AWS foundations theo capability và failure domain
Chọn service từ workload/operations; “serverless/managed” không xóa quotas, IAM, networking, data design hay cost.
Organization and identity
Organizations/OUs/accounts, SCP guardrails, IAM Identity Center for humans, roles for workloads, CloudTrail/org trails and Config. SCP limits maximum permissions but does not grant. Resource policies and role trust need explicit review.
Network/edge
VPC subnets per AZ, route tables, SG stateful/NACL stateless, IGW/NAT, Route 53, CloudFront, ALB/NLB, PrivateLink/Transit Gateway. NAT gateway cost/HA and DNS are common surprises.
Compute/data
EC2/Auto Scaling, ECS/EKS, Lambda; S3 object semantics/lifecycle/versioning; RDS/Aurora relational HA/replicas/backups; DynamoDB partition/key/capacity/consistency. Choose based execution duration/state/network/startup/team.
Messaging/security/ops
SQS queue, SNS fan-out, EventBridge routing, Kinesis streams. KMS envelope/key policy, Secrets Manager rotation, WAF/Shield. CloudWatch metrics/logs/alarms, X-Ray/OTel, CloudTrail audit. Service quotas and regional scope must be designed.
HA/DR/cost
Multi-AZ before multi-region; backups/PITR/cross-region copies tested. Savings Plans/Reserved vs Spot/on-demand; storage lifecycle, data transfer/NAT/log costs and budgets. Well-Architected review records trade-offs.