The Well-Architected Framework

AWS's Well-Architected Framework captures best practices across six pillars for building sound cloud systems.

The AWS Well-Architected Framework is a set of best practices for designing reliable, secure, efficient and cost-effective systems. It is organized into six pillars.

PillarFocus
Operational ExcellenceRun and monitor systems; improve continuously
SecurityProtect data, systems and identities
ReliabilityRecover from failure; scale to meet demand
Performance EfficiencyUse resources efficiently as needs change
Cost OptimizationAvoid unnecessary spend
SustainabilityMinimize environmental impact

A worked example: the three-tier web app

Many of these ideas come together in the classic three-tier architecture — a public web tier, a private application tier and a private database tier.

A three-tier architecture: web tier, application tier and database tierWeb tierCloudFront + ELBpublic subnetApp tierEC2 / Lambdaprivate subnetDatabase tierRDS / DynamoDBprivate subnet
The three-tier pattern isolates each layer in its own subnet for security and scalability.

Example

Example · yaml
# The six pillars, as a quick reference checklist
WellArchitected:
  - OperationalExcellence: automate operations, use IaC, monitor everything
  - Security:              least privilege, encrypt data, enable MFA
  - Reliability:           multi-AZ, health checks, automatic recovery
  - PerformanceEfficiency: right instance types, caching, scaling
  - CostOptimization:      right-size, Savings Plans, delete idle resources
  - Sustainability:        efficient regions, managed services, less waste

When to use it

  • A startup uses the Well-Architected Tool to run a workload review before launching to production, discovering they have no automated backups on their RDS instance.
  • An enterprise architect maps each of the six pillars against their legacy migration plan to ensure the new cloud architecture addresses reliability and security gaps.
  • A team runs a quarterly Well-Architected review of their SaaS platform and tracks high-risk findings as Jira tickets until they are resolved.

More examples

Create a Workload in WAF Tool

Creates a workload entry in the Well-Architected Tool to track review findings against the six pillars framework.

Example · bash
aws wellarchitected create-workload \
  --workload-name "ecommerce-platform" \
  --description "Main customer-facing e-commerce app" \
  --environment PRODUCTION \
  --aws-regions us-east-1 \
  --review-owner [email protected] \
  --lenses wellarchitected

List Workload High Risks

Lists all questions in a Well-Architected review where the answer was marked as HIGH risk, prioritizing remediation work.

Example · bash
WORKLOAD_ID=$(aws wellarchitected list-workloads \
  --workload-name-prefix ecommerce \
  --query 'WorkloadSummaries[0].WorkloadId' --output text)

aws wellarchitected list-answers \
  --workload-id $WORKLOAD_ID \
  --lens-alias wellarchitected \
  --query 'AnswerSummaries[?Risk==`HIGH`].{Question:QuestionTitle,Pillar:PillarId}' \
  --output table

Generate Well-Architected Report

Retrieves workload summary including risk counts per severity, giving a quick health score of the reviewed architecture.

Example · bash
aws wellarchitected get-workload \
  --workload-id abc123def456 \
  --query 'Workload.{Name:WorkloadName,RiskCounts:RiskCounts,Updated:UpdatedAt}' \
  --output json

Related

aws security best practicesaws vpc

Discussion

  • Be the first to comment on this lesson.