Public on-demand AWS list prices from the AWS Price List. Excludes free tier, taxes, support plans, Savings Plans/Reserved Instances/Spot and enterprise discounts, and data transfer unless a node sets egressGbPerMonth. Monthly = 730 hours. Not a quote: confirm with the AWS Pricing Calculator.
| Component | Service | Status | $ / month | Line items |
|---|---|---|---|---|
| Reports | Amazon RDS | estimated | $352 | 2 lines
Excludes backup storage beyond free allocation, Provisioned IOPS and data transfer. |
| Orders | Amazon API Gateway | estimated | $3.50 | 1 line
|
| Receipts | Amazon Simple Storage Service | estimated | $3.20 | 3 lines
|
| Site | Amazon Simple Storage Service | estimated | $3.20 | 3 lines
|
| Orders | AWS Lambda | estimated | $1.87 | 2 lines
|
| Worker | AWS Lambda | estimated | $1.87 | 2 lines
|
| Orders | Amazon DynamoDB | estimated | $1.25 | 3 lines
On-demand capacity mode; the Price List storage tier includes its first 25 GB at no charge. |
| Fulfilment | Amazon Simple Queue Service | estimated | $1.20 | 1 line
|
usage| Component | Assumption | Value | Source |
|---|---|---|---|
| Receipts | storageClass | standard | assumed |
| Receipts | storageGb | 100 | assumed |
| Receipts | putRequestsPerMonth | 100000 | assumed |
| Receipts | getRequestsPerMonth | 1000000 | assumed |
| Site | storageClass | standard | assumed |
| Site | storageGb | 100 | assumed |
| Site | putRequestsPerMonth | 100000 | assumed |
| Site | getRequestsPerMonth | 1000000 | assumed |
| Orders | type | rest | assumed |
| Orders | requestsPerMonth | 1000000 | assumed |
| Orders | requestsPerMonth | 1000000 | assumed |
| Orders | avgDurationMs | 200 | assumed |
| Orders | memoryMb | 512 | assumed |
| Orders | arch | x86 | assumed |
| Reports | instanceClass | db.r6g.large | assumed |
| Reports | engine | PostgreSQL | assumed |
| Reports | multiAz | true | assumed |
| Reports | storageGb | 100 | assumed |
| Orders | readRequestsPerMonth | 5000000 | assumed |
| Orders | writeRequestsPerMonth | 1000000 | assumed |
| Orders | storageGb | 10 | assumed |
| Events | publishesPerMonth | 1000000 | assumed |
| Fulfilment | fifo | false | assumed |
| Fulfilment | requestsPerMonth | 3000000 | assumed |
| Worker | requestsPerMonth | 1000000 | assumed |
| Worker | avgDurationMs | 200 | assumed |
| Worker | memoryMb | 512 | assumed |
| Worker | arch | x86 | assumed |
Retrieved 2026-10-01T18:40:39.861Z from the public AWS Price List bulk API. Per-service publication dates:
AmazonS3 2026-09-28 · AmazonApiGateway 2026-09-21 · AWSLambda 2026-09-19 · AmazonRDS 2026-10-01 · AmazonDynamoDB 2026-09-11 · AmazonSNS 2026-09-15 · AWSQueueService 2026-09-11
Only public on-demand rates are used. This is not a quote — confirm in the AWS Pricing Calculator.
This Well-Architected Framework review of Orders API (from Terraform) (standard criticality) assessed the architecture diagram only. 15 of 307 framework best practices have diagram evidence; the rest are Cannot Determine because process, configuration and runtime evidence is not in the diagram. It found 0 critical, 0 high, 2 medium and 0 low risks. Estimated run cost is $368/month (indicative).
15 of 307 framework best practices have diagram evidence (5%); among those, 6 implemented, 2 partial, 7 not implemented. Provisional: scores cover evidenced practices only.
Strengths. Data stores are not placed in public subnets; Asynchronous decoupling shown; Caching shown; Managed / serverless services dominate.
The reviewed architecture is the Diagram tab (10 components, architecture diagram). Hover a finding to highlight the components involved.
| Pillar | Score (1–5) | Evidenced BPs | I · P · N · NA · CD | Strongest area | Main gap |
|---|---|---|---|---|---|
| Operational excellence | 1.0 provisional | 3/68 (4.4%) | 0 0 3 0 65 | — | No monitoring / observability shown |
| Security | — | 2/63 (3.2%) | 1 0 1 0 61 | Data stores are not placed in public subnets | Internet-facing entry has no WAF / Shield shown |
| Reliability | 2.3 provisional | 3/65 (4.6%) | 1 0 2 1 61 | Asynchronous decoupling shown | No gaps evidenced in the diagram |
| Performance efficiency | — | 2/32 (6.3%) | 1 0 1 1 29 | Caching shown | No gaps evidenced in the diagram |
| Cost optimization | 3.7 provisional | 3/50 (6%) | 1 2 0 0 47 | — | No gaps evidenced in the diagram |
| Sustainability | — | 2/29 (6.9%) | 2 0 0 0 27 | Managed / serverless services dominate | No gaps evidenced in the diagram |
Score = 1 + 4 × (implemented + ½ partial) ÷ evidenced BPs; shown only when ≥ 3 BPs are evidenced. It reflects evidenced practices, not the whole pillar.
