aws-solution-architect · diff
v1.0.0 to v1.0.1
352 added, 104 removed. Audit A to A.
---
name: aws-solution-architect
- description: '用于 AWS 云架构设计、服务选型、成本优化与 Well-Architected Framework 评估。来源：alirezarezvani/claude-skills。'
+ description: 'Design AWS architectures for startups using serverless patterns and IaC templates. Use when asked to design serverless architecture, create CloudFormation templates, optimize AWS costs, set up CI/CD pipelines, or migrate to AWS. Covers Lambda, API Gateway, DynamoDB, ECS, Aurora, and cost optimization.'
zh_description: "用于 AWS 云架构设计、服务选型、成本优化与 Well-Architected Framework 评估。"
- version: "1.0.0"
+ version: "1.0.1"
author: "seaworld008"
source: "skills.sh"
source_url: "https://skills.sh/alirezarezvani/claude-skills/aws-solution-architect"
license: "MIT"
tags: '["architect", "aws", "development", "solution"]'
created_at: "2026-03-27"
- updated_at: "2026-03-27"
+ updated_at: "2026-08-20"
quality: 4
complexity: "intermediate"
---
# AWS Solution Architect
- ## 触发条件
- - 需要将传统本地应用平滑迁移（Lift & Shift）到 AWS 云端时。
- - 面对业务增长，需要设计支持弹性扩缩容、高可用（HA）和容灾（DR）的系统架构。
- - 评估现有 AWS 资源使用情况，通过 Rightsizing 和 Reserved Instances (RI) 进行成本优化。
- - 设计多层 VPC 网络拓扑，确保公共子网、私有子网和数据存储层的安全隔离。
- - 实现细粒度的 IAM 权限管理，支持多人协作环境下的最小权限原则。
- - 面对复杂需求进行核心服务选型（如决定使用 Lambda 还是 EC2，DynamoDB 还是 RDS）。
+ Design scalable, cost-effective AWS architectures for startups with infrastructure-as-code templates.
- ## 核心能力
+ ---
- ### 1. AWS Well-Architected 六大支柱
- - **卓越运营 (Operational Excellence)**: 通过基础设施即代码 (IaC) 自动化部署和观测。
- - **安全性 (Security)**: 多层防御、加密静态/传输数据、IAM 身份联合。
- - **可靠性 (Reliability)**: 跨多可用区 (Multi-AZ) 部署，设计自愈能力。
- - **性能效率 (Performance Efficiency)**: 选择正确的实例类型，利用 Serverless 减少管理开销。
- - **成本优化 (Cost Optimization)**: 使用 Spot 实例、节省计划 (Savings Plans) 和资源清理。
- - **可持续性 (Sustainability)**: 减少资源闲置，优化数据存储方案。
+ ## Workflow
- ### 2. 核心服务选型 (Service Selection)
- - **计算 (Compute)**:
- - EC2: 传统应用、长期运行、完全控制内核。
- - Lambda: 无服务器、事件驱动、按量计费。
- - ECS/EKS: 容器化应用编排。
- - **存储 (Storage)**:
- - S3: 海量对象存储（备份、静态文件、数据湖）。
- - EBS: EC2 块存储。
- - EFS: 跨 EC2 的共享文件系统。
- - **数据库 (Database)**:
- - RDS: 托管关系型数据库（Aurora 为高性能推荐）。
- - DynamoDB: 高性能 NoSQL，亚毫秒级延迟。
- - ElastiCache: Redis/Memcached 内存缓存。
- - **分发 (Content Delivery)**:
- - CloudFront: CDN 全球加速。
+ ### Step 1: Gather Requirements
- ### 3. VPC 网络设计 (Networking)
- - **子网划分**: 合理划分 Public (含 NAT Gateway) 和 Private Subnets。
- - **安全组 (SG) & 网络 ACL (NACL)**: 区分有状态与无状态防火墙。
- - **连接性**: 熟练使用 VPC Peering, Transit Gateway, Client VPN, PrivateLink。
- - **DNS 管理**: 使用 Route 53 进行健康检查和流量加权分发。
+ Collect application specifications:
- ### 4. IAM 权限与安全管理
- - **IAM Roles**: 优先使用角色而非永久性 Access Key。
- - **策略评估 (Policy)**: 编写精细的 JSON 策略，支持条件 (Condition) 限制（如 IP, 时间, MFA）。
- - **集中管理**: 使用 AWS Organizations 和 Control Tower 管理多账号环境。
+ ```
+ - Application type (web app, mobile backend, data pipeline, SaaS)
+ - Expected users and requests per second
+ - Budget constraints (monthly spend limit)
+ - Team size and AWS experience level
+ - Compliance requirements (GDPR, HIPAA, SOC 2)
+ - Availability requirements (SLA, RPO/RTO)
+ ```
- ### 5. 高可用与灾备 (HA & DR)
- - **多可用区**: RDS Multi-AZ, ELB (Elastic Load Balancer) 流量分发。
- - **多区域容灾**: 使用 S3 跨区域复制 (CRR), DynamoDB 全球表。
- - **容灾策略**: 掌握 Backup & Restore, Pilot Light, Warm Standby, Multi-site Active-Active。
