Well-Architected Pillars and Decision Making

Well-Architected Pillars and Decision Making

Operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability are connected lenses; evidence and tradeoffs justify a decision. This lesson applies the rule by linking an observation to the right pillar without reducing the framework to memorization.

Measurements show that the current resource type no longer fits the workload pattern, and a newer technology meets the target more efficiently. Which pillar guides reselection and continuing review? Decision: Performance Efficiency. Reason: Performance Efficiency selects resources from evidence and revisits choices as technologies and requirements evolve.

The primary objective is to reduce resource consumption and environmental impact by removing unused capacity and matching resources to demand. Which pillar governs the decision? Decision: Sustainability. Reason: Sustainability addresses environmental impact and efficient resource use.

A monthly release bundles dozens of unrelated changes, making fault isolation and rollback difficult. Which Operational Excellence principle addresses this? Decision: Make frequent, small, reversible changes. Reason: Small reversible changes bound failure scope and make rollback practical.

Health checks detect an unhealthy instance, but the service waits for manual intervention to replace it. Which Reliability principle matches the need? Decision: Automatically recover from failure while retaining tests to verify behavior. Reason: Automatic recovery uses health evidence to trigger restoration or replacement, while testing remains necessary.

Shared accounts, long-lived keys, and broad permissions exist. Which security principle addresses the root? Decision: A strong identity foundation. A strong identity foundation calls for centralized individual identities, least privilege, and temporary credentials.

One large resource meets capacity but remains one failure point. Which reliability principle reduces its loss impact? Decision: Horizontal scaling for reliability. Replacing one large resource with multiple independent resources reduces single-component impact.

After an incident, the team fixed the symptom and closed it without analyzing signals or contributing factors. Which operating principle is missing? Decision: Learn from operational events and failures. Learning from operational events captures factors and feeds verified improvements into systems and procedures.

Finance sees one total bill, but product owners cannot see attributed usage or cost. Which Cost Optimization principle applies? Decision: Analyze and attribute expenditure. Analyze and attribute expenditure connects usage and cost to workload owners for accountable action.

A team wants to improve environmental impact but has no workload unit metric or long-term target. What is the first principle? Decision: Measurable sustainability goals. Set a measurable sustainability goal, such as reducing resources per transaction, to guide priorities and detect regression.

Changes must be tied to an accountable identity, monitored, and alerted on to support investigation and response. Which security principle? Decision: Enable traceability. Enable traceability connects actions to logging, monitoring, alerting, and response.

Operations procedures must be versioned, tested, reviewed, and executed consistently. Which principle? Decision: Perform operations as code.. Operations as code makes procedures versioned, testable, reviewable, and repeatably executable.

Infrastructure changes are manual, hard to attribute, and difficult to reproduce. Which Reliability principle? Decision: Manage change through automation.. Automation makes infrastructure changes and their definitions traceable, reviewable, and consistent.

Procedures are reviewed only after major incidents despite daily operational events and metrics. Which principle? Decision: Refine operations procedures frequently.. Frequent refinement uses operational events, metrics, and feedback to improve procedures before a major incident.

Stored data and network paths require protection while classification and key access remain explicit. Which principle? Decision: Protect data in transit and at rest.. The principle covers both data states while classification and key access remain explicit responsibilities.

After an incident is detected, the team does not know the owner, escalation path, or required evidence. Which preventive principle? Decision: Prepare for security events in advance.. Preparation defines ownership, paths, evidence, and practiced procedures before an event occurs.

A network control exists, but operating systems, applications, and data lack complementary controls. Which security principle closes the gap? Decision: Apply security at all layers.. Defense in depth applies complementary controls across network, compute, application, and data layers.

A service forces customers to upgrade devices and transfer large data volumes although a lighter design is possible. Which sustainability principle? Decision: Reduce downstream impact on workload users.. Reducing downstream impact lowers energy, data transfer, and device upgrades required to use the service.

Newer hardware and software can deliver the same output with lower environmental impact, but the design resists replacement. Which principle? Decision: Anticipate and adopt more efficient offerings.. Replaceable design and periodic evaluation allow more efficient options to be adopted against output and impact.