| ID | Question | Pillar | Status | Risk | BPs (evidenced) | Key evidence |
|---|---|---|---|---|---|---|
| OPS01 | OPS 1. How do you determine what your priorities are? | Operational excellence | Cannot Determine | Not Applicable | 6 (0) | — |
| OPS02 | OPS 2. How do you structure your organization to support your business outcomes? | Operational excellence | Cannot Determine | Not Applicable | 6 (0) | — |
| OPS03 | OPS 3. How does your organizational culture support your business outcomes? | Operational excellence | Cannot Determine | Not Applicable | 7 (0) | — |
| OPS04 | OPS 4. How do you implement observability in your workload? | Operational excellence | Not Implemented | Medium | 5 (1) | Diagram: No monitoring / observability shown. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied |
| OPS05 | OPS 5. How do you reduce defects, ease remediation, and improve flow into production? | Operational excellence | Cannot Determine | Not Applicable | 10 (2) | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code and deploy through a pipeline with small, reversible changes (CloudFormation/CD |
| OPS06 | OPS 6. How do you mitigate deployment risks? | Operational excellence | Cannot Determine | Not Applicable | 4 (0) | — |
| OPS07 | OPS 7. How do you know that you are ready to support a workload? | Operational excellence | Cannot Determine | Not Applicable | 6 (0) | — |
| OPS08 | OPS 8. How do you utilize workload observability in your organization? | Operational excellence | Not Implemented | Medium | 5 (2) | Diagram: No monitoring / observability shown. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied |
| OPS09 | OPS 9. How do you understand the health of your operations? | Operational excellence | Cannot Determine | Not Applicable | 3 (0) | — |
| OPS10 | OPS 10. How do you manage workload and operations events? | Operational excellence | Cannot Determine | Not Applicable | 7 (0) | — |
| OPS11 | OPS 11. How do you evolve operations? | Operational excellence | Cannot Determine | Not Applicable | 9 (0) | — |
| SEC01 | SEC 1. How do you securely operate your workload? | Security | Cannot Determine | Not Applicable | 8 (0) | — |
| SEC02 | SEC 2. How do you manage authentication for people and machines? | Security | Cannot Determine | Not Applicable | 6 (2) | Diagram: No Secrets Manager shown for database credentials. Store and rotate credentials in AWS Secrets Manager (or use IAM database authentication) instead of |
| SEC03 | SEC 3. How do you manage permissions for people and machines? | Security | Cannot Determine | Not Applicable | 9 (0) | — |
| SEC04 | SEC 4. How do you detect and investigate security events? | Security | Cannot Determine | Not Applicable | 4 (2) | Diagram: No detection or audit services shown. Enable AWS CloudTrail, GuardDuty and Security Hub (and Config/Inspector/Macie as relevant) for logging, threat de |
| SEC05 | SEC 5. How do you protect your network resources? | Security | Not Implemented | Medium | 4 (2) | Diagram: Data stores are not placed in public subnets. Least-privilege network placement for stateful services. |
| SEC06 | SEC 6. How do you protect your compute resources? | Security | Cannot Determine | Not Applicable | 5 (0) | — |
| SEC07 | SEC 7. How do you classify your data? | Security | Cannot Determine | Not Applicable | 4 (0) | — |
| SEC08 | SEC 8. How do you protect your data at rest? | Security | Cannot Determine | Not Applicable | 4 (1) | Diagram: No AWS KMS shown for data at rest. Encrypt data at rest and in transit; use AWS KMS customer managed keys where you need key policy, rotation or audit |
| SEC09 | SEC 9. How do you protect your data in transit? | Security | Cannot Determine | Not Applicable | 3 (0) | — |
| SEC10 | SEC 10. How do you anticipate, respond to, and recover from incidents? | Security | Cannot Determine | Not Applicable | 8 (0) | — |
| SEC11 | SEC 11. How do you incorporate and validate the security properties of applications throughout the design, development, and deployment lifecycle? | Security | Cannot Determine | Not Applicable | 8 (1) | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code and deploy through a pipeline with small, reversible changes (CloudFormation/CD |
| REL01 | REL 1. How do you manage Service Quotas and constraints? | Reliability | Cannot Determine | Not Applicable | 6 (0) | — |
| REL02 | REL 2. How do you plan your network topology? | Reliability | Cannot Determine | Not Applicable | 5 (1) | No on-premises or private-link connectivity is drawn. |
| REL03 | REL 3. How do you design your workload service architecture? | Reliability | Cannot Determine | Not Applicable | 3 (0) | — |
| REL04 | REL 4. How do you design interactions in a distributed system to prevent failures? | Reliability | Implemented | None | 4 (1) | Diagram: Asynchronous decoupling shown. Nodes: events, fulfilment. Decouple components with Amazon SQS, SNS or EventBridge so spikes and downstream failures do |
| REL05 | REL 5. How do you design interactions in a distributed system to mitigate or withstand failures? | Reliability | Cannot Determine | Not Applicable | 7 (0) | — |
| REL06 | REL 6. How do you monitor workload resources? | Reliability | Not Implemented | Medium | 7 (1) | Diagram: No monitoring / observability shown. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied |
| REL07 | REL 7. How do you design your workload to adapt to changes in demand? | Reliability | Cannot Determine | Not Applicable | 4 (0) | — |
| REL08 | REL 8. How do you implement change? | Reliability | Cannot Determine | Not Applicable | 5 (1) | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code and deploy through a pipeline with small, reversible changes (CloudFormation/CD |
| REL09 | REL 9. How do you back up data? | Reliability | Cannot Determine | Not Applicable | 4 (2) | Diagram: No backup or recovery capability shown. Define RPO/RTO and back up data with AWS Backup, snapshots, point-in-time recovery or cross-Region replication. |
| REL10 | REL 10. How do you use fault isolation to protect your workload? | Reliability | Cannot Determine | Not Applicable | 3 (0) | — |
| REL11 | REL 11. How do you design your workload to withstand component failures? | Reliability | Not Implemented | Medium | 7 (1) | Diagram: No monitoring / observability shown. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied |
| REL12 | REL 12. How do you test reliability? | Reliability | Cannot Determine | Not Applicable | 5 (0) | — |
| REL13 | REL 13. How do you plan for disaster recovery (DR)? | Reliability | Cannot Determine | Not Applicable | 5 (0) | — |
| PERF01 | PERF 1. How do you select appropriate cloud resources and architecture for your workload? | Performance efficiency | Cannot Determine | Not Applicable | 7 (0) | — |
| PERF02 | PERF 2. How do you select and use compute resources in your workload? | Performance efficiency | Cannot Determine | Not Applicable | 6 (0) | — |
| PERF03 | PERF 3. How do you store, manage, and access data in your workload? | Performance efficiency | Implemented | None | 5 (1) | Diagram: Caching shown. Add caching (ElastiCache, CloudFront) or read replicas for read-heavy access, and choose the data store that fits the access pattern. |
| PERF04 | PERF 4. How do you select and configure networking resources in your workload? | Performance efficiency | Cannot Determine | Not Applicable | 7 (1) | No dedicated connectivity or VPN is drawn. |
| PERF05 | PERF 5. How do your organizational practices and culture contribute to performance efficiency in your workload? | Performance efficiency | Not Implemented | Medium | 7 (1) | Diagram: No monitoring / observability shown. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied |
| COST01 | COST 1. How do you implement cloud financial management? | Cost optimization | Cannot Determine | Not Applicable | 9 (2) | Diagram: No cost visibility shown. Tag resources, set AWS Budgets and use Cost Explorer so spend maps to workloads and owners. |
| COST02 | COST 2. How do you govern usage? | Cost optimization | Cannot Determine | Not Applicable | 6 (0) | — |
