Checkout (imported from Mermaid)

Well-Architected review Checkout (imported from Mermaid) · 2026-10-02 · mode full

Coverage audit

• AWS Well-Architected Framework — 6 pillars, 57 questions, 307 best practices, from the live documentation index, snapshot 2026-10-01 (0 days old).
• Assessed 307 framework BPs: 11 with diagram evidence, 294 cannot be determined.
• Evidence sources: architecture diagram (services, boundaries, relationships); cost estimate from the AWS Price List.
• Corpus read from a committed snapshot of the live documentation index (not re-fetched during this review). Re-read it with `archify-aws wa corpus --refresh`. Statuses reflect what the diagram and spec show. Process, configuration and runtime evidence are not observable here, so those BPs are 'Cannot Determine' rather than guessed.

Executive summary

This Well-Architected Framework review of Checkout (imported from Mermaid) (standard criticality) assessed the architecture diagram only. 11 of 307 framework best practices have diagram evidence; the rest are Cannot Determine because process, configuration and runtime evidence is not in the diagram. It found 0 critical, 0 high, 2 medium and 0 low risks. Estimated run cost is $7.82/month (indicative).

11 of 307 framework best practices have diagram evidence (4%); among those, 3 implemented, 1 partial, 7 not implemented. Provisional: scores cover evidenced practices only.

Strengths. Data stores are not placed in public subnets; Managed / serverless services dominate; Design-time cost model.

Architecture overview

The reviewed architecture is the Diagram tab (5 components, sequence diagram). Hover a finding to highlight the components involved.

Pillar scorecard

Score = 1 + 4 × (implemented + ½ partial) ÷ evidenced BPs; shown only when ≥ 3 BPs are evidenced. It reflects evidenced practices, not the whole pillar.

Framework questions

Framework best-practice ledger 307 best practices — nothing truncated

Findings

Medium risk (2)

To confirm not drawn, so not counted as gaps

• No AWS KMS shown for data at rest SEC08-BP01 — Manage encryption keys in AWS KMS (customer managed keys where you need key policy, rotation or audit control) and enforce encryption at rest on every data store.
• No identity / authentication service shown SEC02-BP04 — Authenticate and authorize every request through a centralized identity provider (Amazon Cognito, IAM Identity Center) with MFA and temporary credentials.
• No detection or audit services shown SEC04-BP01, SEC04-BP02 — Enable CloudTrail (organization trail), GuardDuty and Security Hub, and send logs and findings to a central, access-restricted account.
• No backup or recovery capability shown REL09-BP01, REL09-BP03 — Back up data automatically with AWS Backup (cross-account/cross-Region vault where required) and test restores against your RPO/RTO.
• No infrastructure-as-code or CI/CD shown OPS05-BP04, OPS05-BP10, REL08-BP05, SEC11-BP06 — Define infrastructure as code and deploy through a pipeline with small, reversible changes and automated rollback.
• No CDN / edge acceleration shown for end users PERF04-BP02, PERF04-BP06 — Serve content close to users with Amazon CloudFront or AWS Global Accelerator to reduce latency.
• No cost visibility shown COST01-BP03, COST01-BP06, COST03-BP05 — Set AWS Budgets with alert thresholds, enable Cost Anomaly Detection and cost allocation tags so spend maps to this workload.

Eisenhower prioritization

Prioritized remediation plan

Next steps

1. Add the missing process, configuration and runtime evidence to turn Cannot Determine practices into assessed ones.
2. Re-run the review after changes, and when the architecture or documentation changes.

Impact × Likelihood matrix from the AWS Well-Architected review skill (Severe+High = Critical; Severe+Medium/Low or Moderate+High = High; Moderate+Medium/Low or Minor+High = Medium; otherwise Low).