Public on-demand AWS list prices from the AWS Price List. Excludes free tier, taxes, support plans, Savings Plans/Reserved Instances/Spot and enterprise discounts, and data transfer unless a node sets egressGbPerMonth. Monthly = 730 hours. Not a quote: confirm with the AWS Pricing Calculator.
Usage basis. Illustrative: a mid-size organisation, 400M input and 40M output model tokens/month, 300,000 Comprehend Medical units. HealthScribe, HealthLake, CloudTrail, Verified Permissions and Direct Connect are not priced yet.
| Component | Service | Status | $ / month | Line items |
|---|---|---|---|---|
| Amazon Comprehend Medical | Amazon Comprehend Medical | estimated | $3,000 | 1 line
|
| Amazon Bedrock | Amazon Bedrock | estimated | $1,320 | 2 lines
Model matched in the Price List: Claude Sonnet 5.5 (Amazon Bedrock Edition). Rates are on-demand standard inference in this region. |
| Amazon OpenSearch Service | Amazon OpenSearch Service | estimated | $268 | 2 lines
|
| Bedrock Guardrails | Amazon Bedrock | estimated | $210 | 3 lines
|
| Amazon CloudWatch | Amazon CloudWatch | estimated | $12.30 | 4 lines
|
| AWS WAF | AWS WAF | estimated | $10.60 | 3 lines
Managed rule groups with their own fees (e.g. Bot Control) are not included. |
| Amazon Bedrock AgentCore | Amazon Bedrock AgentCore | estimated | $5.00 | 3 lines
|
| Amazon API Gateway | Amazon API Gateway | estimated | $3.50 | 1 line
|
| Amazon S3 | Amazon Simple Storage Service | estimated | $3.20 | 3 lines
|
| AWS KMS | AWS Key Management Service | estimated | $1.30 | 2 lines
|
usage| Component | Assumption | Value | Source |
|---|---|---|---|
| Amazon API Gateway | type | rest | assumed |
| Amazon API Gateway | requestsPerMonth | 1000000 | assumed |
| AWS WAF | webAcls | 1 | assumed |
| AWS WAF | rules | 5 | assumed |
| AWS WAF | requestsPerMonth | 1000000 | assumed |
| Bedrock Guardrails | textUnitsPerMonth | 600000 | from spec |
| Bedrock Guardrails | policies | ["content","pii","grounding"] | from spec |
| Amazon Bedrock AgentCore | component | gateway | assumed |
| Amazon Bedrock AgentCore | invocationsPerMonth | 1000000 | assumed |
| Amazon Bedrock AgentCore | searchesPerMonth | 0 | assumed |
| Amazon Bedrock AgentCore | tools | 20 | assumed |
| Amazon Bedrock | model | Claude Sonnet 5.5 | from spec |
| Amazon Bedrock | mode | standard | assumed |
| Amazon Bedrock | inputTokensPerMonth | 400000000 | from spec |
| Amazon Bedrock | outputTokensPerMonth | 40000000 | from spec |
| Amazon Bedrock | cacheReadTokensPerMonth | 0 | assumed |
| Amazon Comprehend Medical | feature | DetectEntities | from spec |
| Amazon Comprehend Medical | unitsPerMonth | 300000 | from spec |
| Amazon OpenSearch Service | mode | provisioned | assumed |
| Amazon OpenSearch Service | instanceType | r6g.large.search | assumed |
| Amazon OpenSearch Service | instanceCount | 2 | assumed |
| Amazon OpenSearch Service | storageGbPerNode | 100 | assumed |
| Amazon S3 | storageClass | standard | assumed |
| Amazon S3 | storageGb | 100 | assumed |
| Amazon S3 | putRequestsPerMonth | 100000 | assumed |
| Amazon S3 | getRequestsPerMonth | 1000000 | assumed |
| Amazon CloudWatch | logIngestGbPerMonth | 10 | assumed |
| Amazon CloudWatch | logStorageGb | 10 | assumed |
| Amazon CloudWatch | customMetrics | 20 | assumed |
| Amazon CloudWatch | alarms | 10 | assumed |
| AWS KMS | keys | 1 | assumed |
| AWS KMS | requestsPerMonth | 100000 | assumed |
No what-if options apply to these services.
Retrieved 2026-10-01T18:40:39.861Z from the public AWS Price List bulk API. Per-service publication dates:
AmazonApiGateway 2026-09-21 · awswaf 2026-09-14 · AmazonBedrock 2026-09-30 · AmazonBedrockAgentCore 2026-09-15 · AmazonBedrockFoundationModels 2026-09-30 · comprehendmedical 2026-09-11 · AmazonES 2026-09-27 · AmazonS3 2026-09-28 · AmazonCloudWatch 2026-09-22 · awskms 2026-09-11
Only public on-demand rates are used. This is not a quote — confirm in the AWS Pricing Calculator.
This Well-Architected Framework and Generative AI Lens review of Healthcare enterprise agentic AI platform on AWS (standard criticality) assessed the architecture diagram only. 20 of 307 framework best practices and 8 of 51 lens best practices have diagram evidence; the rest are Cannot Determine because process, configuration and runtime evidence is not in the diagram. It found 0 critical, 1 high, 0 medium and 0 low risk. Estimated run cost is $4,834/month (indicative).
20 of 307 framework best practices have diagram evidence (7%); among those, 17 implemented, 3 partial, 0 not implemented. Provisional: scores cover evidenced practices only.
Strengths. Edge protection present; Data stores are not placed in public subnets; Key management shown; Identity service shown; Detection / audit services shown; Observability shown; Managed / serverless services dominate; Guardrails shown.
The reviewed architecture is the Diagram tab (18 components, architecture diagram). Hover a finding to highlight the components involved.
| Pillar | Score (1–5) | Evidenced BPs | I · P · N · NA · CD | Strongest area | Main gap |
|---|---|---|---|---|---|
| Operational excellence | 5.0 provisional | 4/68 (5.9%) | 4 0 0 0 64 | Observability shown | No gaps evidenced in the diagram |
| Security | 5.0 provisional | 7/63 (11.1%) | 7 0 0 0 56 | Edge protection present | No gaps evidenced in the diagram |
| Reliability | 4.5 provisional | 4/65 (6.2%) | 3 1 0 0 61 | Hybrid connectivity redundancy | Hybrid connectivity redundancy |
| Performance efficiency | — | 2/32 (6.3%) | 2 0 0 0 30 | — | No gaps evidenced in the diagram |
| Cost optimization | — | 2/50 (4%) | 0 2 0 0 48 | Model inference dominates cost | No gaps evidenced in the diagram |
| Sustainability | — | 1/29 (3.4%) | 1 0 0 0 28 | Managed / serverless services dominate | No gaps evidenced in the diagram |
| Pillar | Score (1–5) | Evidenced BPs | I · P · N · NA · CD | Strongest area | Main gap |
|---|---|---|---|---|---|
| Operational excellence | 5.0 | 3/10 (30%) | 3 0 0 0 7 | Observability shown | No gaps evidenced in the diagram |
| Security | 4.5 | 4/10 (40%) | 3 1 0 0 6 | Edge protection present | No gaps evidenced in the diagram |
| Reliability | — | 0/10 (0%) | 0 0 0 0 10 | Hybrid connectivity redundancy | No gaps evidenced in the diagram |
| Performance efficiency | — | 0/8 (0%) | 0 0 0 0 8 | — | No gaps evidenced in the diagram |
| Cost optimization | — | 1/9 (11.1%) | 0 1 0 0 8 | Model inference dominates cost | No gaps evidenced in the diagram |
| Sustainability | — | 0/4 (0%) | 0 0 0 0 4 | Managed / serverless services dominate | No gaps evidenced in the diagram |
Score = 1 + 4 × (implemented + ½ partial) ÷ evidenced BPs; shown only when ≥ 3 BPs are evidenced. It reflects evidenced practices, not the whole pillar.
