Real-world architectures
Exams test decisions in isolation; real systems combine them. Each architecture below is a common, production-proven pattern. For each, you get the flow, the reasoning, and the exam domains it exercises.
1. Highly available three-tier web application
Users → Route 53 → CloudFront (+WAF) → ALB (2 AZs, public subnets)
→ Auto Scaling group of EC2 / ECS on Fargate (private subnets, 2+ AZs)
→ Aurora MySQL (writer + reader in another AZ) via RDS Proxy
→ ElastiCache (sessions, hot data)
Static assets: S3 behind CloudFront (OAC) Outbound: NAT gateway per AZ
Why: no single point of failure; stateless app tier scales horizontally; caching reduces DB load; WAF/Shield at the edge. Exam domains: resilient (2.1, 2.2), secure (1.2), high-performing (3.2, 3.3). Cost tips: Savings Plans for baseline, Spot in the ASG for burst, gp3, Graviton.
2. Serverless REST API
Client → (CloudFront) → API Gateway (Cognito authorizer, throttling, usage plans)
→ Lambda functions → DynamoDB (on-demand)
→ S3 (files via pre-signed URLs)
Async work: Lambda → SQS → Lambda workers; Workflows: Step Functions
Observability: CloudWatch, X-Ray
Why: zero servers, pay per request, automatic scaling, minimal operations. Domains: least operational overhead (all domains), 2.1 serverless patterns, 4.2 cost.
3. Event-driven order processing
Checkout → API → SNS topic "OrderPlaced"
├─► SQS payments → Lambda (charge card) → DLQ on failure
├─► SQS inventory → ECS service (reserve stock)
├─► SQS shipping → Step Functions (fulfilment workflow)
└─► Data Firehose → S3 → Athena (analytics)
EventBridge: route OrderShipped events to email/notification services
Why: each service fails and scales independently; no orders lost; easy to add consumers. Domains: 2.1 loose coupling, event-driven design.
4. Data lake and analytics platform
Sources: apps (Kinesis/Firehose), databases (DMS), SaaS (AppFlow), files (DataSync)
→ S3 raw → Glue ETL (→ Parquet, partitioned) → S3 curated
→ Glue Data Catalog + Lake Formation permissions
→ Athena (ad-hoc), Redshift (BI warehouse, Spectrum), EMR (Spark), SageMaker (ML)
→ QuickSight dashboards
Why: cheap durable storage, separation of storage and compute, fine-grained governance. Domains: 3.5 ingestion and transformation, 1.3 data governance, 4.1 storage cost.
5. Global static website and media delivery
Route 53 (alias) → CloudFront (ACM cert in us-east-1, WAF, geo restriction, signed URLs for premium)
→ S3 origin (private, OAC), origin failover to a replica bucket (CRR)
Uploads: S3 Transfer Acceleration or pre-signed multipart uploads
Why: fast worldwide, cheap, resilient, private origin. Domains: 3.4 network performance, 4.4 network cost, 1.3 data security.
6. Hybrid enterprise network
Data centre ── Direct Connect (2 locations) ──► Direct Connect gateway ─► Transit Gateway
└─ Site-to-Site VPN (backup) ─────────────────────────────► │
Transit Gateway ⇄ shared-services VPC, prod VPCs, non-prod VPCs (separate route tables)
Route 53 Resolver inbound/outbound endpoints for hybrid DNS
Storage Gateway / DataSync for file data; AD Connector for identity
Why: scalable hub-and-spoke, resilient private connectivity, isolation between environments. Domains: 1.2 secure connections, 3.4 network topology, 4.4 connectivity cost.
7. Multi-Region disaster recovery (warm standby)
Primary Region: full stack (ALB, ASG, Aurora Global Database primary, S3)
DR Region: scaled-down ALB + ASG (min capacity), Aurora secondary cluster, S3 CRR target
Route 53 failover (or Global Accelerator) with health checks
CloudFormation/StackSets keep both Regions identical; quotas pre-raised in DR Region
Failover: promote Aurora secondary → scale ASG up → traffic shifts
Why: recovery in minutes without paying for full duplicate capacity. Domains: 2.2 DR strategies, RPO/RTO, immutable infrastructure.
8. Intelligent document processing
Documents uploaded (web via pre-signed URL, email, SFTP via Transfer Family) → S3
→ EventBridge → Step Functions:
Textract (extract fields/tables) → Comprehend (classify, detect PII)
→ confidence check → low confidence? → human review queue
→ store results in DynamoDB, originals archived with lifecycle → Glacier
Notifications via SNS; dashboards in QuickSight
Why: managed AI services replace custom models; serverless orchestration with human-in-the-loop. Domains: 2.1 purpose-built services, workflow orchestration, 4.1 lifecycle cost.
Building them yourself
The best preparation for both the exam and real work is to build two or three of these in a sandbox account with infrastructure as code, then break things deliberately (stop an instance, fail over the database, block an AZ's subnets) and watch them recover.
In an architecture interview, walk through one of these designs using the four domains as headings: how it's secured, how it survives failures, how it performs at scale, and how it's kept cost-efficient.
Senior Full-Stack Engineer · AI & AWS. I design and run production systems on AWS — serverless, data and AI.