View a markdown version of this page

AWS Well-Architected design considerations - Network Orchestration for AWS Transit Gateway
Operational excellenceSecurityReliabilityPerformance efficiencyCost optimizationSustainability

AWS Well-Architected design considerations

This solution uses the best practices from the AWS Well-Architected Framework which helps customers design and operate reliable, secure, efficient, and cost-effective workloads in the cloud.

This section describes how the design principles and best practices of the Well-Architected Framework benefit this solution.

Operational excellence

This section describes how the principles and best practices of the operational excellence pillar benefit this solution.

  • The solution pushes metrics to CloudWatch to provide observability into the infrastructure, including Lambda functions, Step Functions, Amazon API Gateway, Amazon Simple Storage Service (Amazon S3) buckets, and the rest of the solution components.

  • AWS X-Ray traces are enabled for Step Functions and AWS AppSync. This helps you visualize the components of the state machine and analyze user requests as they travel through your AWS AppSync APIs to the underlying services, identify performance bottlenecks, and troubleshoot requests that resulted in an error.

Security

This section describes how the principles and best practices of the security pillar benefit this solution.

  • The web UI users are authenticated and authorized with Amazon Cognito.

  • All inter-service communications use AWS Identity and Access Management (IAM) roles.

  • All multi-account communications use IAM roles.

  • All IAM roles used by the solution follow least-privilege access. In other words, they only contain minimum permissions required so that the service can function properly.

  • The access token obtained from Amazon Cognito is used to authorize application programming interface (API) calls.

  • All data storage, such as S3 buckets and DynamoDB tables, have encryption at rest.

  • AWS WAF protects the web UI and APIs from attacks using solution-configured web access control lists (ACLs).

The solution creates CloudFront distribution with the Default CloudFront SSL Certificate which allows TLS 1.1 and TLS 1.0. We recommend using Custom SSL Certificate with TLSv1.2_2021 security policy to disallow insecure protocols and cipher suites.

Reliability

This section describes how the principles and best practices of the reliability pillar benefit this solution.

  • The solution uses serverless AWS services wherever possible (such as Lambda, AWS AppSync, Amazon S3, and Step Functions) to ensure high availability and recovery from service failure.

  • AWS protects the solution against definition errors of state machines leveraged by Step Functions by running automated tests on the solution.

  • Data processing uses Lambda functions. The solution stores data in DynamoDB and Amazon S3, so it persists in multiple Availability Zones by default.

Performance efficiency

This section describes how the principles and best practices of the performance efficiency pillar benefit this solution.

  • The solution uses serverless architecture. For additional details, refer to Reliability.

  • The solution uses error handling in Step Functions to run concurrent state machine executions that add or remove multiple subnets in the VPC-TGW attachment. This allows you to create VPC and related resources in parallel using CloudFormation stack.

  • You can launch the solution in any AWS Region that supports the AWS services used in this solution (such as Lambda, API Gateway, Amazon S3, Step Functions, Amazon Cognito, Amazon CloudFront, and AWS WAF). You can also choose not to deploy the web UI if CloudFront and Amazon Cognito aren’t supported in the Region. Refer to Supported AWS Regions.

  • AWS automatically tests and deploys the solution daily. Our solution architects and subject matter experts review the solution for areas to experiment and improve.

Cost optimization

This section describes how the principles and best practices of the cost optimization pillar benefit this solution.

  • The solution uses serverless architecture (for example, Step Functions and DynamoDB) to minimize the cost of unused compute infrastructure, and customers pay only for what they use.

  • The compute layer defaults to Lambda, which uses a pay-per-use model.

Sustainability

This section describes how the principles and best practices of the sustainability pillar benefit this solution.

  • The solution uses managed and serverless services to minimize the environmental impact of the backend services.

  • The solution’s serverless design is aimed at reducing carbon footprint compared to the footprint of continually operating on-premises servers.

  • The web UI allows users to select scan parameters to perform selective scans in specific AWS accounts, Regions, and services.