| ID | Question | Pillar | Status | Risk | BPs (evidenced) | Key evidence |
|---|---|---|---|---|---|---|
| OPS01 | OPS 1. How do you determine what your priorities are? | Operational excellence | Cannot Determine | Not Applicable | 6 (0) | — |
| OPS02 | OPS 2. How do you structure your organization to support your business outcomes? | Operational excellence | Cannot Determine | Not Applicable | 6 (0) | — |
| OPS03 | OPS 3. How does your organizational culture support your business outcomes? | Operational excellence | Cannot Determine | Not Applicable | 7 (0) | — |
| OPS04 | OPS 4. How do you implement observability in your workload? | Operational excellence | Implemented | None | 5 (2) | Diagram: Observability shown. Nodes: cw. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to b |
| OPS05 | OPS 5. How do you reduce defects, ease remediation, and improve flow into production? | Operational excellence | Cannot Determine | Not Applicable | 10 (2) | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code and deploy through a pipeline with small, reversible changes (CloudFormation/CD |
| OPS06 | OPS 6. How do you mitigate deployment risks? | Operational excellence | Cannot Determine | Not Applicable | 4 (0) | — |
| OPS07 | OPS 7. How do you know that you are ready to support a workload? | Operational excellence | Cannot Determine | Not Applicable | 6 (0) | — |
| OPS08 | OPS 8. How do you utilize workload observability in your organization? | Operational excellence | Implemented | None | 5 (2) | Diagram: Observability shown. Nodes: cw. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to b |
| OPS09 | OPS 9. How do you understand the health of your operations? | Operational excellence | Cannot Determine | Not Applicable | 3 (0) | — |
| OPS10 | OPS 10. How do you manage workload and operations events? | Operational excellence | Cannot Determine | Not Applicable | 7 (0) | — |
| OPS11 | OPS 11. How do you evolve operations? | Operational excellence | Cannot Determine | Not Applicable | 9 (0) | — |
| SEC01 | SEC 1. How do you securely operate your workload? | Security | Cannot Determine | Not Applicable | 8 (0) | — |
| SEC02 | SEC 2. How do you manage authentication for people and machines? | Security | Implemented | None | 6 (1) | Diagram: Identity service shown. Nodes: idc. Authenticate and authorize every request (Amazon Cognito, IAM Identity Center, IAM roles, Verified Permissions) and |
| SEC03 | SEC 3. How do you manage permissions for people and machines? | Security | Cannot Determine | Not Applicable | 9 (0) | — |
| SEC04 | SEC 4. How do you detect and investigate security events? | Security | Implemented | None | 4 (2) | Diagram: Detection / audit services shown. Nodes: ct. Enable AWS CloudTrail, GuardDuty and Security Hub (and Config/Inspector/Macie as relevant) for logging, th |
| SEC05 | SEC 5. How do you protect your network resources? | Security | Implemented | None | 4 (2) | Diagram: Data stores are not placed in public subnets. Least-privilege network placement for stateful services. |
| SEC06 | SEC 6. How do you protect your compute resources? | Security | Cannot Determine | Not Applicable | 5 (0) | — |
| SEC07 | SEC 7. How do you classify your data? | Security | Implemented | None | 4 (1) | Amazon Comprehend Medical drawn for automated identification of sensitive data. |
| SEC08 | SEC 8. How do you protect your data at rest? | Security | Implemented | None | 4 (1) | Diagram: Key management shown. Nodes: kms. Encrypt data at rest and in transit; use AWS KMS customer managed keys where you need key policy, rotation or audit c |
| SEC09 | SEC 9. How do you protect your data in transit? | Security | Cannot Determine | Not Applicable | 3 (0) | — |
| SEC10 | SEC 10. How do you anticipate, respond to, and recover from incidents? | Security | Cannot Determine | Not Applicable | 8 (0) | — |
| SEC11 | SEC 11. How do you incorporate and validate the security properties of applications throughout the design, development, and deployment lifecycle? | Security | Cannot Determine | Not Applicable | 8 (1) | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code and deploy through a pipeline with small, reversible changes (CloudFormation/CD |
| REL01 | REL 1. How do you manage Service Quotas and constraints? | Reliability | Cannot Determine | Not Applicable | 6 (0) | — |
| REL02 | REL 2. How do you plan your network topology? | Reliability | Partially Implemented | High | 5 (1) | A single private connection is drawn; redundant connectivity (second Direct Connect location or VPN backup) is not shown. |
| REL03 | REL 3. How do you design your workload service architecture? | Reliability | Cannot Determine | Not Applicable | 3 (0) | — |
| REL04 | REL 4. How do you design interactions in a distributed system to prevent failures? | Reliability | Cannot Determine | Not Applicable | 4 (0) | — |
| REL05 | REL 5. How do you design interactions in a distributed system to mitigate or withstand failures? | Reliability | Cannot Determine | Not Applicable | 7 (0) | — |
| REL06 | REL 6. How do you monitor workload resources? | Reliability | Implemented | None | 7 (2) | Diagram: Observability shown. Nodes: cw. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to b |
| REL07 | REL 7. How do you design your workload to adapt to changes in demand? | Reliability | Cannot Determine | Not Applicable | 4 (0) | — |
| REL08 | REL 8. How do you implement change? | Reliability | Cannot Determine | Not Applicable | 5 (1) | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code and deploy through a pipeline with small, reversible changes (CloudFormation/CD |
| REL09 | REL 9. How do you back up data? | Reliability | Cannot Determine | Not Applicable | 4 (2) | Diagram: No backup or recovery capability shown. Define RPO/RTO and back up data with AWS Backup, snapshots, point-in-time recovery or cross-Region replication. |
| REL10 | REL 10. How do you use fault isolation to protect your workload? | Reliability | Cannot Determine | Not Applicable | 3 (0) | — |
| REL11 | REL 11. How do you design your workload to withstand component failures? | Reliability | Implemented | None | 7 (1) | Diagram: Observability shown. Nodes: cw. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to b |
| REL12 | REL 12. How do you test reliability? | Reliability | Cannot Determine | Not Applicable | 5 (0) | — |
| REL13 | REL 13. How do you plan for disaster recovery (DR)? | Reliability | Cannot Determine | Not Applicable | 5 (0) | — |
| PERF01 | PERF 1. How do you select appropriate cloud resources and architecture for your workload? | Performance efficiency | Cannot Determine | Not Applicable | 7 (0) | — |
| PERF02 | PERF 2. How do you select and use compute resources in your workload? | Performance efficiency | Cannot Determine | Not Applicable | 6 (0) | — |
| PERF03 | PERF 3. How do you store, manage, and access data in your workload? | Performance efficiency | Cannot Determine | Not Applicable | 5 (0) | — |
| PERF04 | PERF 4. How do you select and configure networking resources in your workload? | Performance efficiency | Implemented | None | 7 (3) | Diagram: No CDN / edge acceleration shown for end users. Serve content close to users with Amazon CloudFront or AWS Global Accelerator to cut latency. |
| PERF05 | PERF 5. How do your organizational practices and culture contribute to performance efficiency in your workload? | Performance efficiency | Implemented | None | 7 (1) | Diagram: Observability shown. Nodes: cw. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to b |
| COST01 | COST 1. How do you implement cloud financial management? | Cost optimization | Cannot Determine | Not Applicable | 9 (2) | Diagram: No cost visibility shown. Tag resources, set AWS Budgets and use Cost Explorer so spend maps to workloads and owners. |
| COST02 | COST 2. How do you govern usage? | Cost optimization | Cannot Determine | Not Applicable | 6 (0) | — |
| COST03 | COST 3. How do you monitor your cost and usage? | Cost optimization | Cannot Determine | Not Applicable | 6 (1) | Diagram: No cost visibility shown. Tag resources, set AWS Budgets and use Cost Explorer so spend maps to workloads and owners. |
| COST04 | COST 4. How do you decommission resources? | Cost optimization | Cannot Determine | Not Applicable | 5 (0) | — |
| COST05 | COST 5. How do you evaluate cost when you select services? | Cost optimization | Partially Implemented | None | 6 (1) | A design-time cost model was generated from the AWS Price List: 10 of 15 billable components priced, $4,834.12/month on-demand (indicative; volumes partly assum |
| COST06 | COST 6. How do you meet cost targets when you select resource type, size and number? | Cost optimization | Partially Implemented | None | 4 (1) | A design-time cost model was generated from the AWS Price List: 10 of 15 billable components priced, $4,834.12/month on-demand (indicative; volumes partly assum |
| COST07 | COST 7. How do you use pricing models to reduce cost? | Cost optimization | Cannot Determine | Not Applicable | 5 (0) | — |
| COST08 | COST 8. How do you plan for data transfer charges? | Cost optimization | Cannot Determine | Not Applicable | 3 (1) | Data transfer is excluded from the estimate (no node sets egressGbPerMonth); model it before launch. |
| COST09 | COST 9. How do you manage demand, and supply resources? | Cost optimization | Cannot Determine | Not Applicable | 3 (0) | — |
| COST10 | COST 10. How do you evaluate new services? | Cost optimization | Cannot Determine | Not Applicable | 2 (0) | — |
| COST11 | COST 11. How do you evaluate the cost of effort? | Cost optimization | Cannot Determine | Not Applicable | 1 (0) | — |
| SUS01 | SUS 1 How do you select Regions for your workload? | Sustainability | Cannot Determine | Not Applicable | 1 (0) | — |
