   2. Storage tier
      1. Using appropriate storage types eg: Glacier vs S3 RR vs S3.
      2. Using standard HDD as opposed to SSD  for web tier for small and medium businesses
      3. Deleting unused/unnecessary snapshots, AMIs, S3 objects/buckets
      4. Reduce RDS automatic daily backups
   3. Data transfer
      1. Using VPC endpoints for S3 access to reduce data transfer costs
      2. Transfer using private ips within a AZ for getting local transfer rates
   4. Data/service request costs
      1. S3 or API gateway requests are measured and billed
      2. Using cloud front in front of S3 to reduce S3 requests
      3. Use long polling SQS
5. Operational Excellence Pillar
   1. Perform operations as code using cloud formation etc
      1. define your entire workload (applications, infrastructure, etc.) as code and update it with code.
      2. You can script your operations procedures and automate their execution by triggering them in response to events.
      3. By performing operations as code, you limit human error and enable consistent responses to events. Also repeatable.
   2. Annotated documentation
      1. you can automate the creation of annotated documentation after every build (or automatically annotate hand-crafted documentation).
      2. Annotated documentation can be used by humans and systems.
      3. Use annotations as an input to your operations code. Example: Tagging all development EC2’s with simple tag different from production EC2’s
   3.  Make frequent, small, reversible changes:
   4. Refine operations procedures frequently:
      1. As you use operations procedures, look for opportunities to improve them.
      2. As you evolve your workload, evolve your procedures appropriately.
   5. Anticipate failure
      1. Perform “pre-mortem” exercises to identify potential sources of failure so that they can be removed or mitigated.
      2. Test your failure scenarios and validate your understanding of their
         impact.
      3. Test your response procedures to ensure they are effective and that teams are familiar with their execution.
   6. Learn from all operational failures and Share what is learned across teams and through the entire organization.
   7. Use AWS Support
      1. AWS Cloud Compliance enables you to understand the robust
         controls in place at AWS to maintain security and data protection in the cloud.
      2. AWS Trusted Advisor provides real-time guidance to help you
         provision your resources following AWS best practices.
      3. Business Support provides access to the full set of Trusted Advisor
         checks and guidance for following AWS best practices.
      4. Enterprise Support customers also receive support from Technical
         Account Managers (TAMs)