+ ### Step 2: Design Architecture
- ### 6. 成本优化建议
- - **监控工具**: 使用 Cost Explorer, Trusted Advisor, AWS Budgets 监控支出。
- - **资源下钻**: 发现闲置的 EBS 卷、未关联的 Elastic IP、未使用的 NAT Gateway。
- - **架构调整**: 将低频率访问数据转入 S3 Glacier 存储类。
+ Run the architecture designer to get pattern recommendations:
- ## 常用命令/模板
+ ```bash
+ python scripts/architecture_designer.py --input requirements.json
+ ```
- ### CLI 架构观测组合
+ **Example output:**
+
+ ```json
+ {
+ "recommended_pattern": "serverless_web",
+ "service_stack": ["S3", "CloudFront", "API Gateway", "Lambda", "DynamoDB", "Cognito"],
+ "estimated_monthly_cost_usd": 35,
+ "pros": ["Low ops overhead", "Pay-per-use", "Auto-scaling"],
+ "cons": ["Cold starts", "15-min Lambda limit", "Eventual consistency"]
+ }
+ ```
+
+ Select from recommended patterns:
+ - **Serverless Web**: S3 + CloudFront + API Gateway + Lambda + DynamoDB
+ - **Event-Driven Microservices**: EventBridge + Lambda + SQS + Step Functions
+ - **Three-Tier**: ALB + ECS Fargate + Aurora + ElastiCache
+ - **GraphQL Backend**: AppSync + Lambda + DynamoDB + Cognito
+
+ See `references/architecture_patterns.md` for detailed pattern specifications.
+
+ **Validation checkpoint:** Confirm the recommended pattern matches the team's operational maturity and compliance requirements before proceeding to Step 3.
+
+ ### Step 3: Generate IaC Templates
+
+ Create infrastructure-as-code for the selected pattern:
+
```bash
- # 查询当前账号下所有运行中的 EC2 实例及其规格
- aws ec2 describe-instances --query 'Reservations[*].Instances[*].{ID:InstanceId,Type:InstanceType,State:State.Name}' --output table
+ # Serverless stack (CloudFormation)
+ python scripts/serverless_stack.py --app-name my-app --region us-east-1
+ ```
- # 快速分析 S3 存储桶大小
- aws s3 ls s3://my-bucket --recursive --human-readable --summarize | tail -2
+ **Example CloudFormation YAML output (core serverless resources):**
- # 检查 IAM 用户是否开启了 MFA
- aws iam list-users --query 'Users[*].UserName' --output text | xargs -n1 aws iam list-mfa-devices --user-name
+ ```yaml
+ AWSTemplateFormatVersion: '2010-09-09'
+ Transform: AWS::Serverless-2016-10-31
- # 查看 Lambda 函数的运行时与内存配置
- aws lambda list-functions --query 'Functions[*].{Name:FunctionName,Runtime:Runtime,Memory:MemorySize}'
+ Parameters:
+ AppName:
+ Type: String
+ Default: my-app
+
+ Resources:
+ ApiFunction:
+ Type: AWS::Serverless::Function
+ Properties:
+ Handler: index.handler
+ Runtime: nodejs20.x
+ MemorySize: 512
+ Timeout: 30
+ Environment:
+ Variables:
+ TABLE_NAME: !Ref DataTable
+ Policies:
+ - DynamoDBCrudPolicy:
+ TableName: !Ref DataTable
+ Events:
+ ApiEvent:
+ Type: Api
+ Properties:
+ Path: /{proxy+}
+ Method: ANY
+
+ DataTable:
+ Type: AWS::DynamoDB::Table
+ Properties:
+ BillingMode: PAY_PER_REQUEST
+ AttributeDefinitions:
+ - AttributeName: pk
+ AttributeType: S
+ - AttributeName: sk
+ AttributeType: S
+ KeySchema:
+ - AttributeName: pk
+ KeyType: HASH
+ - AttributeName: sk
+ KeyType: RANGE
```
- ### 多层 VPC 架构建议模板 (Terraform 风格)
- ```hcl
- module "vpc" {
- source = "terraform-aws-modules/vpc/aws"
-
- name = "prod-vpc"
- cidr = "10.0.0.0/16"
+ > Full templates including API Gateway, Cognito, IAM roles, and CloudWatch logging are generated by `serverless_stack.py` and also available in `references/architecture_patterns.md`.
