Amazon CloudWatch stores all logs and metrics from all the services used in this architecture. CloudWatch can also ingest information from customer code running in Amazon ECS. This Guidance is designed to provide the information necessary to understand its internal state (for example, metrics, logs, events, and traces) across all components for observability. It also captures changes in state, user activity, and access privileges to monitor the health of the workload, identify when outcomes are at risk, and enable effective responses.

AWS Identity and Access Management (IAM) policies control services interactions. Policies and roles are granted the least amount of permissions required for the application to operate. IAM policies and roles limit unauthorized access to services so that a malicious actor, misconfiguration, or bug cannot expose user data or impact application operations. AWS WAF blocks malicious actors from accessing the authentication layer hosted on Amazon Cognito. It protects the web application from a known list of offending IP addresses. AWS Key Management Service (AWS KMS) keys encrypt Aurora and Amazon Redshift data in transit using TLS 1.2 or higher so that malicious actors cannot read confidential information.

AWS Amplify allows a modern application (integrated into a development pipeline) to work reliably and at scale because it embeds a content delivery network (CDN). This Guidance describes an application that may be accessed simultaneously by thousands of users. In case of load spikes or technical issues on edge nodes or the origin, Amplify redirects traffic, scales its capacity, and caches original content, allowing the application to serve traffic steadily at all hours of the day. While Amplify reliably serves static content, API Gateway serves dynamic content to users, using caching and throttling to not overwhelm the backend.

Additionally, Aurora replicates data across different Availability Zones and supports automated failover for minimal service interruption. Aurora also provides automated backups that you can use to restore application functionality in case of human errors or malfunctions.

Aurora delivers significant PostgreSQL performance by tightly integrating the database engine with an SSD-based virtualized storage layer purpose-built for database workloads, reducing writes to the storage system, minimizing lock contention, and eliminating delays created by the database process thread. Aurora features a storage system that delivers high performance, availability, and performance, and this storage can be increased for up to 15 low-latency read replicas.

Additionally, Amplify CDN can improve performance for remote users by distributing and caching requests. API Gateway scales automatically to support traffic spikes and can cache requests to accelerate the requests and reduce load on the database. 

There are no minimum fees or upfront commitments for using Amplify, API Gateway, Step Functions, or Amazon ECS. Amazon ECS can run containers without having to provision or manage Amazon Elastic Compute Cloud (Amazon EC2) instances. Amazon ECS supports auto scaling and can also use Amazon EC2 Spot Instances to achieve a significant cost reduction without sacrificing performance. Aurora offers an I/O optimized configuration that can be useful if the database is under a sustained heavy I/O load, as it offers zero charges for read and write I/O operations.

Amazon ECS allows customer to fine tune container requirements, avoiding provisioning for peak times. Amazon ECS and Aurora also support AWS Graviton processors for the underlying clusters. AWS Graviton processors offer the best price performance per watt of energy, and latest generations of AWS Graviton processors use up to 60% less energy for the same performance.