AWS Well-Architected Framework
AWS Well-Architected helps cloud architects build secure, high-performing, resilient, and efficient infrastructure for their applications and workloads. Based on six pillars — operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability — AWS Well-Architected provides a consistent approach for customers and partners to evaluate architectures, and implement designs that can scale over time.
Recent questions
see all1 / 18
- I am unable to create a new Amazon CloudFront distribution because AWS shows the following message: “Your account must be verified before you can add new CloudFront resources.” However, my AWS account...
- ### Background We run an Aurora Serverless v2 cluster (MySQL 8.4, single writer instance, no reader) in eu-west-1 consolidating 13 schemas. The cluster serves a mix of ECS Fargate applications and tw...
asked 12 days ago
- I run an ops agent built on Strands. It reads on a read-only role and changes things only by opening a pull request against our GitOps repository. The problem: the agent's own credential can open that...
- We want one Amazon Bedrock AgentCore Runtime, a Strands agent with Knowledge Base search and per-user AgentCore Memory, shared by several tenants. Logged-in users call it from each tenant's web fronte...
- Hello AWS Team, I need urgent assistance regarding unauthorized third-party usage on my account that occurred on September 1st (Claude Opus services). I fully remediated the account on the same day ...
- **Starting a new backend process costs ~27 ms of CPU on RDS PG 17.11, versus ~4.5 ms on 14.19.** Because PostgreSQL forks one process per connection, and our API opens 40–120 new connections/second, t...
- Hello AWS Community and Support Team, I am requesting urgent assistance to escalate an active support case regarding a severe account compromise on child account. Summary of the Incident: - Incident...
- I have a Compute Savings Plan that is approaching its expiration date, and I want to renew it. However, our infrastructure needs have changed, so I need to change our hourly commitment amount for the ...
- The project is in initial phase, where have to work in DR strategy and implementation, could you please suggest what questions we have to ask from customer to right align on the expectations and get t...
- We suspect inter-AZ communication between pods is causing this traffic leak. While we've looked into implementing topology-aware routing, we are concerned about uneven load distribution on our nodes. ...
- ## Ask Add `qwen.qwen3-coder-480b-a35b-v1:0` to the Bedrock prompt-caching supported-models list (both Converse API `cachePoint` and Messages API equivalent). Ideally extend to other non-Anthropic, no...
- I recently deployed a small word puzzle project using Amazon S3 static hosting. The site loads fine, but I’ve noticed slower performance for users in different regions. For reference, this is the pro...
- Hi all, We are currently experiencing a situation where a single external IP address is continuously sending a very high volume of requests (tens of thousands per minute) to our application behind Am...
- **IAM Identity Center Application Inconsistency After Account Reactivation** I'm experiencing an inconsistency with IAM Identity Center applications after my account was suspended and then reactivate...
- We have multiple AWS accounts across several regions and over time a number of VPC Endpoints ( Interface types) have been created for various services. We suspect many of these endpoints are no longer...
- Service: Amazon EKS Category: Security / Vulnerability ...
- I work in a cloud lab rental company that provides temporary AWS environments for students to practice and learn. We use AWS Control Tower for multi-account management with the following architecture:...
- Hello! Sorry, I know this is probably a common question, but none of the current content reflects my situation. Anyway, I am using Cognito. My Accounts are fully passwordless, with no option built-i...
