Use templated answers to perform Well-Architected reviews at scale
AWS Architecture BlogUse templated answers to perform Well-Architected reviews at scaleby Thomas Attree and Paul Le Page | on06 JUN 2022| inArchitecture,AWS Well-Architected,AWS Well-Architected Framework,AWS Well-Architected Tool|Permalink|ShareFor larger customers, performingAWS Well-Architected (AWS WA) Frameworkreviews often involves a combination of different teams. Coordinating participants from each team in order to perform a review increases the time taken and is expensive. In a large organization, there are often hundreds of AWS accounts where teams can store review documents, which means there is no way to quickly identify risks or spot common issues or trends that could influence improvements.To address this, we created a solution to help you perform reviews easier and faster. It allows workload owners to automatically populate their reviews with templated answers to questions in theAWS Well-Architected Tool (AWS WA Tool). These answers may be a shared responsibility between an application team and a centralized team such as platform, security, or finance. This way, application teams have fewer questions to answer and centralized team members have fewer reviews to attend, because answers that are common to all workloads are pre-populated in workload reviews. The solution also provides centralized reporting to provide a centralized view of AWS WA reviews conducted across the organization.Perform Well-Architected reviews at scaleIn large organizations, responsibilities are often distributed across multiple teams, for example:A platform team manages anAWS Control Towerlanding zoneand provides accounts, access controls, and networking.A security team defines security policies for this solution and enforces them using guardrails or marketplace solutions.A financial operations team mandates a tagging policy to allow for accurate cost cross-charging within the business.Application teams developing internal or external facing applications use a shared platform provided by a Cloud Center of Excellence.To perform a traditional AWS WA review for this example, you would likely need to invite representatives from each of these teams to attend the review. This is because one team would be unlikely to be able to answer the foundational questions alone.With tens or hundreds of workloads being reviewed every year, this approach doesn’t scale. This is because representatives from central teams end up attending every review. With more people involved, scheduling reviews is difficult, the overall time required to conduct the review increases, and longer reviews with more people are more expensive to perform.Additionally, the review document is usually created and stored in one of the application team’s AWS accounts. In a large organization, there are often hundreds of AWS accounts. This makes it difficult for leadership to get a consolidated view of the risks identified across the reviews. It also makes it almost impossible to spot common issues or trends that could influence roadmaps for organization-wide improvements.Automatically populate templated answers for quicker, easier reviewsOur solution allows you to address these challenges by using the AWS WA Tool to create answer templates. An answer template looks like a regular AWS WA Tool workload review. However, these answers propagate automatically to application workload reviews and are visible by application workload owners during the review process. This way, where there is a shared responsibility, workload owners can see this detail and they can be confident that the inputs provided by the central teams are correct and consistent.The solution operates as shown in Figure 1 and works as follows:Central teams use the AWS WA Tool in the “central” AWS account to create workload templates. These are prefixed with “CentralTemplate” (or by astack parameter).The central team answers the questions they’re responsible for and marks all others as “Question does not apply to this workload”.When an application team is ready to perform an AWS WA Framework review, they create a new workload in their workload account in the AWS WA Tool.This new workload is then shared with the central account (with contributor access) by anAWS Lambdafunction. After that, a message is placed on anAmazon Simple Notification Service (Amazon SNS)topic in the central account.In the central account, a Lambda function is subscribed to the Amazon SNS topic from step 4. This function accepts the incoming share, then shares all templates back to the workload account (with read-only access).The shared workload is then populated with templated answers from templates with the “CentralTemplate” prefix. Both the selected choices and notes are written to the shared workload. Questions in the template marked as “question does not apply to this workload” are ignored.As the application team proceeds through the questions, they will see the pre-populated answers from the template.Should a central team need to update their answers, they can update their template andcreate a milestone.The milestone creation invokes anAWS Step Functionsworkflow. The workflow collects all shared workload IDs. Next, it uses amap stateto fan-out the updating of all shared workloads. Whether this process should overwrite or append workload answers is configurable at deployment time.Because all workloads are now visible in the central account, the dashboards referenced in AWS WAlabscan be used for consolidated analysis of risks.Figure 1. Solution components and workflow stepsThe solution can be coupled with anAmazon QuickSightpoweredreporting solutionto get an organization-wide view of reviews from a single account. These reviews can also be shared with your AWS account team for ongoing collaborative improvement.Note:For some workloads, you may need additional AWS WA Frameworklenses. The solution offered in this post is lens agnostic, and also supports the use ofcustom lenses. To deploy the solution, refer to the deployment instructions which can be found on GitHub underaws-samples.ConclusionIn this post, we explored some of the challenges faced by large enterprises when performing AWS WA Framework reviews at scale and showed you a solution to help your teams define templated answers to particular questions in the AWS WA Tool.You can deploy this solution to your AWS accounts today by following the deployment instructions included on theaws-samplesrepository.Having these templated answers automatically propagated to application workload reviews reduces the number of questions application teams have to answer, as well as the number of attendees required for a review. With this solution, all the AWS WA Framework reviews can be viewed in a single AWS account, so you can also apply thereporting solution provided in AWS WA labsto run centralized reports against all AWS WA Framework reviews in your organization.Looking for more architecture content?AWS Architecture Centerprovides reference architecture diagrams, vetted architecture solutions,Well-Architectedbest practices, patterns, icons, and more!Thomas AttreeThomas is a Solutions Architect at Amazon Web Services based in London. Thomas currently helps customers in the power and utilities industry and applies his passion for sustainability to help customers architect applications for energy efficiency.Paul Le PagePaul Le Page is a Senior Solutions Architect at AWS. He works with enterprise retail customers, helping them with migrations to the cloud and adoption of cloud native services. In his free time, Paul enjoys travel, food and the great outdoors.
For larger customers, performing AWS Well-Architected (AWS WA) Framework reviews often involves a combination of different teams. Coordinating participants from each team in order to perform a review increases the time taken and is expensive. In a large organization, there are often hundreds of AWS accounts where teams can store review documents, which means there […]
Thomas Attree
Architecture AWS Well-Architected AWS Well-Architected Framework AWS Well-Architected Tool