| COST03 | COST 3. How do you monitor your cost and usage? | Cost optimization | Cannot Determine | Not Applicable | 6 (1) | Diagram: No cost visibility shown. Tag resources, set AWS Budgets and use Cost Explorer so spend maps to workloads and owners. |
| COST04 | COST 4. How do you decommission resources? | Cost optimization | Cannot Determine | Not Applicable | 5 (0) | — |
| COST05 | COST 5. How do you evaluate cost when you select services? | Cost optimization | Partially Implemented | None | 6 (1) | A design-time cost model was generated from the AWS Price List: 9 of 10 billable components priced, $367.58/month on-demand (indicative; volumes partly assumed) |
| COST06 | COST 6. How do you meet cost targets when you select resource type, size and number? | Cost optimization | Partially Implemented | None | 4 (1) | A design-time cost model was generated from the AWS Price List: 9 of 10 billable components priced, $367.58/month on-demand (indicative; volumes partly assumed) |
| COST07 | COST 7. How do you use pricing models to reduce cost? | Cost optimization | Cannot Determine | Not Applicable | 5 (1) | Compute and database capacity is $355.23/month at on-demand rates (97% of the estimate); whether Savings Plans/Reserved Instances apply is not shown. Evaluate w |
| COST08 | COST 8. How do you plan for data transfer charges? | Cost optimization | Cannot Determine | Not Applicable | 3 (1) | Data transfer is excluded from the estimate (no node sets egressGbPerMonth); model it before launch. |
| COST09 | COST 9. How do you manage demand, and supply resources? | Cost optimization | Implemented | None | 3 (1) | Diagram: Asynchronous decoupling shown. Nodes: events, fulfilment. Decouple components with Amazon SQS, SNS or EventBridge so spikes and downstream failures do |
| COST10 | COST 10. How do you evaluate new services? | Cost optimization | Cannot Determine | Not Applicable | 2 (0) | — |
| COST11 | COST 11. How do you evaluate the cost of effort? | Cost optimization | Cannot Determine | Not Applicable | 1 (0) | — |
| SUS01 | SUS 1 How do you select Regions for your workload? | Sustainability | Cannot Determine | Not Applicable | 1 (0) | — |
| SUS02 | SUS 2 How do you align cloud resources to your demand? | Sustainability | Cannot Determine | Not Applicable | 6 (0) | — |
| SUS03 | SUS 3 How do you take advantage of software and architecture patterns to support your sustainability goals? | Sustainability | Implemented | None | 5 (1) | Diagram: Asynchronous decoupling shown. Nodes: events, fulfilment. Decouple components with Amazon SQS, SNS or EventBridge so spikes and downstream failures do |
| SUS04 | SUS 4 How do you take advantage of data management policies and patterns to support your sustainability goals? | Sustainability | Cannot Determine | Not Applicable | 8 (0) | — |
| SUS05 | SUS 5 How do you select and use cloud hardware and services in your architecture to support your sustainability goals? | Sustainability | Implemented | None | 4 (1) | Diagram: Managed / serverless services dominate. Prefer managed and serverless services, right-size, use Graviton-based instances, and scale to demand to raise |
| SUS06 | SUS 6 How do your organizational processes support your sustainability goals? | Sustainability | Cannot Determine | Not Applicable | 5 (0) | — |
| ID | Pillar | Best practice | Status | Evidence |
|---|---|---|---|---|
| OPS01-BP01 | Operational excellence | Evaluate external customer needs | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS01-BP02 | Operational excellence | Evaluate internal customer needs | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS01-BP03 | Operational excellence | Evaluate governance requirements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS01-BP04 | Operational excellence | Evaluate compliance requirements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS01-BP05 | Operational excellence | Evaluate threat landscape | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS01-BP06 | Operational excellence | Evaluate tradeoffs while managing benefits and risks | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS02-BP01 | Operational excellence | Resources have identified owners | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS02-BP02 | Operational excellence | Processes and procedures have identified owners | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS02-BP03 | Operational excellence | Operations activities have identified owners responsible for their performance | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS02-BP04 | Operational excellence | Mechanisms exist to manage responsibilities and ownership | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS02-BP05 | Operational excellence | Mechanisms exist to request additions, changes, and exceptions | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS02-BP06 | Operational excellence | Responsibilities between teams are predefined or negotiated | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS03-BP01 | Operational excellence | Provide executive sponsorship | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS03-BP02 | Operational excellence | Team members are empowered to take action when outcomes are at risk | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS03-BP03 | Operational excellence | Escalation is encouraged | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS03-BP04 | Operational excellence | Communications are timely, clear, and actionable | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS03-BP05 | Operational excellence | Experimentation is encouraged | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS03-BP06 | Operational excellence | Team members are encouraged to maintain and grow their skill sets | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS03-BP07 | Operational excellence | Resource teams appropriately | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS04-BP01 | Operational excellence | Identify key performance indicators | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| OPS04-BP02 | Operational excellence | Implement application telemetry | Not Implemented | Diagram: No monitoring / observability shown. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to business outcomes. |
| OPS04-BP03 | Operational excellence | Implement user experience telemetry | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS04-BP04 | Operational excellence | Implement dependency telemetry | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS04-BP05 | Operational excellence | Implement distributed tracing | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS05-BP01 | Operational excellence | Use version control | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS05-BP02 | Operational excellence | Test and validate changes | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS05-BP03 | Operational excellence | Use configuration management systems | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| OPS05-BP04 | Operational excellence | Use build and deployment management systems | Cannot Determine | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code and deploy through a pipeline with small, reversible changes (CloudFormation/CDK, CodePipeline). |
| OPS05-BP05 | Operational excellence | Perform patch management | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| OPS05-BP06 | Operational excellence | Share design standards | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS05-BP07 | Operational excellence | Implement practices to improve code quality | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS05-BP08 | Operational excellence | Use multiple environments | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS05-BP09 | Operational excellence | Make frequent, small, reversible changes | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS05-BP10 | Operational excellence | Fully automate integration and deployment | Cannot Determine | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code and deploy through a pipeline with small, reversible changes (CloudFormation/CDK, CodePipeline). |