Recent articles
see all1 / 18
SwaathiEXPERT
published 5 days ago2 votes80 views
Developers automating the AWS Identity Store often can't tell whether an AccessDeniedException is an IAM policy issue or a customer managed key failure. This article shows how to use the exception's R...KayoEXPERT
published 9 days ago0 votes100 views
AWS may ask you to verify your identity when you request access to certain products, features, or programs. We only use your verification data to confirm who you are. If you choose not to verify your ...Ankit SrivastavaEXPERT
published 15 days ago0 votes82 views
AWS Regions grow over time as new Availability Zones are added. If your Terraform configuration reads the Region’s Availability Zone list dynamically and passes it directly into a database resource, t...jdparsoEXPERT
published 16 days ago0 votes97 views
Many workloads still run Provisioned IOPS SSD (io2) EBS volumes chosen years ago, before gp3 existed. Because io2 bills for every provisioned IOPS on top of storage, a volume provisioned far above its...jdparsoEXPERT
published 16 days ago0 votes94 views
Amazon CloudWatch cost can grow quietly into a large share of the bill, and the drivers are rarely obvious: high-volume metric API requests, too many custom metrics, or verbose log ingestion, often fr...Rosa LlorenteEXPERT
published a month ago0 votes129 views
Centralized traffic inspection with Transit Gateway and Network Firewall often inspects far more than necessary, and per-GB charges dominate at scale. This post shows how three Transit Gateway feature...Dubey, ShubhenduEXPERT
published a month ago0 votes147 views
AWS Agent Registry is now generally available, but most teams meet it mid-sprawl: dozens of agents and MCP tools scattered across accounts, with no shared inventory, no cross-team discovery, and no au...Fernandes Costa, JorgeEXPERT
published 2 months ago0 votes268 views
Most media customers deploy MediaLive with default ABR rendition ladders without visibility into which renditions viewers actually consume. This article provides a complete, deployable solution to ana...H_ShahEXPERT
published 2 months ago4 votes219 views
This article presents a cost-optimization pattern using a dedicated AWS Direct Connect gateway with private virtual interfaces to bypass Transit Gateway for bulk storage traffic, while preserving the ...Nita_SEXPERT
published 2 months ago0 votes204 views
This article provides best practices for designing and operating Amazon Redshift workloads aligned with the AWS Well-Architected Framework. It helps architects and data engineers make informed decisio...Nikhil BhagatEXPERT
published 2 months ago0 votes344 views
This article compares the costs of seven common AWS networking architecture patterns against Amazon VPC Lattice alternatives. Each comparison includes detailed cost breakdowns with public pricing assu...ShravanEXPERT
published 2 months ago0 votes237 views
Organizations adopting Amazon Bedrock at scale struggle to attribute model-invocation costs to specific teams, detect LLM-native anomalies like tool-call loops, and investigate spend spikes fast enoug...Derek ZiehlEXPERT
published 2 months ago1 votes150 views
Customers evaluating the CloudFront Security Savings Bundle often ask whether activating mid-month means losing the discount on usage already incurred that month, or whether they should wait until the...Alexandre CarlimEXPERT
published 2 months ago2 votes173 views
If you're building an application that calls MCP (Model Context Protocol) servers — say, an AI-powered support portal or an agentic workflow — you've probably hit HTTP 429 errors when traffic spikes. ...Tirth ParekhEXPERT
published 3 months ago1 votes369 views
Compare AWS WAF AntiDDoS managed rule group (AMR) vs Shield Advanced for Layer 7 DDoS protection. Includes a capability-based decision framework, architecture recommendations, and migration guidance- AWS OFFICIALUpdated 3 months ago0 votes440 viewsThis article outlines best practices for managing Reserved Instances (RI) and AWS Savings Plans commitments during AWS Organizations consolidations. It explains how to avoid costly billing gaps and us...
AneeshEXPERT
published 3 months ago1 votes427 views
Identify and eliminate hidden cost drivers in high-volume Amazon Bedrock workloads using four data-driven optimization levers.Sagar GandhaEXPERT
published 3 months ago0 votes346 views
AWS DevOps Agent charges per agent-second with no built-in spending cap or alert mechanism. This article walks through setting up a CloudWatch metric math alarm that sums daily consumption across all ...
Recent selections
see all1 / 5
Benjamin LecoqEXPERT
published 3 years ago9 votes17.5K views
Re:invent 2024 takes place in Las Vegas (Nevada) from Monday 12/02 to Friday 12/06. This selection will focus on cost optimization related announcementsJonathan_DEXPERT
published 3 years ago4 votes12.6K views
Do you have critical workloads running in AWS? Review these handpicked resources to find ways to ensure your applications are resilient to failures.- AWS OFFICIALUpdated 3 years ago0 votes157 viewsDo you want to monitor your Amazon WorkSpaces usage and optimize your costs? Deploy Cost Optimizer for Amazon WorkSpaces to review your WorkSpaces usage and manage costs.
- AWS OFFICIALUpdated 3 years ago0 votes146 viewsThis selection includes content and solutions supporting FSI related compliance and requirements covering security, immutable storage, and general guidance.
- AWS OFFICIALUpdated 3 years ago0 votes364 viewsAs a best practice, AWS recommends that you use AWS Identity and Access Management (IAM) roles instead of IAM users with long-term credentials such as access keys.
1 / 18
Riku_Kobayashi
EXPERTGary Mclean
EXPERTAntonio Lagrotteria
EXPERTOleksii Bebych
EXPERTOsvaldo Marte
EXPERTSedat SALMAN
EXPERTAdeleke Adebowale .J.
EXPERTShahed Kazi (@shajam)
EXPERTTushar Jagdale
EXPERTMatt Barbieri
EXPERTAWS-User-alantam
EXPERTIndranil Banerjee AWS
EXPERTGK
EXPERTGunasekaran, Makendran
EXPERTGarre Sandeep
EXPERTThanniru Anil Kumar
EXPERTMax Clements
EXPERT