- azs = ["us-east-1a", "us-east-1b", "us-east-1c"]
- private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] # 业务应用
- public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] # ALB/NAT
- database_subnets = ["10.0.201.0/24", "10.0.202.0/24"] # RDS/NoSQL
+ **Example CDK TypeScript snippet (three-tier pattern):**
- enable_nat_gateway = true
- single_nat_gateway = false # 生产环境建议每可用区一个
-
- tags = {
- Environment = "production"
- CreatedBy = "AWS-Solution-Architect"
- }
+ ```typescript
+ import * as ecs from 'aws-cdk-lib/aws-ecs';
+ import * as ec2 from 'aws-cdk-lib/aws-ec2';
+ import * as rds from 'aws-cdk-lib/aws-rds';
+
+ const vpc = new ec2.Vpc(this, 'AppVpc', { maxAzs: 2 });
+
+ const cluster = new ecs.Cluster(this, 'AppCluster', { vpc });
+
+ const db = new rds.ServerlessCluster(this, 'AppDb', {
+ engine: rds.DatabaseClusterEngine.auroraPostgres({
+ version: rds.AuroraPostgresEngineVersion.VER_15_2,
+ }),
+ vpc,
+ scaling: { minCapacity: 0.5, maxCapacity: 4 },
+ });
+ ```
+
+ ### Step 4: Review Costs
+
+ Analyze estimated costs and optimization opportunities:
+
+ ```bash
+ python scripts/cost_optimizer.py --resources current_setup.json --monthly-spend 2000
+ ```
+
+ **Example output:**
+
+ ```json
+ {
+ "current_monthly_usd": 2000,
+ "recommendations": [
+ { "action": "Right-size RDS db.r5.2xlarge → db.r5.large", "savings_usd": 420, "priority": "high" },
+ { "action": "Purchase 1-yr Compute Savings Plan at 40% utilization", "savings_usd": 310, "priority": "high" },
+ { "action": "Move S3 objects >90 days to Glacier Instant Retrieval", "savings_usd": 85, "priority": "medium" }
+ ],
+ "total_potential_savings_usd": 815
}
```
- ### IAM 最小权限策略模板 (S3 只读)
+ Output includes:
+ - Monthly cost breakdown by service
+ - Right-sizing recommendations
+ - Savings Plans opportunities
+ - Potential monthly savings
+
+ ### Step 5: Deploy
+
+ Deploy the generated infrastructure:
+
+ ```bash
+ # CloudFormation
+ aws cloudformation create-stack \
+ --stack-name my-app-stack \
+ --template-body file://template.yaml \
+ --capabilities CAPABILITY_IAM
+
+ # CDK
+ cdk deploy
+
+ # Terraform
+ terraform init && terraform apply
+ ```
+
+ ### Step 6: Validate and Handle Failures
+
+ Verify deployment and set up monitoring:
+
+ ```bash
+ # Check stack status
+ aws cloudformation describe-stacks --stack-name my-app-stack
+
+ # Set up CloudWatch alarms
+ aws cloudwatch put-metric-alarm --alarm-name high-errors ...
+ ```
+
+ **If stack creation fails:**
+
+ 1. Check the failure reason:
+ ```bash
+ aws cloudformation describe-stack-events \
+ --stack-name my-app-stack \
+ --query 'StackEvents[?ResourceStatus==`CREATE_FAILED`]'
+ ```
+ 2. Review CloudWatch Logs for Lambda or ECS errors.
+ 3. Fix the template or resource configuration.
+ 4. Delete the failed stack before retrying:
+ ```bash
+ aws cloudformation delete-stack --stack-name my-app-stack
+ # Wait for deletion
+ aws cloudformation wait stack-delete-complete --stack-name my-app-stack
+ # Redeploy
+ aws cloudformation create-stack ...
+ ```
+
+ **Common failure causes:**
+ - IAM permission errors → verify `--capabilities CAPABILITY_IAM` and role trust policies
+ - Resource limit exceeded → request quota increase via Service Quotas console
+ - Invalid template syntax → run `aws cloudformation validate-template --template-body file://template.yaml` before deploying
+
+ ---
+
+ ## Tools
+
+ ### architecture_designer.py
+
+ Generates architecture patterns based on requirements.