| SUS02 | SUS 2 How do you align cloud resources to your demand? | Sustainability | Cannot Determine | Not Applicable | 6 (0) | — |
| SUS03 | SUS 3 How do you take advantage of software and architecture patterns to support your sustainability goals? | Sustainability | Cannot Determine | Not Applicable | 5 (0) | — |
| SUS04 | SUS 4 How do you take advantage of data management policies and patterns to support your sustainability goals? | Sustainability | Cannot Determine | Not Applicable | 8 (0) | — |
| SUS05 | SUS 5 How do you select and use cloud hardware and services in your architecture to support your sustainability goals? | Sustainability | Implemented | None | 4 (1) | Diagram: Managed / serverless services dominate. Prefer managed and serverless services, right-size, use Graviton-based instances, and scale to demand to raise |
| SUS06 | SUS 6 How do your organizational processes support your sustainability goals? | Sustainability | Cannot Determine | Not Applicable | 5 (0) | — |
| ID | Question | Pillar | Status | Risk | BPs (evidenced) | Key evidence |
|---|---|---|---|---|---|---|
| GENOPS01 | Model performance evaluation | Operational excellence | Cannot Determine | Not Applicable | 2 (0) | — |
| GENOPS02 | Monitor and manage operational health | Operational excellence | Implemented | None | 3 (2) | Diagram: Model telemetry destination shown. Nodes: guard, agentcore, fm. Implement comprehensive observability: log model invocations, latency, token usage, gua |
| GENOPS03 | Observability in workloads | Operational excellence | Implemented | None | 2 (1) | Tracing/telemetry is drawn (cw). |
| GENOPS04 | Automate lifecycle management | Operational excellence | Cannot Determine | Not Applicable | 2 (0) | — |
| GENOPS05 | Model customization | Operational excellence | Cannot Determine | Not Applicable | 1 (0) | — |
| GENSEC01 | Endpoint security | Security | Implemented | None | 4 (1) | Diagram: Model telemetry destination shown. Nodes: guard, agentcore, fm. Implement comprehensive observability: log model invocations, latency, token usage, gua |
| GENSEC02 | Response validation | Security | Implemented | None | 1 (1) | Diagram: Guardrails shown. Nodes: guard, agentcore, fm. Design for controlled autonomy: apply Amazon Bedrock Guardrails (or equivalent) to filter harmful conten |
| GENSEC03 | Event monitoring | Security | Implemented | None | 1 (1) | Diagram: Model telemetry destination shown. Nodes: guard, agentcore, fm. Implement comprehensive observability: log model invocations, latency, token usage, gua |
| GENSEC04 | Prompt security | Security | Cannot Determine | Not Applicable | 2 (0) | — |
| GENSEC05 | Excessive agency | Security | Partially Implemented | None | 1 (1) | Diagram: Agents and excessive agency. Nodes: agentcore. Limit tool permissions with least-privilege IAM roles, scope tool inputs/outputs, and add human approval |
| GENSEC06 | Data poisoning | Security | Cannot Determine | Not Applicable | 1 (0) | — |
| GENREL01 | Manage throughput quotas | Reliability | Cannot Determine | Not Applicable | 1 (0) | — |
| GENREL02 | Network reliability | Reliability | Cannot Determine | Not Applicable | 1 (0) | — |
| GENREL03 | Prompt remediation and recovery actions | Reliability | Cannot Determine | Not Applicable | 2 (0) | — |
| GENREL04 | Prompt management | Reliability | Cannot Determine | Not Applicable | 2 (0) | — |
| GENREL05 | Distributed availability | Reliability | Cannot Determine | Not Applicable | 3 (1) | Diagram: Single-Region model inference. Nodes: guard, agentcore, fm. Establish distributed resilience: plan for throttling and quota limits (retries, queues, pr |
| GENREL06 | Distributed compute tasks | Reliability | Cannot Determine | Not Applicable | 1 (0) | — |
| GENPERF01 | Establish performance evaluation processes | Performance efficiency | Cannot Determine | Not Applicable | 2 (0) | — |
| GENPERF02 | Maintaining model performance | Performance efficiency | Cannot Determine | Not Applicable | 3 (0) | — |
| GENPERF03 | Optimize consumption of high-performance compute | Performance efficiency | Cannot Determine | Not Applicable | 1 (0) | — |
| GENPERF04 | Vector store optimization | Performance efficiency | Cannot Determine | Not Applicable | 2 (1) | Diagram: Retrieval / grounding data shown. Nodes: kb. Ground responses in enterprise data (RAG with a vector store or Knowledge Bases) and measure retrieval qua |
| GENCOST01 | Model selection and cost optimization | Cost optimization | Partially Implemented | None | 1 (1) | Diagram: Model cost controls. Nodes: guard, agentcore, fm. Optimize resource efficiency: select the smallest model that meets quality targets, use prompt cachin |
| GENCOST02 | Generative AI pricing model | Cost optimization | Cannot Determine | Not Applicable | 2 (0) | — |
| GENCOST03 | Cost-aware prompting | Cost optimization | Cannot Determine | Not Applicable | 4 (1) | No prompt-cache usage is modelled; repeated instructions/context are a candidate for prompt caching. |
| GENCOST04 | Cost-informed vector stores | Cost optimization | Cannot Determine | Not Applicable | 1 (0) | — |
| GENCOST05 | Cost-informed agents | Cost optimization | Cannot Determine | Not Applicable | 1 (0) | — |
| GENSUS01 | Energy-efficient infrastructure and services | Sustainability | Cannot Determine | Not Applicable | 2 (0) | — |
| GENSUS02 | Consume sustainable data processing and storage services | Sustainability | Cannot Determine | Not Applicable | 1 (0) | — |
| GENSUS03 | Consume energy efficient models | Sustainability | Cannot Determine | Not Applicable | 1 (1) | Diagram: Model and hosting efficiency. Nodes: guard, agentcore, fm. Prefer right-sized or distilled models, serverless inference (Bedrock) and efficient acceler |
| ID | Pillar | Best practice | Status | Evidence |
|---|---|---|---|---|
| OPS01-BP01 | Operational excellence | Evaluate external customer needs | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS01-BP02 | Operational excellence | Evaluate internal customer needs | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS01-BP03 | Operational excellence | Evaluate governance requirements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS01-BP04 | Operational excellence | Evaluate compliance requirements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS01-BP05 | Operational excellence | Evaluate threat landscape | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS01-BP06 | Operational excellence | Evaluate tradeoffs while managing benefits and risks | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS02-BP01 | Operational excellence | Resources have identified owners | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS02-BP02 | Operational excellence | Processes and procedures have identified owners | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS02-BP03 | Operational excellence | Operations activities have identified owners responsible for their performance | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS02-BP04 | Operational excellence | Mechanisms exist to manage responsibilities and ownership | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS02-BP05 | Operational excellence | Mechanisms exist to request additions, changes, and exceptions | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS02-BP06 | Operational excellence | Responsibilities between teams are predefined or negotiated | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS03-BP01 | Operational excellence | Provide executive sponsorship | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS03-BP02 | Operational excellence | Team members are empowered to take action when outcomes are at risk | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS03-BP03 | Operational excellence | Escalation is encouraged | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS03-BP04 | Operational excellence | Communications are timely, clear, and actionable | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS03-BP05 | Operational excellence | Experimentation is encouraged | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS03-BP06 | Operational excellence | Team members are encouraged to maintain and grow their skill sets | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS03-BP07 | Operational excellence | Resource teams appropriately | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS04-BP01 | Operational excellence | Identify key performance indicators | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| OPS04-BP02 | Operational excellence | Implement application telemetry | Implemented | Diagram: Observability shown. Nodes: cw. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to business outcomes. |
| OPS04-BP03 | Operational excellence | Implement user experience telemetry | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS04-BP04 | Operational excellence | Implement dependency telemetry | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS04-BP05 | Operational excellence | Implement distributed tracing | Implemented | Tracing/telemetry is drawn (cw). |
| OPS05-BP01 | Operational excellence | Use version control | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS05-BP02 | Operational excellence | Test and validate changes | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS05-BP03 | Operational excellence | Use configuration management systems | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| OPS05-BP04 | Operational excellence | Use build and deployment management systems | Cannot Determine | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code and deploy through a pipeline with small, reversible changes (CloudFormation/CDK, CodePipeline). |