| OPS06-BP01 | Operational excellence | Plan for unsuccessful changes | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS06-BP02 | Operational excellence | Test deployments | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS06-BP03 | Operational excellence | Employ safe deployment strategies | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS06-BP04 | Operational excellence | Automate testing and rollback | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS07-BP01 | Operational excellence | Ensure personnel capability | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS07-BP02 | Operational excellence | : Ensure a consistent review of operational readiness | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS07-BP03 | Operational excellence | Use runbooks to perform procedures | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS07-BP04 | Operational excellence | Use playbooks to investigate issues | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS07-BP05 | Operational excellence | Make informed decisions to deploy systems and changes | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS07-BP06 | Operational excellence | Create support plans for production workloads | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS08-BP01 | Operational excellence | Analyze workload metrics | Not Implemented | Diagram: No monitoring / observability shown. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to business outcomes. |
| OPS08-BP02 | Operational excellence | Analyze workload logs | Not Implemented | Diagram: No monitoring / observability shown. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to business outcomes. |
| OPS08-BP03 | Operational excellence | Analyze workload traces | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS08-BP04 | Operational excellence | Create actionable alerts | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS08-BP05 | Operational excellence | Create dashboards | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS09-BP01 | Operational excellence | Measure operations goals and KPIs with metrics | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS09-BP02 | Operational excellence | Communicate status and trends to ensure visibility into operation | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS09-BP03 | Operational excellence | Review operations metrics and prioritize improvement | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS10-BP01 | Operational excellence | Use a process for event, incident, and problem management | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS10-BP02 | Operational excellence | Have a process per alert | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS10-BP03 | Operational excellence | Prioritize operational events based on business impact | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS10-BP04 | Operational excellence | Define escalation paths | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS10-BP05 | Operational excellence | Define a customer communication plan for service-impacting events | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS10-BP06 | Operational excellence | Communicate status through dashboards | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS10-BP07 | Operational excellence | Automate responses to events | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS11-BP01 | Operational excellence | Have a process for continuous improvement | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS11-BP02 | Operational excellence | Perform post-incident analysis | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS11-BP03 | Operational excellence | Implement feedback loops | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS11-BP04 | Operational excellence | Perform knowledge management | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS11-BP05 | Operational excellence | Define drivers for improvement | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS11-BP06 | Operational excellence | Validate insights | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| OPS11-BP07 | Operational excellence | Perform operations metrics reviews | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS11-BP08 | Operational excellence | Document and share lessons learned | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| OPS11-BP09 | Operational excellence | Allocate time to make improvements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC01-BP01 | Security | Separate workloads using accounts | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC01-BP02 | Security | Secure account root user and properties | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC01-BP03 | Security | Identify and validate control objectives | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC01-BP04 | Security | Stay up to date with security threats and recommendations | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC01-BP05 | Security | Reduce security management scope | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC01-BP06 | Security | Automate deployment of standard security controls | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC01-BP07 | Security | Identify threats and prioritize mitigations using a threat model | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC01-BP08 | Security | Evaluate and implement new security services and features regularly | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC02-BP01 | Security | Use strong sign-in mechanisms | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC02-BP02 | Security | Use temporary credentials | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC02-BP03 | Security | Store and use secrets securely | Cannot Determine | Diagram: No Secrets Manager shown for database credentials. Store and rotate credentials in AWS Secrets Manager (or use IAM database authentication) instead of embedding them. |
| SEC02-BP04 | Security | Rely on a centralized identity provider | Cannot Determine | Diagram: No identity / authentication service shown. Authenticate and authorize every request (Amazon Cognito, IAM Identity Center, IAM roles, Verified Permissions) and use temporary credentials. |
| SEC02-BP05 | Security | Audit and rotate credentials periodically | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC02-BP06 | Security | Employ user groups and attributes | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC03-BP01 | Security | Define access requirements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC03-BP02 | Security | Grant least privilege access | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC03-BP03 | Security | Establish emergency access process | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC03-BP04 | Security | Reduce permissions continuously | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC03-BP05 | Security | Define permission guardrails for your organization | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC03-BP06 | Security | Manage access based on lifecycle | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC03-BP07 | Security | Analyze public and cross-account access | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC03-BP08 | Security | Share resources securely within your organization | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC03-BP09 | Security | Share resources securely with a third party | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC04-BP01 | Security | Configure service and application logging | Cannot Determine | Diagram: No detection or audit services shown. Enable AWS CloudTrail, GuardDuty and Security Hub (and Config/Inspector/Macie as relevant) for logging, threat detection and response. |
| SEC04-BP02 | Security | Capture logs, findings, and metrics in standardized locations | Cannot Determine | Diagram: No detection or audit services shown. Enable AWS CloudTrail, GuardDuty and Security Hub (and Config/Inspector/Macie as relevant) for logging, threat detection and response. |
