Run a first Well-Architected review of an invented shop

short · 30 min · Task statement 1.2

Before you start — what this lab needs, and what it can cost

This lab runs in your own AWS account, so every command acts on something real and billed to you. Work in AWS CloudShell, opened from the console toolbar, signed in as a non-root administrative identity: an IAM Identity Center user, or an IAM user with administrator permissions. Never use the root user, and create no access keys, because CloudShell already has the AWS CLI and your credentials. The lab uses the AWS Free Tier where possible, but charges are possible, so do the clean-up the same day; each service's pricing page and the AWS Pricing Calculator give current rates. It relies on the budget alert you set in lesson 1's lab, clf-zero-spend-budget, which emails you as soon as this account starts to cost money. The commands use 111122223333 as the account ID: put your own 12-digit account ID in its place wherever it appears. The shop is invented: describe it with text you make up yourself, never a real company's details.

This lab ends with a clean-up. Do it the same day: anything left running in your account is billed to you.

Task

Define a workload in the AWS Well-Architected Tool for an invented online shop, walk through the six pillars, and answer one question in the Security pillar and one in the Cost optimization pillar. Then read the review back from CloudShell. By the end you can name the six pillars in the order the tool shows them, explain that the Framework is guidance applied through a review rather than a service that deploys anything, and say which pillar each of your two answers belongs to and why. You also see how the tool turns answers into risks and an improvement plan.

Steps

Open the AWS Well-Architected Tool console (search for "Well-Architected Tool") and choose Define workload. Enter these values and leave the optional fields empty:

Name: clf-lab02-sample-shop
Description: Invented online shop used for a practice review
Review owner: you@example.com
Environment: Pre-production
Regions: the Region CloudShell is using

Continue to the lenses page, keep the AWS Well-Architected Framework lens that is already selected, and finish defining the workload. 2. Choose Start reviewing. The left-hand list shows the six pillars: Operational excellence, Security, Reliability, Performance efficiency, Cost optimization and Sustainability. Open the first question of each pillar in turn and read its list of best practices. For each pillar, write down one design principle from lesson 2 that its first question reflects. Answer nothing yet. 3. In the Security pillar, open the question about how you manage authentication for people and machines (SEC 2). For the invented shop, select the best practices it follows: say it uses strong sign-in mechanisms and a centralised identity provider. Choose Save and exit. This is the "implement a strong identity foundation" principle. 4. In the Cost optimization pillar, open the question about how you monitor your cost and usage. Select one or two practices the invented shop follows, such as configuring billing and cost management tools, and choose Save and exit. Your lesson 1 budget is exactly this kind of tool. 5. Open the workload's overview. It shows how many questions are answered and how many high and medium risks the tool has found so far, and the Improvement plan tab lists the best practices it suggests next. A question you have not answered is not counted as a risk: it is simply unanswered. 6. Read the review back from CloudShell. Find the workload's ID first:

WID=$(aws wellarchitected list-workloads --workload-name-prefix clf-lab02 --query 'WorkloadSummaries[0].WorkloadId' --output text)
aws wellarchitected get-lens-review --workload-id "$WID" --lens-alias wellarchitected --query 'LensReview.PillarReviewSummaries[].PillarId' --output text

The second command prints the six pillar IDs the tool uses, from operationalExcellence to sustainability.

Verify

Run these in the same CloudShell session (if WID is empty, run the first line of step 6 again).

aws wellarchitected get-workload --workload-id "$WID" --query 'Workload.[WorkloadName,Environment]' --output text

Expected output: clf-lab02-sample-shop PREPRODUCTION.

aws wellarchitected get-lens-review --workload-id "$WID" --lens-alias wellarchitected --query 'length(LensReview.PillarReviewSummaries)' --output text

Expected output: 6.

aws wellarchitected list-answers --workload-id "$WID" --lens-alias wellarchitected --pillar-id security --query "length(AnswerSummaries[?Risk!='UNANSWERED'])" --output text
aws wellarchitected list-answers --workload-id "$WID" --lens-alias wellarchitected --pillar-id costOptimization --query "length(AnswerSummaries[?Risk!='UNANSWERED'])" --output text

Expected output: 1 from each command, one answered question per pillar.

Cost and clean-up

AWS describes the Well-Architected Tool as available at no additional charge; check its product page before relying on that. The lab makes no other resource.

Created by this lab: the Well-Architected Tool workload clf-lab02-sample-shop and the answers saved in it.

Delete the workload clf-lab02-sample-shop, which deletes its answers with it:

aws wellarchitected delete-workload --workload-id "$WID"

If WID is no longer set, open the workload in the Well-Architected Tool console and choose Delete instead.

Check it is gone

aws wellarchitected list-workloads --workload-name-prefix clf-lab02 --query 'length(WorkloadSummaries)' --output text

Expected output: 0.

Notes

Step 2, one acceptable principle per pillar: Operational excellence, "organise teams around business outcomes"; Security, "implement a strong identity foundation"; Reliability, "automatically recover from failure"; Performance efficiency, "experiment more often"; Cost optimization, "implement Cloud Financial Management"; Sustainability, "understand your impact". The tool's question wording changes from time to time, so match the idea rather than the exact words.

The Well-Architected Tool runs a review; it is not AWS Trusted Advisor, which checks the resources in an account automatically, and it certifies nothing.

This is an independent study companion for the AWS Certified Cloud Practitioner (CLF-C02) exam and is not produced by or endorsed by Amazon Web Services. AWS, Amazon Web Services and AWS Certified Cloud Practitioner are trademarks of Amazon.com, Inc. or its affiliates.

This is an independent study companion for AWS Certified Cloud Practitioner CLF-C02 and is not produced by or endorsed by CompTIA.