| OPS05-BP05 | Operational excellence | Perform patch management | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| OPS05-BP06 | Operational excellence | Share design standards | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS05-BP07 | Operational excellence | Implement practices to improve code quality | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS05-BP08 | Operational excellence | Use multiple environments | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS05-BP09 | Operational excellence | Make frequent, small, reversible changes | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS05-BP10 | Operational excellence | Fully automate integration and deployment | Cannot Determine | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code and deploy through a pipeline with small, reversible changes (CloudFormation/CDK, CodePipeline). |
| OPS06-BP01 | Operational excellence | Plan for unsuccessful changes | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS06-BP02 | Operational excellence | Test deployments | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS06-BP03 | Operational excellence | Employ safe deployment strategies | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS06-BP04 | Operational excellence | Automate testing and rollback | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS07-BP01 | Operational excellence | Ensure personnel capability | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS07-BP02 | Operational excellence | : Ensure a consistent review of operational readiness | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS07-BP03 | Operational excellence | Use runbooks to perform procedures | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS07-BP04 | Operational excellence | Use playbooks to investigate issues | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS07-BP05 | Operational excellence | Make informed decisions to deploy systems and changes | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS07-BP06 | Operational excellence | Create support plans for production workloads | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS08-BP01 | Operational excellence | Analyze workload metrics | Implemented | Diagram: Observability shown. Nodes: cw. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to business outcomes. |
| OPS08-BP02 | Operational excellence | Analyze workload logs | Implemented | Diagram: Observability shown. Nodes: cw. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to business outcomes. |
| OPS08-BP03 | Operational excellence | Analyze workload traces | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS08-BP04 | Operational excellence | Create actionable alerts | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS08-BP05 | Operational excellence | Create dashboards | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS09-BP01 | Operational excellence | Measure operations goals and KPIs with metrics | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS09-BP02 | Operational excellence | Communicate status and trends to ensure visibility into operation | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS09-BP03 | Operational excellence | Review operations metrics and prioritize improvement | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS10-BP01 | Operational excellence | Use a process for event, incident, and problem management | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS10-BP02 | Operational excellence | Have a process per alert | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS10-BP03 | Operational excellence | Prioritize operational events based on business impact | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS10-BP04 | Operational excellence | Define escalation paths | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS10-BP05 | Operational excellence | Define a customer communication plan for service-impacting events | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS10-BP06 | Operational excellence | Communicate status through dashboards | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS10-BP07 | Operational excellence | Automate responses to events | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS11-BP01 | Operational excellence | Have a process for continuous improvement | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS11-BP02 | Operational excellence | Perform post-incident analysis | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS11-BP03 | Operational excellence | Implement feedback loops | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS11-BP04 | Operational excellence | Perform knowledge management | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS11-BP05 | Operational excellence | Define drivers for improvement | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS11-BP06 | Operational excellence | Validate insights | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS11-BP07 | Operational excellence | Perform operations metrics reviews | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS11-BP08 | Operational excellence | Document and share lessons learned | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS11-BP09 | Operational excellence | Allocate time to make improvements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC01-BP01 | Security | Separate workloads using accounts | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC01-BP02 | Security | Secure account root user and properties | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC01-BP03 | Security | Identify and validate control objectives | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC01-BP04 | Security | Stay up to date with security threats and recommendations | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC01-BP05 | Security | Reduce security management scope | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC01-BP06 | Security | Automate deployment of standard security controls | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC01-BP07 | Security | Identify threats and prioritize mitigations using a threat model | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC01-BP08 | Security | Evaluate and implement new security services and features regularly | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC02-BP01 | Security | Use strong sign-in mechanisms | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC02-BP02 | Security | Use temporary credentials | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC02-BP03 | Security | Store and use secrets securely | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC02-BP04 | Security | Rely on a centralized identity provider | Implemented | Diagram: Identity service shown. Nodes: idc. Authenticate and authorize every request (Amazon Cognito, IAM Identity Center, IAM roles, Verified Permissions) and use temporary credentials. |
| SEC02-BP05 | Security | Audit and rotate credentials periodically | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC02-BP06 | Security | Employ user groups and attributes | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC03-BP01 | Security | Define access requirements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC03-BP02 | Security | Grant least privilege access | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC03-BP03 | Security | Establish emergency access process | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC03-BP04 | Security | Reduce permissions continuously | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC03-BP05 | Security | Define permission guardrails for your organization | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC03-BP06 | Security | Manage access based on lifecycle | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC03-BP07 | Security | Analyze public and cross-account access | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC03-BP08 | Security | Share resources securely within your organization | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC03-BP09 | Security | Share resources securely with a third party | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC04-BP01 | Security | Configure service and application logging | Implemented | Diagram: Detection / audit services shown. Nodes: ct. Enable AWS CloudTrail, GuardDuty and Security Hub (and Config/Inspector/Macie as relevant) for logging, threat detection and response. |
| SEC04-BP02 | Security | Capture logs, findings, and metrics in standardized locations | Implemented | Diagram: Detection / audit services shown. Nodes: ct. Enable AWS CloudTrail, GuardDuty and Security Hub (and Config/Inspector/Macie as relevant) for logging, threat detection and response. |
| SEC04-BP03 | Security | Correlate and enrich security alerts | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC04-BP04 | Security | Initiate remediation for non-compliant resources | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC05-BP01 | Security | Create network layers | Implemented | Diagram: Data stores are not placed in public subnets. Least-privilege network placement for stateful services. |
| SEC05-BP02 | Security | Control traffic flow within your network layers | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC05-BP03 | Security | Implement inspection-based protection | Implemented | Diagram: Edge protection present. Nodes: waf. Protect public entry points (CloudFront, API Gateway, load balancers) with AWS WAF and AWS Shield, and restrict origins. |
| SEC05-BP04 | Security | Automate network protection | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC06-BP01 | Security | Perform vulnerability management | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC06-BP02 | Security | Provision compute from hardened images | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC06-BP03 | Security | Reduce manual management and interactive access | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC06-BP04 | Security | Validate software integrity | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC06-BP05 | Security | Automate compute protection | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC07-BP01 | Security | Understand your data classification scheme | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC07-BP02 | Security | Apply data protection controls based on data sensitivity | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC07-BP03 | Security | Automate identification and classification | Implemented | Amazon Comprehend Medical drawn for automated identification of sensitive data. |
