Platform engineering, system design and infrastructure shape.
3 items at advanced level · all topics
A company uses AWS Organizations with all features enabled. For compliance reasons, workloads may only run in two approved AWS Regions. Account administrators in member accounts currently hold the AdministratorAccess policy. The company must prevent resources from being created in any other Region. What should a solutions architect do?
A service control policy is the only control that an account administrator cannot remove, because it caps what identities in a member account may do no matter what their IAM policies say. IAM policies and permissions boundaries can both be edited by the very administrators you are trying to constrain.
A company runs a business-critical application in one AWS Region. The disaster recovery plan requires a recovery time objective of 10 minutes and a recovery point objective of 1 minute in a second Region. The company wants to avoid paying for a full duplicate of the production fleet. Which disaster recovery strategy should a solutions architect choose?
RTO and RPO in minutes rule out backup and restore and pilot light, because both require standing infrastructure up before traffic can move. Warm standby keeps a scaled-down copy always running, which is what buys minutes instead of hours without paying for a second full fleet.
A multiplayer game server runs on Amazon EC2 instances behind Network Load Balancers in three AWS Regions. Players connect over UDP. The company needs to route each player to the lowest-latency healthy Region, to fail over within seconds if a Region becomes unhealthy, and to publish a fixed set of IP addresses that players' firewalls can allow. Which solution meets these requirements?
UDP, static IP addresses and fast regional failover all point at AWS Global Accelerator rather than CloudFront. Global Accelerator gives you anycast static IPs, carries traffic over the AWS backbone, and reroutes without waiting for DNS to expire anywhere.