Network and logging controls are created manually in the console, so accounts drift and changes are hard to prove. What applies the automate-security-best-practices principle? Decision: Define controls in versioned templates and policies and test them in the deployment pipeline. Versioned templates and policies make security controls reviewable, testable, and consistently deployable instead of relying on manual console steps.

Analytics operators download sensitive customer records to their laptops and remove fields manually before processing. Which design applies the keep-people-away-from-data principle? Decision: Automate masking and processing inside a restricted environment with scoped service roles. Automation in a restricted environment performs masking and processing with scoped service roles, removing the need for people to download sensitive data.

Before launching a service that depends on an external provider, the team has neither a list of provider failure modes nor a tested outage response. What applies the anticipate-failure principle? Decision: Enumerate failure modes, define signals and responses, then rehearse a controlled dependency outage before launch. Anticipating failure means identifying failure modes, signals, and responses and rehearsing them before they become a customer-impacting incident.

A small team needs a two-week prototype that summarizes non-sensitive documents. It has no foundation-model training or GPU-platform expertise, and must measure summary quality on an approved set with human review. What applies the democratize-advanced-technologies principle? Decision: Use a managed foundation model through Amazon Bedrock for the prototype, with an evaluation set, a quality threshold, and human review before acceptance. Consuming the foundation model as a managed capability shifts effort from building training infrastructure to evaluating the product outcome, while the team remains responsible for quality and human review.

A fraud team follows multi-hop paths among accounts, devices, and IP addresses; relationships and traversal are the primary query pattern. Which decision applies mechanical sympathy? Decision: Choose Amazon Neptune and model entities and relationships as a graph for traversal. Mechanical sympathy aligns technology with the access pattern; because the decision centers on traversing deep relationships, the purpose-built Amazon Neptune graph engine fits.

Two architectures provide the same function, but their latency, cost, and failure behavior are unknown. What applies the experiment-more-often principle? Decision: Run a bounded test with representative load, a hypothesis, and acceptance metrics, then compare results before commitment. A bounded experiment with a hypothesis, representative load, and acceptance metrics compares alternatives with evidence before architectural commitment.

The team reports total instance count and estimated energy, but transaction growth makes month-to-month comparison misleading. What is the first measure for understanding workload environmental impact? Decision: Relate resources and impact to a useful work unit such as one thousand successful transactions. Relating resources and impact to a useful work unit shows whether workload efficiency improved even as demand changes.

CPU and memory remain within limits, but checkout completion is falling and the team cannot tell whether users achieve the intended outcome. What is the sound observability design? Decision: Collect business indicators such as checkout completion and correlate them with traces, logs, and technical metrics. Operational observability includes business-outcome indicators correlated with traces, logs, and technical metrics—not one infrastructure metric.

One engineer can request, approve, and execute a sensitive production change with the same identity. What strong-identity-foundation practice addresses this risk? Decision: Separate request, approval, and execution roles and require independent authorization for each step. Separation of duties with independent authorization prevents one person from controlling the full sensitive-change request, approval, and execution path.

An analytics job must finish by 06:00, and measurements show enough idle capacity from midnight to 04:00. Which sustainability decision improves utilization of existing capacity? Decision: Schedule the deferrable job in the measured idle-capacity window and prove completion before 06:00. The decision time-shifts flexible work into measured idle capacity; it does not repeat an automatic add/remove capacity choice.

A customer-operated scheduler averages 15% utilization, and a managed service meets the same service objective. What is the sound sustainability evaluation? Decision: Compare service outcome and utilization; choose managed if it improves efficiency, while the customer retains data and configuration duties. The decision turns on measured shared-infrastructure utilization and retained duties, not a generic managed-service benefit.

A team claims that moving a workload to AWS makes AWS solely responsible for its environmental impact. What is the correction? Decision: AWS optimizes sustainability of the cloud, while the customer remains responsible for workload demand, architecture, data, and usage. This tests the sustainability responsibility boundary, not another storage lifecycle policy.