| SEC07-BP04 | Security | Define scalable data lifecycle management | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC08-BP01 | Security | Implement secure key management | Implemented | Diagram: Key management shown. Nodes: kms. Encrypt data at rest and in transit; use AWS KMS customer managed keys where you need key policy, rotation or audit control. |
| SEC08-BP02 | Security | Enforce encryption at rest | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC08-BP03 | Security | Automate data at rest protection | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC08-BP04 | Security | Enforce access control | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC09-BP01 | Security | Implement secure key and certificate management | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC09-BP02 | Security | Enforce encryption in transit | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC09-BP03 | Security | Authenticate network communications | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC10-BP01 | Security | Identify key personnel and external resources | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC10-BP02 | Security | Develop incident management plans | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC10-BP03 | Security | Prepare forensic capabilities | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC10-BP04 | Security | Develop and test security incident response playbooks | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC10-BP05 | Security | Pre-provision access | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC10-BP06 | Security | Pre-deploy tools | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC10-BP07 | Security | Run simulations | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC10-BP08 | Security | Establish a framework for learning from incidents | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC11-BP01 | Security | Train for application security | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC11-BP02 | Security | Automate testing throughout the development and release lifecycle | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC11-BP03 | Security | Perform regular penetration testing | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC11-BP04 | Security | Conduct code reviews | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC11-BP05 | Security | Centralize services for packages and dependencies | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC11-BP06 | Security | Deploy software programmatically | Cannot Determine | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code and deploy through a pipeline with small, reversible changes (CloudFormation/CDK, CodePipeline). |
| SEC11-BP07 | Security | Regularly assess security properties of the pipelines | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC11-BP08 | Security | Build a program that embeds security ownership in workload teams | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL01-BP01 | Reliability | Aware of service quotas and constraints | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL01-BP02 | Reliability | Manage service quotas across accounts and regions | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL01-BP03 | Reliability | Accommodate fixed service quotas and constraints through architecture | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL01-BP04 | Reliability | Monitor and manage quotas | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL01-BP05 | Reliability | Automate quota management | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL01-BP06 | Reliability | Ensure that a sufficient gap exists between the current quotas and the maximum usage to accommodate failover | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL02-BP01 | Reliability | Use highly available network connectivity for your workload public endpoints | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL02-BP02 | Reliability | Provision redundant connectivity between private networks in the cloud and on-premises environments | Partially Implemented | A single private connection is drawn; redundant connectivity (second Direct Connect location or VPN backup) is not shown. |
| REL02-BP03 | Reliability | Ensure IP subnet allocation accounts for expansion and availability | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL02-BP04 | Reliability | Prefer hub-and-spoke topologies over many-to-many mesh | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL02-BP05 | Reliability | Enforce non-overlapping private IP address ranges in all private address spaces where they are connected | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL03-BP01 | Reliability | Choose how to segment your workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL03-BP02 | Reliability | Build services focused on specific business domains and functionality | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL03-BP03 | Reliability | Provide service contracts per API | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL04-BP01 | Reliability | Identify the kind of distributed systems you depend on | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL04-BP02 | Reliability | Implement loosely coupled dependencies | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL04-BP03 | Reliability | Do constant work | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL04-BP04 | Reliability | Make mutating operations idempotent | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL05-BP01 | Reliability | Implement graceful degradation to transform applicable hard dependencies into soft dependencies | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL05-BP02 | Reliability | Throttle requests | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL05-BP03 | Reliability | Control and limit retry calls | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL05-BP04 | Reliability | Fail fast and limit queues | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL05-BP05 | Reliability | Set client timeouts | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL05-BP06 | Reliability | Make systems stateless where possible | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL05-BP07 | Reliability | Implement emergency levers | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL06-BP01 | Reliability | Monitor all components for the workload (Generation) | Implemented | Diagram: Observability shown. Nodes: cw. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to business outcomes. |
| REL06-BP02 | Reliability | Define and calculate metrics (Aggregation) | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL06-BP03 | Reliability | Send notifications (Real-time processing and alarming) | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL06-BP04 | Reliability | Automate responses (Real-time processing and alarming) | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL06-BP05 | Reliability | Analyze logs | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL06-BP06 | Reliability | Regularly review monitoring scope and metrics | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL06-BP07 | Reliability | Monitor end-to-end tracing of requests through your system | Implemented | Tracing/telemetry is drawn (cw). |
| REL07-BP01 | Reliability | Use automation when obtaining or scaling resources | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL07-BP02 | Reliability | Obtain resources upon detection of impairment to a workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL07-BP03 | Reliability | Obtain resources upon detection that more resources are needed for a workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL07-BP04 | Reliability | Load test your workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL08-BP01 | Reliability | Use runbooks for standard activities such as deployment | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL08-BP02 | Reliability | Integrate functional testing as part of your deployment | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL08-BP03 | Reliability | Integrate resiliency testing as part of your deployment | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL08-BP04 | Reliability | Deploy using immutable infrastructure | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL08-BP05 | Reliability | Deploy changes with automation | Cannot Determine | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code and deploy through a pipeline with small, reversible changes (CloudFormation/CDK, CodePipeline). |
| REL09-BP01 | Reliability | Identify and back up all data that needs to be backed up, or reproduce the data from sources | Cannot Determine | Diagram: No backup or recovery capability shown. Define RPO/RTO and back up data with AWS Backup, snapshots, point-in-time recovery or cross-Region replication. |
| REL09-BP02 | Reliability | Secure and encrypt backups | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL09-BP03 | Reliability | Perform data backup automatically | Cannot Determine | Diagram: No backup or recovery capability shown. Define RPO/RTO and back up data with AWS Backup, snapshots, point-in-time recovery or cross-Region replication. |
