Use AWS Solutions Architect Prover with your AI.

Validate aws architecture

The order is non-negotiable. most AWS failures come from executing these steps out of sequence. You must: (1) QUANTIFY REQUIREMENTS. extract concrete numbers. RPS peak and sustained, p50/p95/p99 latency in ms, availability SLO as 9s (99.9%, 99.95%, 99.99%), RTO in minutes, RPO in minutes, data volume in GB and growth rate, user count, compliance scope (PCI-DSS, HIPAA, SOC2). "Scalable" and "high-performance" are marketing words, not requirements, (2) MAP BLAST RADIUS. name what fails at every AWS scope level. AZ failure: how does the workload survive one AZ going dark? Region failure: what is the multi-region strategy and does the SLO justify it? Account failure: is production isolated in a dedicated account for blast radius bounding? Service failure: what happens when SQS is throttled or KMS is unavailable? "AWS handles it" is not a map, (3) MINIMIZE SERVICES. the best AWS service is no AWS service. For every service in your architecture, name the AWS alternative you REJECTED and the concrete reason. Fargate over EKS (control plane cost, ops burden), SQS over Kinesis (no replay > 24h need), Aurora over DynamoDB (relational needs). Reject Kafka on MSK unless you can name the ordering guarantee, throughput, or ecosystem capability that SQS cannot provide, (4) CALCULATE REAL TCO. itemize the AWS invoice. Compute + storage + NAT Gateway ($32/mo + $0.045/GB) + cross-AZ transfer ($0.01/GB) + egress ($0.09/GB) + VPC endpoints ($22/mo per endpoint per AZ) + PIOPS + CloudWatch + support tier + ops burden in engineer-hours. "Serverless is cheap" is a slogan. At sustained load, Lambda + API Gateway + DynamoDB frequently exceeds Fargate + ALB + Aurora by 2-3x, (5) DESIGN SECURITY IN. Day 0, not Day 90. IAM roles for compute (never access keys), policies scoped to specific ARNs (never Resource: ""), aws:PrincipalTag and aws:ResourceTag condition keys, KMS CMK per data domain with rotation, S3 Block Public Access on every bucket, VPC endpoints for AWS service traffic, GuardDuty + Config + CloudTrail + Security Hub enabled on Day 0, Secrets Manager with automatic rotation, compliance conformance packs where scoped. If rejected, you violated the Algorithm sequence. Structured reflection capability that forces execution of the 5-Step AWS Well-Architected Algorithm before validating any AWS cloud architecture decision. The algorithm must be executed IN ORDER. skipping steps is the most common failure. Catches Requirement Hallucination (accepting vague terms like "scalable", "high performance", "cloud-native" without extracting concrete SLIs, SLOs, RTO, or RPO. a senior architect never chooses a service before quantifying the numbers), Blast Radius Ignorance (proposing multi-region for a 200-user internal capability or single-AZ for a payment system. multi-AZ meets 99.95%, multi-region needs a business case like data residency or 99.99%+ SLO. "AWS handles it" is not a failure domain analysis), Service Sprawl (stacking Kinesis + MSK + EventBridge + SQS + SNS in the same architecture because the LLM cannot decide. a senior architect picks ONE messaging primitive matching volume, ordering, retention, and consumer model; ONE compute abstraction ordered from least operational burden (App Runner, Fargate) to most (EKS)), Cost Hallucination (calling Lambda "cheap" while ignoring API Gateway $3.50/M requests, DynamoDB WCU/RCU, VPC endpoints $22/mo per AZ, NAT Gateway $32/mo + $0.045/GB, cross-AZ $0.01/GB, egress $0.09/GB, and support tier. the TCO is the invoice, not the compute bill), and Security Afterthought (writing Resource: "", using access keys instead of IAM roles, deferring MFA and encryption to "later". Day 0 is when least-privilege IAM, KMS CMK rotation, VPC endpoints, GuardDuty, Config, and CloudTrail must exist, not Day 90). Call once per major AWS architectural decision