| SEC04-BP03 | Security | Correlate and enrich security alerts | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC04-BP04 | Security | Initiate remediation for non-compliant resources | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC05-BP01 | Security | Create network layers | Implemented | Diagram: Data stores are not placed in public subnets. Least-privilege network placement for stateful services. |
| SEC05-BP02 | Security | Control traffic flow within your network layers | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC05-BP03 | Security | Implement inspection-based protection | Not Implemented | Diagram: Internet-facing entry has no WAF / Shield shown. Nodes: web, orders. Protect public entry points (CloudFront, API Gateway, load balancers) with AWS WAF and AWS Shield, and restrict origins. |
| SEC05-BP04 | Security | Automate network protection | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC06-BP01 | Security | Perform vulnerability management | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC06-BP02 | Security | Provision compute from hardened images | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC06-BP03 | Security | Reduce manual management and interactive access | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC06-BP04 | Security | Validate software integrity | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC06-BP05 | Security | Automate compute protection | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC07-BP01 | Security | Understand your data classification scheme | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC07-BP02 | Security | Apply data protection controls based on data sensitivity | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC07-BP03 | Security | Automate identification and classification | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC07-BP04 | Security | Define scalable data lifecycle management | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC08-BP01 | Security | Implement secure key management | Cannot Determine | Diagram: No AWS KMS shown for data at rest. Encrypt data at rest and in transit; use AWS KMS customer managed keys where you need key policy, rotation or audit control. |
| SEC08-BP02 | Security | Enforce encryption at rest | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC08-BP03 | Security | Automate data at rest protection | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC08-BP04 | Security | Enforce access control | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC09-BP01 | Security | Implement secure key and certificate management | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC09-BP02 | Security | Enforce encryption in transit | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC09-BP03 | Security | Authenticate network communications | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC10-BP01 | Security | Identify key personnel and external resources | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC10-BP02 | Security | Develop incident management plans | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC10-BP03 | Security | Prepare forensic capabilities | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC10-BP04 | Security | Develop and test security incident response playbooks | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC10-BP05 | Security | Pre-provision access | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SEC10-BP06 | Security | Pre-deploy tools | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC10-BP07 | Security | Run simulations | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC10-BP08 | Security | Establish a framework for learning from incidents | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC11-BP01 | Security | Train for application security | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC11-BP02 | Security | Automate testing throughout the development and release lifecycle | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC11-BP03 | Security | Perform regular penetration testing | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC11-BP04 | Security | Conduct code reviews | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SEC11-BP05 | Security | Centralize services for packages and dependencies | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC11-BP06 | Security | Deploy software programmatically | Cannot Determine | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code and deploy through a pipeline with small, reversible changes (CloudFormation/CDK, CodePipeline). |
| SEC11-BP07 | Security | Regularly assess security properties of the pipelines | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SEC11-BP08 | Security | Build a program that embeds security ownership in workload teams | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL01-BP01 | Reliability | Aware of service quotas and constraints | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL01-BP02 | Reliability | Manage service quotas across accounts and regions | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL01-BP03 | Reliability | Accommodate fixed service quotas and constraints through architecture | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL01-BP04 | Reliability | Monitor and manage quotas | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL01-BP05 | Reliability | Automate quota management | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL01-BP06 | Reliability | Ensure that a sufficient gap exists between the current quotas and the maximum usage to accommodate failover | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL02-BP01 | Reliability | Use highly available network connectivity for your workload public endpoints | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL02-BP02 | Reliability | Provision redundant connectivity between private networks in the cloud and on-premises environments | Not Applicable | No on-premises or private-link connectivity is drawn. |
| REL02-BP03 | Reliability | Ensure IP subnet allocation accounts for expansion and availability | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL02-BP04 | Reliability | Prefer hub-and-spoke topologies over many-to-many mesh | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL02-BP05 | Reliability | Enforce non-overlapping private IP address ranges in all private address spaces where they are connected | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL03-BP01 | Reliability | Choose how to segment your workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL03-BP02 | Reliability | Build services focused on specific business domains and functionality | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL03-BP03 | Reliability | Provide service contracts per API | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL04-BP01 | Reliability | Identify the kind of distributed systems you depend on | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL04-BP02 | Reliability | Implement loosely coupled dependencies | Implemented | Diagram: Asynchronous decoupling shown. Nodes: events, fulfilment. Decouple components with Amazon SQS, SNS or EventBridge so spikes and downstream failures do not cascade; add retries with backoff and timeouts. |
| REL04-BP03 | Reliability | Do constant work | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL04-BP04 | Reliability | Make mutating operations idempotent | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL05-BP01 | Reliability | Implement graceful degradation to transform applicable hard dependencies into soft dependencies | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL05-BP02 | Reliability | Throttle requests | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL05-BP03 | Reliability | Control and limit retry calls | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL05-BP04 | Reliability | Fail fast and limit queues | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL05-BP05 | Reliability | Set client timeouts | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL05-BP06 | Reliability | Make systems stateless where possible | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL05-BP07 | Reliability | Implement emergency levers | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL06-BP01 | Reliability | Monitor all components for the workload (Generation) | Not Implemented | Diagram: No monitoring / observability shown. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to business outcomes. |