| REL09-BP04 | Reliability | Perform periodic recovery of the data to verify backup integrity and processes | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL10-BP01 | Reliability | Deploy the workload to multiple locations | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL10-BP02 | Reliability | Automate recovery for components constrained to a single location | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL10-BP03 | Reliability | Use bulkhead architectures to limit scope of impact | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL11-BP01 | Reliability | Monitor all components of the workload to detect failures | Implemented | Diagram: Observability shown. Nodes: cw. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to business outcomes. |
| REL11-BP02 | Reliability | Fail over to healthy resources | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL11-BP03 | Reliability | Automate healing on all layers | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL11-BP04 | Reliability | Rely on the data plane and not the control plane during recovery | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL11-BP05 | Reliability | Use static stability to prevent bimodal behavior | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL11-BP06 | Reliability | Send notifications when events impact availability | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL11-BP07 | Reliability | Architect your product to meet availability targets and uptime service level agreements (SLAs) | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL12-BP01 | Reliability | Use playbooks to investigate failures | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL12-BP02 | Reliability | Perform post-incident analysis | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL12-BP03 | Reliability | Test scalability and performance requirements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL12-BP04 | Reliability | Test resiliency using chaos engineering | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL12-BP05 | Reliability | Conduct game days regularly | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL13-BP01 | Reliability | Define recovery objectives for downtime and data loss | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL13-BP02 | Reliability | Use defined recovery strategies to meet the recovery objectives | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL13-BP03 | Reliability | Test disaster recovery implementation to validate the implementation | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL13-BP04 | Reliability | Manage configuration drift at the DR site or Region | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL13-BP05 | Reliability | Automate recovery | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF01-BP01 | Performance efficiency | Learn about and understand available cloud services and features | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF01-BP02 | Performance efficiency | Use guidance from your cloud provider or an appropriate partner to learn about architecture patterns and best practices | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF01-BP03 | Performance efficiency | Factor cost into architectural decisions | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF01-BP04 | Performance efficiency | Evaluate how trade-offs impact customers and architecture efficiency | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF01-BP05 | Performance efficiency | Use policies and reference architectures | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF01-BP06 | Performance efficiency | Use benchmarking to drive architectural decisions | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF01-BP07 | Performance efficiency | Use a data-driven approach for architectural choices | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF02-BP01 | Performance efficiency | Select the best compute options for your workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF02-BP02 | Performance efficiency | Understand the available compute configuration and features | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF02-BP03 | Performance efficiency | Collect compute-related metrics | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF02-BP04 | Performance efficiency | Configure and right-size compute resources | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF02-BP05 | Performance efficiency | Scale your compute resources dynamically | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF02-BP06 | Performance efficiency | Use optimized hardware-based compute accelerators | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF03-BP01 | Performance efficiency | Use a purpose-built data store that best supports your data access and storage requirements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| PERF03-BP02 | Performance efficiency | Evaluate available configuration options for data store | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF03-BP03 | Performance efficiency | Collect and record data store performance metrics | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF03-BP04 | Performance efficiency | Implement strategies to improve query performance in data store | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| PERF03-BP05 | Performance efficiency | Implement data access patterns that utilize caching | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF04-BP01 | Performance efficiency | Understand how networking impacts performance | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF04-BP02 | Performance efficiency | Evaluate available networking features | Cannot Determine | Diagram: No CDN / edge acceleration shown for end users. Serve content close to users with Amazon CloudFront or AWS Global Accelerator to cut latency. |
| PERF04-BP03 | Performance efficiency | Choose appropriate dedicated connectivity or VPN for your workload | Implemented | AWS Direct Connect provides dedicated connectivity. |
| PERF04-BP04 | Performance efficiency | Use load balancing to distribute traffic across multiple resources | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF04-BP05 | Performance efficiency | Choose network protocols to improve performance | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| PERF04-BP06 | Performance efficiency | Choose your workload's location based on network requirements | Cannot Determine | Diagram: No CDN / edge acceleration shown for end users. Serve content close to users with Amazon CloudFront or AWS Global Accelerator to cut latency. |
| PERF04-BP07 | Performance efficiency | Optimize network configuration based on metrics | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF05-BP01 | Performance efficiency | Establish key performance indicators (KPIs) to measure workload health and performance | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF05-BP02 | Performance efficiency | Use monitoring solutions to understand the areas where performance is most critical | Implemented | Diagram: Observability shown. Nodes: cw. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to business outcomes. |
| PERF05-BP03 | Performance efficiency | Define a process to improve workload performance | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| PERF05-BP04 | Performance efficiency | Load test your workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF05-BP05 | Performance efficiency | Use automation to proactively remediate performance-related issues | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF05-BP06 | Performance efficiency | Keep your workload and services up-to-date | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF05-BP07 | Performance efficiency | Review metrics at regular intervals | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST01-BP01 | Cost optimization | Establish ownership of cost optimization | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST01-BP02 | Cost optimization | Establish a partnership between finance and technology | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST01-BP03 | Cost optimization | Establish cloud budgets and forecasts | Cannot Determine | Diagram: No cost visibility shown. Tag resources, set AWS Budgets and use Cost Explorer so spend maps to workloads and owners. |
| COST01-BP04 | Cost optimization | Implement cost awareness in your organizational processes | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST01-BP05 | Cost optimization | Report and notify on cost optimization | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST01-BP06 | Cost optimization | Monitor cost proactively | Cannot Determine | Diagram: No cost visibility shown. Tag resources, set AWS Budgets and use Cost Explorer so spend maps to workloads and owners. |
| COST01-BP07 | Cost optimization | Keep up-to-date with new service releases | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST01-BP08 | Cost optimization | Create a cost-aware culture | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST01-BP09 | Cost optimization | Quantify business value from cost optimization | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST02-BP01 | Cost optimization | Develop policies based on your organization requirements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST02-BP02 | Cost optimization | Implement goals and targets | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST02-BP03 | Cost optimization | Implement an account structure | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST02-BP04 | Cost optimization | Implement groups and roles | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST02-BP05 | Cost optimization | Implement cost controls | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST02-BP06 | Cost optimization | Track project lifecycle | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST03-BP01 | Cost optimization | Configure detailed information sources | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| COST03-BP02 | Cost optimization | Add organization information to cost and usage | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST03-BP03 | Cost optimization | Identify cost attribution categories | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST03-BP04 | Cost optimization | Establish organization metrics | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST03-BP05 | Cost optimization | Configure billing and cost management tools | Cannot Determine | Diagram: No cost visibility shown. Tag resources, set AWS Budgets and use Cost Explorer so spend maps to workloads and owners. |
