Question Deconstructor

Aster Labs publishes a static documentation and marketing site: HTML, CSS, JavaScript, and about 900 product screenshots, held in one S3 bucket in eu-west-1. Readers open it from three continents, and the two-person platform team wants every asset answered by a cache close to the reader rather than the single Region. A security review closed with one rule: viewers may reach the site only through the CDN, and no browser request may read an object from the bucket itself.

Halide Health runs a stateless internal portal on one m5.large EC2 instance in eu-central-1a. When that Availability Zone lost power in March, the portal was dark for four hours while an engineer rebuilt it by hand from the release AMI. The platform lead wants the next outage absorbed by the platform: capacity must survive the loss of one Availability Zone, and a failed instance must be replaced with no page.

Corvid Analytics runs a 40-instance Spark fleet in the private subnets of a VPC in us-east-2, reading and writing multi-gigabyte Parquet objects in two S3 buckets all day. The VPC has no internet gateway today, and the platform security standard forbids adding one, a NAT device, or any other route to the public internet from those subnets. Finance has already flagged the data-transfer line, so the team wants no new hourly charges, and the thin on-call rota rules out another instance to patch.

Brightline Supply runs its order API on ECS, and each request writes the order straight into an RDS for PostgreSQL instance that downstream fulfilment and finance both read. During last month's flash sale arrivals jumped from 40 to 900 orders a second; the database saturated, API latency climbed, and about 3,000 checkout requests timed out and were never recorded. The platform lead wants arrival spikes held durably until the database can take them, and any order that keeps failing parked somewhere the on-call engineer can inspect rather than retried forever. Fulfilment and finance already query the relational order tables, so RDS must stay the system of record.

A media operations team runs a three-tier order portal on EC2 in a single Availability Zone; customer uploads are written to instance-local EBS volumes and a self-managed MySQL 8.0 server runs on a separate EC2 host. An Availability Zone impairment last quarter took the portal offline for four hours, and the team restored from the previous night's logical dump. The portal must survive the loss of one Availability Zone, database failover may lose no more than a few seconds of committed writes, and every web instance must read and write one shared upload directory. The team will not rewrite SQL statements or POSIX file paths, and multi-Region disaster recovery stays out of scope this budget cycle.

Pinebrook Freight runs a data account that owns the S3 bucket holding the curated shipment extract, and a separate analytics account whose EC2 reporting fleet rebuilds dashboards each night. The fleet needs read-only access to the curated/shipments/ prefix; the eleven other prefixes in the same bucket hold raw carrier invoices the analytics team is not cleared to open. The security lead adds two rules the design must respect: no long-lived access keys may exist in the analytics account, and no second copy of the extract may be stored outside the data account.

A claims-processing platform for a regional insurer runs entirely in one AWS Region on EC2, Amazon RDS, and Amazon S3, and it has to keep accepting claims through a complete Regional outage. The business has signed an RPO measured in seconds and an RTO measured in minutes, so the recovery Region has to answer live requests immediately rather than after a rebuild. Finance approved continuous database replication and a small standing footprint in the second Region, but not a second full-size production fleet running all day. The platform team already deploys with infrastructure as code and rehearses a failover every quarter, and it accepts that scaling the recovery Region up to full capacity is part of the cutover.

A logistics company runs shipment tracking on one Amazon RDS for PostgreSQL DB instance that also answers a fast-growing analyst reporting workload. Reporting queries now hold the instance above 90 percent CPU for most of the afternoon, tracking updates queue behind them, and the instance already runs on the largest class in its family. Reports may read data a few seconds behind the primary, but every insert and update has to keep landing on the primary, and the team cannot change the relational schema or the SQL the reports already run. A two-person platform team owns the database, so the change must ship in one sprint and must not add application code they then have to maintain.

Harbourline Marine streams telemetry from 400,000 hull sensors; each unit emits a reading every two seconds, and bursts during storm season triple the rate without warning. The diagnostics team needs the readings from a single sensor in the order they were emitted, because a pressure alarm only means something after the preceding temperature trend. Two applications must read the same feed at the same time without slowing each other: a live operations dashboard and a batch anomaly detector. After a detector bug is fixed the team must re-read the last seven days of readings, and the platform group wants whichever design adds the least operational overhead.

Vanth Insurance holds 80 TB of closed claim files that the business has not opened in two years and expects to open perhaps twice more before they age out. Compliance requires the files to stay retrievable for seven years from closure, after which they should disappear on their own. The auditor who does ask gives two weeks of notice, so a retrieval that takes hours rather than milliseconds is fine; finance simply wants the smallest possible storage bill.