| REL06-BP02 | Reliability | Define and calculate metrics (Aggregation) | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL06-BP03 | Reliability | Send notifications (Real-time processing and alarming) | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL06-BP04 | Reliability | Automate responses (Real-time processing and alarming) | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL06-BP05 | Reliability | Analyze logs | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL06-BP06 | Reliability | Regularly review monitoring scope and metrics | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL06-BP07 | Reliability | Monitor end-to-end tracing of requests through your system | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL07-BP01 | Reliability | Use automation when obtaining or scaling resources | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL07-BP02 | Reliability | Obtain resources upon detection of impairment to a workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL07-BP03 | Reliability | Obtain resources upon detection that more resources are needed for a workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL07-BP04 | Reliability | Load test your workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL08-BP01 | Reliability | Use runbooks for standard activities such as deployment | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL08-BP02 | Reliability | Integrate functional testing as part of your deployment | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL08-BP03 | Reliability | Integrate resiliency testing as part of your deployment | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL08-BP04 | Reliability | Deploy using immutable infrastructure | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL08-BP05 | Reliability | Deploy changes with automation | Cannot Determine | Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code and deploy through a pipeline with small, reversible changes (CloudFormation/CDK, CodePipeline). |
| REL09-BP01 | Reliability | Identify and back up all data that needs to be backed up, or reproduce the data from sources | Cannot Determine | Diagram: No backup or recovery capability shown. Define RPO/RTO and back up data with AWS Backup, snapshots, point-in-time recovery or cross-Region replication. |
| REL09-BP02 | Reliability | Secure and encrypt backups | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL09-BP03 | Reliability | Perform data backup automatically | Cannot Determine | Diagram: No backup or recovery capability shown. Define RPO/RTO and back up data with AWS Backup, snapshots, point-in-time recovery or cross-Region replication. |
| REL09-BP04 | Reliability | Perform periodic recovery of the data to verify backup integrity and processes | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL10-BP01 | Reliability | Deploy the workload to multiple locations | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL10-BP02 | Reliability | Automate recovery for components constrained to a single location | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL10-BP03 | Reliability | Use bulkhead architectures to limit scope of impact | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL11-BP01 | Reliability | Monitor all components of the workload to detect failures | Not Implemented | Diagram: No monitoring / observability shown. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to business outcomes. |
| REL11-BP02 | Reliability | Fail over to healthy resources | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL11-BP03 | Reliability | Automate healing on all layers | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL11-BP04 | Reliability | Rely on the data plane and not the control plane during recovery | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL11-BP05 | Reliability | Use static stability to prevent bimodal behavior | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL11-BP06 | Reliability | Send notifications when events impact availability | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL11-BP07 | Reliability | Architect your product to meet availability targets and uptime service level agreements (SLAs) | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL12-BP01 | Reliability | Use playbooks to investigate failures | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL12-BP02 | Reliability | Perform post-incident analysis | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL12-BP03 | Reliability | Test scalability and performance requirements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| REL12-BP04 | Reliability | Test resiliency using chaos engineering | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL12-BP05 | Reliability | Conduct game days regularly | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL13-BP01 | Reliability | Define recovery objectives for downtime and data loss | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL13-BP02 | Reliability | Use defined recovery strategies to meet the recovery objectives | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL13-BP03 | Reliability | Test disaster recovery implementation to validate the implementation | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| REL13-BP04 | Reliability | Manage configuration drift at the DR site or Region | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| REL13-BP05 | Reliability | Automate recovery | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF01-BP01 | Performance efficiency | Learn about and understand available cloud services and features | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF01-BP02 | Performance efficiency | Use guidance from your cloud provider or an appropriate partner to learn about architecture patterns and best practices | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF01-BP03 | Performance efficiency | Factor cost into architectural decisions | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF01-BP04 | Performance efficiency | Evaluate how trade-offs impact customers and architecture efficiency | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF01-BP05 | Performance efficiency | Use policies and reference architectures | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF01-BP06 | Performance efficiency | Use benchmarking to drive architectural decisions | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF01-BP07 | Performance efficiency | Use a data-driven approach for architectural choices | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF02-BP01 | Performance efficiency | Select the best compute options for your workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF02-BP02 | Performance efficiency | Understand the available compute configuration and features | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF02-BP03 | Performance efficiency | Collect compute-related metrics | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF02-BP04 | Performance efficiency | Configure and right-size compute resources | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF02-BP05 | Performance efficiency | Scale your compute resources dynamically | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF02-BP06 | Performance efficiency | Use optimized hardware-based compute accelerators | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF03-BP01 | Performance efficiency | Use a purpose-built data store that best supports your data access and storage requirements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| PERF03-BP02 | Performance efficiency | Evaluate available configuration options for data store | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF03-BP03 | Performance efficiency | Collect and record data store performance metrics | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF03-BP04 | Performance efficiency | Implement strategies to improve query performance in data store | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| PERF03-BP05 | Performance efficiency | Implement data access patterns that utilize caching | Implemented | Diagram: Caching shown. Add caching (ElastiCache, CloudFront) or read replicas for read-heavy access, and choose the data store that fits the access pattern. |