| COST03-BP06 | Cost optimization | Allocate costs based on workload metrics | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST04-BP01 | Cost optimization | Track resources over their lifetime | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST04-BP02 | Cost optimization | Implement a decommissioning process | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST04-BP03 | Cost optimization | Decommission resources | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST04-BP04 | Cost optimization | Decommission resources automatically | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST04-BP05 | Cost optimization | Enforce data retention policies | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST05-BP01 | Cost optimization | Identify organization requirements for cost | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST05-BP02 | Cost optimization | Analyze all components of the workload | Partially Implemented | A design-time cost model was generated from the AWS Price List: 10 of 15 billable components priced, $4,834.12/month on-demand (indicative; volumes partly assumed). |
| COST05-BP03 | Cost optimization | Perform a thorough analysis of each component | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST05-BP04 | Cost optimization | Select software with cost-effective licensing | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST05-BP05 | Cost optimization | Select components of this workload to optimize cost in line with organization priorities | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST05-BP06 | Cost optimization | Perform cost analysis for different usage over time | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST06-BP01 | Cost optimization | Perform cost modeling | Partially Implemented | A design-time cost model was generated from the AWS Price List: 10 of 15 billable components priced, $4,834.12/month on-demand (indicative; volumes partly assumed). |
| COST06-BP02 | Cost optimization | Select resource type, size, and number based on data | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST06-BP03 | Cost optimization | Select resource type, size, and number automatically based on metrics | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST06-BP04 | Cost optimization | Consider using shared resources | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST07-BP01 | Cost optimization | Perform pricing model analysis | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST07-BP02 | Cost optimization | Choose Regions based on cost | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST07-BP03 | Cost optimization | Select third-party agreements with cost-efficient terms | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST07-BP04 | Cost optimization | Implement pricing models for all components of this workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST07-BP05 | Cost optimization | Perform pricing model analysis at the management account level | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST08-BP01 | Cost optimization | Perform data transfer modeling | Cannot Determine | Data transfer is excluded from the estimate (no node sets egressGbPerMonth); model it before launch. |
| COST08-BP02 | Cost optimization | Select components to optimize data transfer cost | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST08-BP03 | Cost optimization | Implement services to reduce data transfer costs | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST09-BP01 | Cost optimization | Perform an analysis on the workload demand | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST09-BP02 | Cost optimization | Implement a buffer or throttle to manage demand | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST09-BP03 | Cost optimization | Supply resources dynamically | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST10-BP01 | Cost optimization | Develop a workload review process | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST10-BP02 | Cost optimization | Review and analyze this workload regularly | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST11-BP01 | Cost optimization | Perform automation for operations | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS01-BP01 | Sustainability | Choose Region based on both business requirements and sustainability goals | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SUS02-BP01 | Sustainability | Scale workload infrastructure dynamically | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS02-BP02 | Sustainability | Align SLAs with sustainability goals | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SUS02-BP03 | Sustainability | Stop the creation and maintenance of unused assets | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS02-BP04 | Sustainability | Optimize geographic placement of workloads based on their networking requirements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SUS02-BP05 | Sustainability | Optimize team member resources for activities performed | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SUS02-BP06 | Sustainability | Implement buffering or throttling to flatten the demand curve | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS03-BP01 | Sustainability | Optimize software and architecture for asynchronous and scheduled jobs | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS03-BP02 | Sustainability | Remove or refactor workload components with low or no use | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS03-BP03 | Sustainability | Optimize areas of code that consume the most time or resources | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS03-BP04 | Sustainability | Optimize impact on devices and equipment | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS03-BP05 | Sustainability | Use software patterns and architectures that best support data access and storage patterns | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SUS04-BP01 | Sustainability | Implement a data classification policy | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SUS04-BP02 | Sustainability | Use technologies that support data access and storage patterns | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SUS04-BP03 | Sustainability | Use policies to manage the lifecycle of your datasets | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS04-BP04 | Sustainability | Use elasticity and automation to expand block storage or file system | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS04-BP05 | Sustainability | Remove unneeded or redundant data | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS04-BP06 | Sustainability | Use shared file systems or storage to access common data | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SUS04-BP07 | Sustainability | Minimize data movement across networks | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SUS04-BP08 | Sustainability | Back up data only when difficult to recreate | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS05-BP01 | Sustainability | Use the minimum amount of hardware to meet your needs | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS05-BP02 | Sustainability | Use instance types with the least impact | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS05-BP03 | Sustainability | Use managed services | Implemented | Diagram: Managed / serverless services dominate. Prefer managed and serverless services, right-size, use Graviton-based instances, and scale to demand to raise utilization and cut idle capacity. |
| SUS05-BP04 | Sustainability | Optimize your use of hardware-based compute accelerators | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS06-BP01 | Sustainability | Communicate and cascade your sustainability goals | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SUS06-BP02 | Sustainability | Adopt methods that can rapidly introduce sustainability improvements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SUS06-BP03 | Sustainability | Keep your workload up-to-date | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS06-BP04 | Sustainability | Increase utilization of build environments | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS06-BP05 | Sustainability | Use managed device farms for testing | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| ID | Pillar | Best practice | Status | Evidence |
|---|---|---|---|---|
| GENOPS01-BP01 | Operational excellence | Periodically evaluate functional performance | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENOPS01-BP02 | Operational excellence | Collect and monitor user feedback | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENOPS02-BP01 | Operational excellence | Monitor all application layers | Implemented | Diagram: Model telemetry destination shown. Nodes: guard, agentcore, fm. Implement comprehensive observability: log model invocations, latency, token usage, guardrail interventions and user feedback to CloudWatch/S3, and keep an audit trail with CloudTrail. |
| GENOPS02-BP02 | Operational excellence | Monitor foundation model metrics | Implemented | Diagram: Model telemetry destination shown. Nodes: guard, agentcore, fm. Implement comprehensive observability: log model invocations, latency, token usage, guardrail interventions and user feedback to CloudWatch/S3, and keep an audit trail with CloudTrail. |