The team has never tested identity-provider failure, although its runbook claims the service recovers. What best applies operational evolution? A controlled identity-provider failure exposes service and recovery behavior that the written runbook has not proved, then turns observed evidence into an actionable update.

Checkout waits on a payment provider without a timeout and immediately retries every failure; during an outage threads pile up and payment requests duplicate. What interaction policy fits? The timeout bounds dependency impact, backoff prevents a retry storm, idempotency prevents duplicate payment, and reconciliation preserves ambiguous cases. More threads or unbounded retries amplify the outage.

At saturation, deferrable historical reports compete with checkout that has a 300 ms objective. Capacity cannot complete both. What should the workload do? Overload needs explicit priority and admission limits; protecting the critical business path prevents deferrable work from consuming all capacity. Unlimited waiting turns saturation into system-wide failure.

Unused test environments run every night and can be recreated from automation each morning. What is the most precise sustainability decision? Removing idle resources reduces consumption while protecting the work unit by measuring recreation time.

A system has front-end paths in two Availability Zones, but both depend on one DNS resolver in a single Zone. Server failure passed; resolver loss was never tested. What is the judgment? Path count does not prevent correlated failure when both share one dependency. A server test does not cover the resolver; evidence must exercise the shared point itself.

Compression reduced storage per million transactions from 1 TB to 0.4 TB, but doubled CPU from 200 to 400 hours and pushed transaction latency beyond target. What is the sustainability judgment? A work-unit measure must include relevant resources and preserve the user outcome. Reducing one resource is not an improvement when another doubles and the latency objective fails.

Payroll records are encrypted in transit and at rest, but staff open plaintext daily to copy it between systems even though the transfer can be automated. Which security principle removes the nearest risk? The keep-people-away-from-data principle retains encryption while reducing exposure and human error by removing routine manual handling, using least-privilege automation, and monitoring exceptional access.

An existing workload is approaching launch. The team wants a structured review across the Well-Architected pillars, documented risks, a prioritized improvement plan, and milestone tracking; it is not asking for compliance certification or automatic remediation. What should it do? A Well-Architected review provides a consistent conversation about the workload against best practices, identifies risks, and creates an improvement plan; the Tool documents decisions and tracks progress. The review is neither a compliance audit nor automatic remediation.

A platform team knows that its workload is sensitive to memory latency and bandwidth, and it measured the access pattern and response limits before choosing technology. Which design principle should govern the evaluation? Mechanical sympathy means understanding how a service is consumed and choosing technology aligned with measured workload goals and characteristics. A bounded experiment, standardization, and horizontal scaling are all professional practices, but each addresses a different constraint; the existing measurements decide technology and consumption-model fit here.

Textract document analysis returns the required form key/value pairs and table cells from supported scanned documents. Translate changes text language; it neither detects the form layout nor returns structured cells. Comprehend analyzes text that already exists and does not perform document-layout extraction from the scan.

Transcribe batch processing converts the existing supported audio object into a same-language transcript. Polly performs the inverse transformation by synthesizing audio from written text. Translate requires textual input and changes language rather than recognizing spoken words.

Translate directly converts the existing text between a supported source and target language. Transcribe recognizes speech in audio; there is no audio input in this case. Comprehend derives entities and sentiment but does not produce the requested target-language version.

Comprehend supplies pretrained named-entity and sentiment analysis for supported text, matching both requested outputs. Textract would recover document structure from an image but would not classify sentiment in existing text. Translate produces another-language text and does not return entity and sentiment labels.

Polly synthesizes spoken audio from approved written text, which is exactly the accessibility output requested. Transcribe starts with speech and returns text, so its data flow is opposite to the requirement. Translate changes the language of written text but does not create narration.

Rekognition image labels identify objects and scenes in supported ordinary images, matching the visual classification task. Textract is specialized for text and document structure such as form fields and tables, not general scene labels. Comprehend analyzes natural-language text and cannot label the visual contents of an ordinary image.

Lex V2 recognizes intents, elicits missing slot values, and maintains the multi-turn task dialogue required by the booking interface. Transcribe can turn speech into text but does not decide intent or manage the subsequent conversational state. Polly speaks response text but does not interpret user goals or request missing booking details.