| PERF04-BP01 | Performance efficiency | Understand how networking impacts performance | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF04-BP02 | Performance efficiency | Evaluate available networking features | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF04-BP03 | Performance efficiency | Choose appropriate dedicated connectivity or VPN for your workload | Not Applicable | No dedicated connectivity or VPN is drawn. |
| PERF04-BP04 | Performance efficiency | Use load balancing to distribute traffic across multiple resources | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF04-BP05 | Performance efficiency | Choose network protocols to improve performance | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| PERF04-BP06 | Performance efficiency | Choose your workload's location based on network requirements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| PERF04-BP07 | Performance efficiency | Optimize network configuration based on metrics | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF05-BP01 | Performance efficiency | Establish key performance indicators (KPIs) to measure workload health and performance | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| PERF05-BP02 | Performance efficiency | Use monitoring solutions to understand the areas where performance is most critical | Not Implemented | Diagram: No monitoring / observability shown. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to business outcomes. |
| PERF05-BP03 | Performance efficiency | Define a process to improve workload performance | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| PERF05-BP04 | Performance efficiency | Load test your workload | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF05-BP05 | Performance efficiency | Use automation to proactively remediate performance-related issues | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF05-BP06 | Performance efficiency | Keep your workload and services up-to-date | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| PERF05-BP07 | Performance efficiency | Review metrics at regular intervals | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST01-BP01 | Cost optimization | Establish ownership of cost optimization | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST01-BP02 | Cost optimization | Establish a partnership between finance and technology | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST01-BP03 | Cost optimization | Establish cloud budgets and forecasts | Cannot Determine | Diagram: No cost visibility shown. Tag resources, set AWS Budgets and use Cost Explorer so spend maps to workloads and owners. |
| COST01-BP04 | Cost optimization | Implement cost awareness in your organizational processes | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST01-BP05 | Cost optimization | Report and notify on cost optimization | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST01-BP06 | Cost optimization | Monitor cost proactively | Cannot Determine | Diagram: No cost visibility shown. Tag resources, set AWS Budgets and use Cost Explorer so spend maps to workloads and owners. |
| COST01-BP07 | Cost optimization | Keep up-to-date with new service releases | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST01-BP08 | Cost optimization | Create a cost-aware culture | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST01-BP09 | Cost optimization | Quantify business value from cost optimization | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST02-BP01 | Cost optimization | Develop policies based on your organization requirements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST02-BP02 | Cost optimization | Implement goals and targets | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST02-BP03 | Cost optimization | Implement an account structure | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST02-BP04 | Cost optimization | Implement groups and roles | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST02-BP05 | Cost optimization | Implement cost controls | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST02-BP06 | Cost optimization | Track project lifecycle | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST03-BP01 | Cost optimization | Configure detailed information sources | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| COST03-BP02 | Cost optimization | Add organization information to cost and usage | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST03-BP03 | Cost optimization | Identify cost attribution categories | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST03-BP04 | Cost optimization | Establish organization metrics | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST03-BP05 | Cost optimization | Configure billing and cost management tools | Cannot Determine | Diagram: No cost visibility shown. Tag resources, set AWS Budgets and use Cost Explorer so spend maps to workloads and owners. |
| COST03-BP06 | Cost optimization | Allocate costs based on workload metrics | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST04-BP01 | Cost optimization | Track resources over their lifetime | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST04-BP02 | Cost optimization | Implement a decommissioning process | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST04-BP03 | Cost optimization | Decommission resources | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST04-BP04 | Cost optimization | Decommission resources automatically | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST04-BP05 | Cost optimization | Enforce data retention policies | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST05-BP01 | Cost optimization | Identify organization requirements for cost | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST05-BP02 | Cost optimization | Analyze all components of the workload | Partially Implemented | A design-time cost model was generated from the AWS Price List: 9 of 10 billable components priced, $367.58/month on-demand (indicative; volumes partly assumed). |
| COST05-BP03 | Cost optimization | Perform a thorough analysis of each component | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST05-BP04 | Cost optimization | Select software with cost-effective licensing | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST05-BP05 | Cost optimization | Select components of this workload to optimize cost in line with organization priorities | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST05-BP06 | Cost optimization | Perform cost analysis for different usage over time | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST06-BP01 | Cost optimization | Perform cost modeling | Partially Implemented | A design-time cost model was generated from the AWS Price List: 9 of 10 billable components priced, $367.58/month on-demand (indicative; volumes partly assumed). |
| COST06-BP02 | Cost optimization | Select resource type, size, and number based on data | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST06-BP03 | Cost optimization | Select resource type, size, and number automatically based on metrics | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST06-BP04 | Cost optimization | Consider using shared resources | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST07-BP01 | Cost optimization | Perform pricing model analysis | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST07-BP02 | Cost optimization | Choose Regions based on cost | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST07-BP03 | Cost optimization | Select third-party agreements with cost-efficient terms | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST07-BP04 | Cost optimization | Implement pricing models for all components of this workload | Cannot Determine | Compute and database capacity is $355.23/month at on-demand rates (97% of the estimate); whether Savings Plans/Reserved Instances apply is not shown. Evaluate with Cost Explorer recommendations after 30+ days of steady usage. |