| GENOPS02-BP03 | Operational excellence | Implement solutions to mitigate the risk of system overload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENOPS03-BP01 | Operational excellence | Implement prompt template management | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENOPS03-BP02 | Operational excellence | Enable tracing for agents and RAG workflows | Implemented | Tracing/telemetry is drawn (cw). |
| GENOPS04-BP01 | Operational excellence | Automate generative AI application lifecycle with infrastructure as code (IaC) | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENOPS04-BP02 | Operational excellence | Implement GenAIOps to optimize the application lifecycle | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENOPS05-BP01 | Operational excellence | Learn when to customize models | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENSEC01-BP01 | Security | Grant least privilege access to foundation model endpoints | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| GENSEC01-BP02 | Security | Implement private network communication between foundation models and applications | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| GENSEC01-BP03 | Security | Implement least privilege access permissions for foundation models accessing data stores | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| GENSEC01-BP04 | Security | Implement access monitoring to generative AI services and foundation models | Implemented | Diagram: Model telemetry destination shown. Nodes: guard, agentcore, fm. Implement comprehensive observability: log model invocations, latency, token usage, guardrail interventions and user feedback to CloudWatch/S3, and keep an audit trail with CloudTrail. |
| GENSEC02-BP01 | Security | Implement guardrails to mitigate harmful or incorrect model responses | Implemented | Diagram: Guardrails shown. Nodes: guard, agentcore, fm. Design for controlled autonomy: apply Amazon Bedrock Guardrails (or equivalent) to filter harmful content, PII and prompt attacks on both prompts and responses. |
| GENSEC03-BP01 | Security | Implement control plane and data access monitoring to generative AI services and foundation models | Implemented | Diagram: Model telemetry destination shown. Nodes: guard, agentcore, fm. Implement comprehensive observability: log model invocations, latency, token usage, guardrail interventions and user feedback to CloudWatch/S3, and keep an audit trail with CloudTrail. |
| GENSEC04-BP01 | Security | Implement a secure prompt catalog | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENSEC04-BP02 | Security | Sanitize and validate user inputs to foundation models | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENSEC05-BP01 | Security | Implement least privilege access and permissions boundaries for agentic workflows | Partially Implemented | Diagram: Agents and excessive agency. Nodes: agentcore. Limit tool permissions with least-privilege IAM roles, scope tool inputs/outputs, and add human approval for high-impact actions. Verified Permissions tool authorization authorizes agent actions outside the agent's own code. |
| GENSEC06-BP01 | Security | Implement data purification filters for model training workflows | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| GENREL01-BP01 | Reliability | Scale and balance foundation model throughput as a function of utilization | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENREL02-BP01 | Reliability | Implement redundant network connections among model endpoints and supporting infrastructure | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| GENREL03-BP01 | Reliability | Use logic to manage prompt flows and gracefully recover from failure | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENREL03-BP02 | Reliability | Implement timeout mechanisms on agentic workflows | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENREL04-BP01 | Reliability | Implement a prompt catalog | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENREL04-BP02 | Reliability | Implement a model catalog | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENREL05-BP01 | Reliability | Load-balance inference requests across all regions of availability | Cannot Determine | Diagram: Single-Region model inference. Nodes: guard, agentcore, fm. Establish distributed resilience: plan for throttling and quota limits (retries, queues, provisioned throughput) and consider cross-Region inference profiles or a fallback model. |
| GENREL05-BP02 | Reliability | Replicate embedding data across all Regions of availability | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENREL05-BP03 | Reliability | Verify that agent capabilities are available across all regions of availability | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENREL06-BP01 | Reliability | Design for fault-tolerance for high-performance distributed computation tasks | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENPERF01-BP01 | Performance efficiency | Define a ground truth data set of prompts and responses | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENPERF01-BP02 | Performance efficiency | Collect performance metrics from generative AI workloads | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENPERF02-BP01 | Performance efficiency | Load test model endpoints | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENPERF02-BP02 | Performance efficiency | Optimize inference parameters to improve response quality | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| GENPERF02-BP03 | Performance efficiency | Select and customize the appropriate model for your use case | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENPERF03-BP01 | Performance efficiency | Use managed solutions for model hosting, customization, and data access where appropriate | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| GENPERF04-BP01 | Performance efficiency | Test vector embeddings for latency and relevant performance | Cannot Determine | Diagram: Retrieval / grounding data shown. Nodes: kb. Ground responses in enterprise data (RAG with a vector store or Knowledge Bases) and measure retrieval quality; version prompts, models and data sources. |
| GENPERF04-BP02 | Performance efficiency | Optimize vector sizes for your use case | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENCOST01-BP01 | Cost optimization | Right-size model selection to optimize inference costs | Partially Implemented | Diagram: Model cost controls. Nodes: guard, agentcore, fm. Optimize resource efficiency: select the smallest model that meets quality targets, use prompt caching / batch inference where possible, and track cost per request. Claude Sonnet 5.5 (Amazon Bedrock Edition) accounts for 27% of the estimated monthly cost ($1,320.00); model right-sizing should be validated against quality targets. |
| GENCOST02-BP01 | Cost optimization | Balance cost and performance when selecting inference paradigms | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENCOST02-BP02 | Cost optimization | Optimize resource consumption to minimize hosting costs | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENCOST03-BP01 | Cost optimization | Optimize prompt token length | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENCOST03-BP02 | Cost optimization | Control model response length | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENCOST03-BP03 | Cost optimization | Implement prompt caching to reduce token costs | Cannot Determine | No prompt-cache usage is modelled; repeated instructions/context are a candidate for prompt caching. |
| GENCOST03-BP04 | Cost optimization | Annotate user input to enable cost-aware content filtering | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENCOST04-BP01 | Cost optimization | Reduce vector length on embedded tokens | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENCOST05-BP01 | Cost optimization | Create stopping conditions to control long-running workflows | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENSUS01-BP01 | Sustainability | Implement auto scaling and serverless architectures to optimize resource utilization | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENSUS01-BP02 | Sustainability | Use efficient model customization services | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| GENSUS02-BP01 | Sustainability | Optimize data processing and storage to minimize energy consumption | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| GENSUS03-BP01 | Sustainability | Leverage smaller models and optimized inference techniques to reduce carbon footprint | Cannot Determine | Diagram: Model and hosting efficiency. Nodes: guard, agentcore, fm. Prefer right-sized or distilled models, serverless inference (Bedrock) and efficient accelerators; avoid always-on endpoints for spiky traffic. |
Evidence. A single private connection is drawn; redundant connectivity (second Direct Connect location or VPN backup) is not shown.
Impact × likelihood. Severe × Low → High. Status: Partially Implemented.
Recommendation. Provision redundant connectivity to on-premises: a second Direct Connect connection in a different location, with Site-to-Site VPN as backup.
Priority. Plan · effort Medium · owner Platform / SRE
| ID | Risk | Quadrant | SMART goal | Owner |
|---|---|---|---|---|
| F-001 | High | Plan | By 2026-11-13 (6 weeks): Provision redundant connectivity to on-premises: a second Direct Connect connection in a different location, with Site-to-Site VPN as backup. Success measure: Loss of one link keeps hybrid traffic flowing in a failover test | Platform / SRE |
Impact × Likelihood matrix from the AWS Well-Architected review skill (Severe+High = Critical; Severe+Medium/Low or Moderate+High = High; Moderate+Medium/Low or Minor+High = Medium; otherwise Low).