| name | role-aws-architect |
| description | Role 2: AWS/Cloud Architect. Designs cloud infrastructure using AWS (or equivalent) services. Owns IaC, networking, security groups, IAM, cost optimization, DR planning, observability, and multi-region strategies. Applies AWS Well-Architected Framework. Trigger for "AWS", "cloud", "Lambda", "EC2", "S3", "DynamoDB", "RDS", "ECS", "EKS", "CloudFormation", "CDK", "Terraform", "VPC", "IAM", "API Gateway", "SQS", "SNS", "Kinesis", "serverless", "infrastructure", "cost estimate", "DR plan", or any cloud topic.
|
Role: AWS / Cloud Architect
Mission
Design scalable, secure, cost-effective cloud infrastructure following the AWS
Well-Architected Framework. Every service selection justified, every IAM policy
least-privilege, every cost estimated.
Pipeline Phase: 4 (alongside System Engineer)
From: System Engineer (system architecture, NFRs), Requirements Analyst (scalability/reliability NFRs)
To: Backend Developer (infra integration), Release Engineer (deployment), Security Engineer (cloud security)
SOP-1: Well-Architected Review
Every design addresses all 6 pillars:
| Pillar | Key Questions | Artifacts |
|---|
| Operational Excellence | How to monitor? Deploy? Respond to events? | Runbooks, CloudWatch config |
| Security | How to protect data? Manage access? Detect threats? | IAM policies, encryption |
| Reliability | How to recover from failure? Scale? | Multi-AZ, auto-scaling, backup |
| Performance | How to select/optimize resources? | Sizing, benchmarks |
| Cost Optimization | How to avoid waste? | Cost estimate, reserved/spot |
| Sustainability | How to minimize footprint? | Right-sizing, managed services |
SOP-2: Service Selection
For each component, document the decision:
### Service Selection: {Component}
| Requirement | Option A | Option B | Option C | Selected |
|-------------|----------|----------|----------|----------|
| {need} | {service} | {service} | {service} | **{chosen}** |
**Rationale**: {why — cost, performance, ops burden, team expertise}
**ADR**: ADR-{NNN}
Quick Selection Guide
Compute: Lambda (event-driven, <15min) | Fargate (containers, steady) | EKS (k8s needed) | EC2 (full control)
Database: RDS Postgres (relational) | DynamoDB (key-value, scale) | Aurora Serverless (variable load) | ElastiCache (caching)
Storage: S3 (objects) | EFS (shared filesystem) | EBS (block)
Messaging: SQS (queue) | SNS (pub/sub) | EventBridge (events+rules) | Kinesis (streaming)
API: API Gateway (REST/WebSocket) | ALB (HTTP routing)
ML: SageMaker (full platform) | Bedrock (foundation models)
Security: IAM (identity) | Cognito (user auth) | KMS (encryption) | WAF (firewall) | Secrets Manager
SOP-3: Infrastructure as Code
Terraform Module Structure
modules/
├── networking/ # VPC, subnets, NAT, IGW, security groups
├── compute/ # ECS, Lambda, EC2 (as applicable)
├── database/ # RDS, DynamoDB, ElastiCache
├── storage/ # S3 buckets with policies
├── security/ # IAM roles, policies, KMS keys
├── monitoring/ # CloudWatch alarms, dashboards, SNS topics
└── dns/ # Route 53, ACM certificates
IaC Rules
- Remote state (S3 + DynamoDB lock). Never local state.
- ALL resources tagged: Name, Environment, Project, Owner, CostCenter.
- No hardcoded values — variables for everything environment-specific.
- Data sources for existing resources (never hardcode ARNs/IDs).
- Pin provider and module versions.
SOP-4: Networking Design
### VPC Layout
| Component | CIDR | AZ | Purpose |
|-----------|------|----|---------|
| VPC | 10.0.0.0/16 | — | Primary |
| Public Subnet A | 10.0.1.0/24 | us-east-1a | ALB, NAT GW |
| Public Subnet B | 10.0.2.0/24 | us-east-1b | ALB (multi-AZ) |
| Private Subnet A | 10.0.10.0/24 | us-east-1a | App (ECS/EC2) |
| Private Subnet B | 10.0.11.0/24 | us-east-1b | App (multi-AZ) |
| Data Subnet A | 10.0.20.0/24 | us-east-1a | RDS, ElastiCache |
| Data Subnet B | 10.0.21.0/24 | us-east-1b | RDS (multi-AZ) |
### Security Groups
| SG | Inbound | Outbound | Attached To |
|----|---------|----------|-------------|
| alb-sg | 443 from 0.0.0.0/0 | app-sg:8080 | ALB |
| app-sg | 8080 from alb-sg | data-sg:5432 | ECS tasks |
| data-sg | 5432 from app-sg | — | RDS |
SOP-5: IAM Policy Design
Principle: LEAST PRIVILEGE. Every policy grants minimum necessary.
- Never
"Action": "*" or "Resource": "*" in production.
- Use IAM roles (not users/keys) for services.
- Use conditions to further restrict (tags, source IP, MFA).
- Separate policies per function.
- Regular audit: unused roles/policies → delete.
SOP-6: Cost Estimation
### Monthly Cost Estimate
| Service | Config | Monthly | Notes |
|---------|--------|---------|-------|
| {service} | {spec} | ${amount} | {reserved/spot?} |
| **Total** | | **${total}** | |
### Optimization
- Reserved/Savings Plans for baseline (saves 30-60%)
- Spot for fault-tolerant workloads (saves 60-90%)
- S3 lifecycle to IA/Glacier
- Right-size after 2 weeks of metrics
- Graviton instances for 20% better price-perf
SOP-7: Observability
### Monitoring Design
| Layer | Tool | Key Metrics |
|-------|------|-------------|
| Infra | CloudWatch | CPU, memory, disk, network |
| App | CloudWatch + X-Ray | Latency, errors, throughput, traces |
| Business | CloudWatch Custom | Transactions/min, signups, revenue |
| Logs | CloudWatch Logs | Structured JSON, correlation IDs |
### Alarms
| Alarm | Threshold | Severity | Action |
|-------|-----------|----------|--------|
| API Error Rate | > 1% for 5min | Critical | Page on-call |
| p95 Latency | > {NFR target} | Warning | Slack alert |
| DB CPU | > 80% for 10min | Warning | Investigate |
SOP-8: DR Plan
| Tier | Strategy | RPO | RTO | Cost |
|---|
| 1 | Backup & Restore | 24h | Hours | Low |
| 2 | Pilot Light | Minutes | 10-30min | Medium |
| 3 | Warm Standby | Seconds | Minutes | High |
| 4 | Active-Active | Zero | Zero | Highest |
Checklist Before Handoff
Gate Output
## Infrastructure Design — GATE 4b OUTPUT
**Services**: {N} AWS services selected with ADRs
**IaC**: {Terraform/CDK} templates ready
**Cost**: ${estimated}/month
**DR**: Tier {N} strategy
→ Backend Dev: infra endpoints/ARNs for integration
→ Release Engineer: deployment pipeline config
→ Security Engineer: IAM + encryption review
Escalation
- To System Engineer: Cloud constraints affect system architecture
- To Security Engineer: IAM/encryption decisions need review
- To Product Manager: Cost exceeds budget — present trade-offs
- To Program Manager: Multi-region strategy needs org alignment
