Well-Architected and global infrastructure
The exam validates designs against the AWS Well-Architected Framework, so this topic underpins all four domains. Global infrastructure and shared responsibility are named in Task 1.1 (Domain 1, 30%) and Task 2.2 (Domain 2, 26%).
The framework
AWS Well-Architected Framework
A set of design principles, best practices and questions for building secure, reliable, efficient, cost-effective and sustainable workloads. A review is a conversation about trade-offs, not an audit.
Key points
- 6 pillars: operational excellence, security, reliability, performance efficiency, cost optimization and sustainability.
- Each pillar has design principles, best practices, questions and a dedicated whitepaper.
- Trade-offs: improving one pillar often costs another, e.g. a multi-Region active/active design raises reliability and cost together.
- Lenses extend the framework for specific workloads, such as serverless or SaaS.
On the exam
The four exam domains are four pillars. Operational excellence and sustainability have no domain of their own, but show up as qualifiers such as "least operational overhead".
Pillars and exam domains
| Pillar | Where it shows up |
|---|---|
| Security | Domain 1, Design Secure Architectures (30%) |
| Reliability | Domain 2, Design Resilient Architectures (26%) |
| Performance efficiency | Domain 3, Design High-Performing Architectures (24%) |
| Cost optimization | Domain 4, Design Cost-Optimized Architectures (20%) |
| Operational excellence | No domain of its own. Appears as "least operational overhead", automation and managed services. |
| Sustainability | No domain of its own. Overlaps with rightsizing, high utilization and managed services. |
The design principles behind Domains 1 and 2. Most correct answers in those domains apply one of them.
Key points
- Strong identity foundation: least privilege, separation of duties, centralized identity and no long-term static credentials.
- Security at all layers and traceability: defense in depth from the edge to the code, with every action logged and alarmed.
- Protect data in transit and at rest and keep people away from data: encryption, tokenization and automation instead of manual access.
- Reliability (principles): automatically recover from failure, test recovery procedures, scale horizontally, stop guessing capacity, manage change through automation.
- Scale horizontally: replace one large resource with several small ones so a single failure has less impact.
On the exam
Long-lived access keys on an instance lose to an IAM role. A single large instance loses to an Auto Scaling group across AZs. Both are these principles in answer form.
The design principles behind Domains 3 and 4: consume technology as a service, match it to the access pattern and pay only for what delivers value.
Key points
- Democratize advanced technologies: consume NoSQL, transcoding or ML as managed services instead of running them yourself.
- Go global in minutes, use serverless architectures, experiment more often.
- Mechanical sympathy: choose the database or storage by data access pattern, not by habit.
- Cost (principles): Cloud Financial Management, consumption model, measure overall efficiency, stop undifferentiated heavy lifting, analyze and attribute expenditure.
- Consumption model: stopping dev and test resources outside a 40 hour work week saves about 75% (40 versus 168 hours).
On the exam
"Key-value lookups at any scale" is mechanical sympathy pointing to DynamoDB, not a bigger relational instance. "Environments idle at night" is the consumption model: schedule them off.
The two pillars without their own domain. They still decide many answers through automation, managed services and utilization.
Key points
- Operational excellence: organize teams around business outcomes, implement observability, safely automate, make frequent small reversible changes.
- Also: refine procedures often, anticipate failure, learn from all operational events and use managed services.
- Sustainability (principles): understand your impact, set goals, maximize utilization, adopt more efficient hardware and software, use managed services, reduce downstream impact.
- Maximize utilization: 2 hosts at 30% are less efficient than 1 host at 60%, because each host has baseline power draw.
On the exam
Infrastructure as code with small, reversible deployments is the operational excellence answer. Rightsizing and S3 Lifecycle to colder tiers serve both sustainability and cost.
A Region is a separate geographic area, isolated from the others. Each Region has at least 3 Availability Zones, each made of one or more discrete data centers.
Key points
- Region choice: compliance and data residency, latency to users, service availability and price.
- No automatic copy: some resources can be replicated across Regions, but AWS never does it for you.
- AZs have redundant power, networking and connectivity, sit many kilometers apart but within 100 km (60 miles), and are linked by low-latency networking that supports synchronous replication.
- Opt-in Regions: Regions launched after March 20, 2019 must be enabled before use.
- AZ ID (e.g.
use1-az1) is the same physical zone in every account. In the oldest Regions, the AZ name (e.g.us-east-1a) may map to different zones in accounts created before November 2025.
On the exam
"Survive the loss of a data center" means multi-AZ. "Survive the loss of a Region" or "regulator requires another geography" means multi-Region, which costs more. To align zones across accounts, use the AZ ID.
Infrastructure outside the Region core: edge locations for content and traffic, and zones or racks that bring AWS closer to users or into your data center.
Key points
- Edge locations: CloudFront points of presence cache content close to viewers. Regional edge caches sit between them and the origin and keep less popular objects longer (how it works).
- AWS Global Accelerator: 2 static anycast IPv4 addresses for TCP or UDP that bring traffic onto the AWS global network at the nearest edge, with health-based failover across Regions.
- Local Zones: an extension of a Region in a metro area. Enable it, create a subnet there and run latency-sensitive workloads or meet local data residency (guide).
- Wavelength Zones: AWS compute and storage inside the 5G networks of telecom carriers, reached through a carrier gateway (guide).
- AWS Outposts: AWS-managed racks (42U) or servers (1U or 2U) on your premises, an extension of an AZ and its Region for low latency, local processing and data residency (guide).
On the exam
"Single-digit millisecond latency to an on-premises system" or "data must stay in our facility" is Outposts. "Users in a metro without a Region" is Local Zones. "5G mobile devices" is Wavelength. "Static IP and TCP/UDP acceleration" is Global Accelerator, not CloudFront.
Well-Architected Tool
AWS Well-Architected Tool
A console service, at no additional charge, for reviewing a workload against the framework, recording decisions and tracking improvements.
Key points
- Workload review: answer the pillar questions and get identified risks, high and medium (HRIs and MRIs), plus an improvement plan.
- Lenses (guide): the Well-Architected Framework Lens is applied automatically. Add Lens Catalog lenses from AWS or your own custom lenses.
- Milestones: record the state of a workload at a point in time to measure progress.
- Integrations: AWS Trusted Advisor and AWS Service Catalog AppRegistry help answer review questions.
On the exam
"Review a workload against AWS best practices and track remediation over time" is the Well-Architected Tool. Trusted Advisor checks the account for specific issues, it does not run the architecture review.