Provisioning
For provisioning, AWS CloudFormation is the native service. Third‑party tools such as Terraform remain popular, and the AWS Cloud Development Kit (CDK) provides code-first abstractions that synthesize to CloudFormation templates.
- CloudFormation is an AWS‑managed control plane for provisioning stacks. AWS operates the service as highly available; there are few knobs to adjust CloudFormation’s own availability.
- Protect stacks by using stack-level controls such as change sets, stack policies, termination protection, and drift detection.
- Your reliability work is in template and resource design: encode retries where supported, design safe update strategies (blue/green, canary, or resource replacement strategies), and plan cross‑stack failover patterns.
- The CDK (v2) is a code abstraction that synthesizes CloudFormation templates. It does not change service-level reliability of the provisioning service, but CDK constructs can help you encode safer deployment patterns in code.
Observability and Monitoring
Observability services — CloudWatch, X-Ray, Amazon Managed Service for Prometheus, Amazon Managed Grafana, and the Personal Health Dashboard — are provided as highly managed services. AWS builds these services to be available and resilient because customers depend on them for detection and troubleshooting. CloudWatch- CloudWatch supplies metrics, logs, alarms, Events/EventBridge, and application monitoring capabilities.
- You can’t harden CloudWatch itself; instead design your monitoring architecture: metric collection, dashboarding, retention policies, alarm thresholds, and escalation/runbooks.
- The Personal Health Dashboard (PHD) provides AWS operational events that affect your resources. It’s a managed status board you consume — not a service you operate for availability.
- Amazon Managed Service for Prometheus and Amazon Managed Grafana are serverless/managed observability offerings: they autoscale and autoheal with no servers for you to manage.
- Your design focus is on how telemetry gets to them (agents, OpenTelemetry, VPC endpoints), retention and query strategies, dashboard lifecycle, and alert routing.
Exam-style example: if you’re migrating an on‑premises monitoring stack and want a single pane of glass with managed scaling, Amazon Managed Grafana is a suitable choice.
Advisory and Best‑Practice Tools
Advisory services and recommendations help you identify reliability gaps — they don’t require you to harden the advisory service itself. Trusted Advisor- Provides checks across Cost Optimization, Security, Fault Tolerance, and Performance.
- Full checks require Business or Enterprise support plans. Use Trusted Advisor recommendations to prioritize reliability and operational improvements.
- Launch Wizard provisions best-practice topologies for complex workloads (SAP, Microsoft, etc.). It helps deploy resilient architectures, but the wizard itself is a managed provisioning aid.
- Recommends sizing and instance type changes for EC2, Lambda, EBS, and more to avoid under/over‑provisioning. Use recommendations to improve cost, performance, and indirectly reliability.
Account Management and Guardrails
Use multi‑account patterns and guardrails to improve isolation, blast radius reduction, and consistent governance.- AWS Organizations provides account grouping and Service Control Policies (SCPs) to enforce permissions across accounts.
- AWS Control Tower implements account baselines, guardrails, centralized logging, and auditing to create a consistent, safer account structure.
- AWS Systems Manager provides operational tooling (Inventory, Patch Manager, State Manager, Session Manager, Fleet Manager) for EC2 and hybrid environments.
- The service is managed by AWS for availability; you define runbooks, patch cadences, automation documents, and compliance checks to meet reliability objectives.
Service Catalog, License Manager, Proton, and Management Utilities
Service Catalog- Manage and distribute approved product portfolios (CloudFormation templates, etc.) across your organization to enforce standard patterns and reduce configuration drift.
- Centralizes license tracking and can enforce license-based restrictions on launches. The service is managed; focus on policy enforcement and compliance.
- Proton enforces infrastructure best practices for container and serverless applications via templates. Model reliability behavior (backups, CI/CD, rollback strategies) inside Proton templates rather than changing Proton itself.
- Tag Editor, Resource Explorer, Resource Groups, and Resource Access Manager improve visibility and shareability across accounts and regions; their availability is managed by AWS.
- Resilience Hub ingests architecture, recovery plans, and testing policies to evaluate and improve application resilience. It surfaces gaps, but much of the input (architecture, RTO/RPO expectations, and recovery actions) comes from you.
Summary
Most AWS management and governance services are highly managed: they autoscale, autoheal, and emit metrics. There are few or no service-level “reliability knobs” for you to turn inside these services. Instead, concentrate on:- Designing resilient resources and architectures (multi‑AZ, multi‑Region, redundancy, backups, health checks).
- Ensuring observability and automation (metrics, logs, alarms, runbooks, incident escalation).
- Using advisory tools (Trusted Advisor, Compute Optimizer, Resilience Hub) to identify gaps and prioritize improvements.
Most management and governance services are intentionally invisible from a resilience standpoint — they are already highly available. Focus on designing the resources and operational processes (monitoring, backups, failover, and runbooks) that depend on these services.