| COST07-BP05 | Cost optimization | Perform pricing model analysis at the management account level | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST08-BP01 | Cost optimization | Perform data transfer modeling | Cannot Determine | Data transfer is excluded from the estimate (no node sets egressGbPerMonth); model it before launch. |
| COST08-BP02 | Cost optimization | Select components to optimize data transfer cost | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST08-BP03 | Cost optimization | Implement services to reduce data transfer costs | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST09-BP01 | Cost optimization | Perform an analysis on the workload demand | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST09-BP02 | Cost optimization | Implement a buffer or throttle to manage demand | Implemented | Diagram: Asynchronous decoupling shown. Nodes: events, fulfilment. Decouple components with Amazon SQS, SNS or EventBridge so spikes and downstream failures do not cascade; add retries with backoff and timeouts. |
| COST09-BP03 | Cost optimization | Supply resources dynamically | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| COST10-BP01 | Cost optimization | Develop a workload review process | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST10-BP02 | Cost optimization | Review and analyze this workload regularly | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| COST11-BP01 | Cost optimization | Perform automation for operations | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS01-BP01 | Sustainability | Choose Region based on both business requirements and sustainability goals | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SUS02-BP01 | Sustainability | Scale workload infrastructure dynamically | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS02-BP02 | Sustainability | Align SLAs with sustainability goals | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SUS02-BP03 | Sustainability | Stop the creation and maintenance of unused assets | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS02-BP04 | Sustainability | Optimize geographic placement of workloads based on their networking requirements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SUS02-BP05 | Sustainability | Optimize team member resources for activities performed | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SUS02-BP06 | Sustainability | Implement buffering or throttling to flatten the demand curve | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS03-BP01 | Sustainability | Optimize software and architecture for asynchronous and scheduled jobs | Implemented | Diagram: Asynchronous decoupling shown. Nodes: events, fulfilment. Decouple components with Amazon SQS, SNS or EventBridge so spikes and downstream failures do not cascade; add retries with backoff and timeouts. |
| SUS03-BP02 | Sustainability | Remove or refactor workload components with low or no use | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS03-BP03 | Sustainability | Optimize areas of code that consume the most time or resources | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS03-BP04 | Sustainability | Optimize impact on devices and equipment | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS03-BP05 | Sustainability | Use software patterns and architectures that best support data access and storage patterns | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SUS04-BP01 | Sustainability | Implement a data classification policy | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SUS04-BP02 | Sustainability | Use technologies that support data access and storage patterns | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SUS04-BP03 | Sustainability | Use policies to manage the lifecycle of your datasets | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS04-BP04 | Sustainability | Use elasticity and automation to expand block storage or file system | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS04-BP05 | Sustainability | Remove unneeded or redundant data | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS04-BP06 | Sustainability | Use shared file systems or storage to access common data | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SUS04-BP07 | Sustainability | Minimize data movement across networks | Cannot Determine | Not observable from the architecture diagram; needs IaC or configuration evidence. |
| SUS04-BP08 | Sustainability | Back up data only when difficult to recreate | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS05-BP01 | Sustainability | Use the minimum amount of hardware to meet your needs | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS05-BP02 | Sustainability | Use instance types with the least impact | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS05-BP03 | Sustainability | Use managed services | Implemented | Diagram: Managed / serverless services dominate. Prefer managed and serverless services, right-size, use Graviton-based instances, and scale to demand to raise utilization and cut idle capacity. |
| SUS05-BP04 | Sustainability | Optimize your use of hardware-based compute accelerators | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS06-BP01 | Sustainability | Communicate and cascade your sustainability goals | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SUS06-BP02 | Sustainability | Adopt methods that can rapidly introduce sustainability improvements | Cannot Determine | Not observable from the architecture diagram; needs process or organizational evidence. |
| SUS06-BP03 | Sustainability | Keep your workload up-to-date | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS06-BP04 | Sustainability | Increase utilization of build environments | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
| SUS06-BP05 | Sustainability | Use managed device farms for testing | Cannot Determine | Not observable from the architecture diagram; needs runtime or operational evidence. |
Evidence. Diagram: No monitoring / observability shown. Collect metrics, logs and traces (Amazon CloudWatch, AWS X-Ray, managed Grafana/Prometheus) and define alarms tied to business outcomes.
Impact × likelihood. Moderate × Medium → Medium. Status: Not Implemented.
Recommendation. Collect metrics, logs and traces (CloudWatch, X-Ray/OpenTelemetry) and define alarms tied to business outcomes.
Priority. Delegate · effort Low · owner DevOps / SRE
Evidence. Diagram: Internet-facing entry has no WAF / Shield shown. Nodes: web, orders. Protect public entry points (CloudFront, API Gateway, load balancers) with AWS WAF and AWS Shield, and restrict origins.
Impact × likelihood. Moderate × Medium → Medium. Status: Not Implemented.
Recommendation. Put AWS WAF (with Shield) in front of every internet-facing entry point; start with AWS managed rule groups in count mode, then enforce.
Priority. Delegate · effort Low · owner Security engineering
None
None
None
| ID | Risk | Quadrant | SMART goal | Owner |
|---|---|---|---|---|
| F-001 | Medium | Delegate | By 2026-10-16 (2 weeks): Collect metrics, logs and traces (CloudWatch, X-Ray/OpenTelemetry) and define alarms tied to business outcomes. Success measure: Dashboards and alarms for every tier; mean time to detect < 5 minutes | DevOps / SRE |
| F-002 | Medium | Delegate | By 2026-10-16 (2 weeks): Put AWS WAF (with Shield) in front of every internet-facing entry point; start with AWS managed rule groups in count mode, then enforce. Success measure: 100% of public endpoints behind a web ACL with logging enabled | Security engineering |
Impact × Likelihood matrix from the AWS Well-Architected review skill (Severe+High = Critical; Severe+Medium/Low or Moderate+High = High; Moderate+Medium/Low or Minor+High = Medium; otherwise Low).