+
+ ```bash
+ python scripts/architecture_designer.py --input requirements.json --output design.json
+ ```
+
+ **Input:** JSON with app type, scale, budget, compliance needs
+ **Output:** Recommended pattern, service stack, cost estimate, pros/cons
+
+ ### serverless_stack.py
+
+ Creates serverless CloudFormation templates.
+
+ ```bash
+ python scripts/serverless_stack.py --app-name my-app --region us-east-1
+ ```
+
+ **Output:** Production-ready CloudFormation YAML with:
+ - API Gateway + Lambda
+ - DynamoDB table
+ - Cognito user pool
+ - IAM roles with least privilege
+ - CloudWatch logging
+
+ ### cost_optimizer.py
+
+ Analyzes costs and recommends optimizations.
+
+ ```bash
+ python scripts/cost_optimizer.py --resources inventory.json --monthly-spend 5000
+ ```
+
+ **Output:** Recommendations for:
+ - Idle resource removal
+ - Instance right-sizing
+ - Reserved capacity purchases
+ - Storage tier transitions
+ - NAT Gateway alternatives
+
+ ---
+
+ ## Quick Start
+
+ ### MVP Architecture (< $100/month)
+
+ ```
+ Ask: "Design a serverless MVP backend for a mobile app with 1000 users"
+
+ Result:
+ - Lambda + API Gateway for API
+ - DynamoDB pay-per-request for data
+ - Cognito for authentication
+ - S3 + CloudFront for static assets
+ - Estimated: $20-50/month
+ ```
+
+ ### Scaling Architecture ($500-2000/month)
+
+ ```
+ Ask: "Design a scalable architecture for a SaaS platform with 50k users"
+
+ Result:
+ - ECS Fargate for containerized API
+ - Aurora Serverless for relational data
+ - ElastiCache for session caching
+ - CloudFront for CDN
+ - CodePipeline for CI/CD
+ - Multi-AZ deployment
+ ```
+
+ ### Cost Optimization
+
+ ```
+ Ask: "Optimize my AWS setup to reduce costs by 30%. Current spend: $3000/month"
+
+ Provide: Current resource inventory (EC2, RDS, S3, etc.)
+
+ Result:
+ - Idle resource identification
+ - Right-sizing recommendations
+ - Savings Plans analysis
+ - Storage lifecycle policies
+ - Target savings: $900/month
+ ```
+
+ ### IaC Generation
+
+ ```
+ Ask: "Generate CloudFormation for a three-tier web app with auto-scaling"
+
+ Result:
+ - VPC with public/private subnets
+ - ALB with HTTPS
+ - ECS Fargate with auto-scaling
+ - Aurora with read replicas
+ - Security groups and IAM roles
+ ```
+
+ ---
+
+ ## Input Requirements
+
+ Provide these details for architecture design:
+
+ | Requirement | Description | Example |
+ |-------------|-------------|---------|
+ | Application type | What you're building | SaaS platform, mobile backend |
+ | Expected scale | Users, requests/sec | 10k users, 100 RPS |
+ | Budget | Monthly AWS limit | $500/month max |
+ | Team context | Size, AWS experience | 3 devs, intermediate |
+ | Compliance | Regulatory needs | HIPAA, GDPR, SOC 2 |
+ | Availability | Uptime requirements | 99.9% SLA, 1hr RPO |
+
+ **JSON Format:**
+
```json
{
- "Version": "2012-10-17",
- "Statement": [
- {
- "Effect": "Allow",
- "Action": [
- "s3:ListBucket",
- "s3:GetBucketLocation"
- ],
- "Resource": "arn:aws:s3:::my-secure-bucket"
- },
- {
- "Effect": "Allow",
- "Action": "s3:GetObject",
- "Resource": "arn:aws:s3:::my-secure-bucket/*",
- "Condition": {
- "IpAddress": { "aws:SourceIp": "1.2.3.4/32" }
- }
- }
- ]
+ "application_type": "saas_platform",
+ "expected_users": 10000,
+ "requests_per_second": 100,
+ "budget_monthly_usd": 500,
+ "team_size": 3,
+ "aws_experience": "intermediate",
+ "compliance": ["SOC2"],
+ "availability_sla": "99.9%"
}
```
- ## 边界与限制
- - **单账号限制**: 每个 AWS 账号都有服务限制 (Service Quotas)，在高并发冷启动（如 Lambda）时可能触发。
- - **数据出口成本**: AWS 的内网流量通常免费或便宜，但数据流向外网（Data Transfer Out）成本极高，架构设计时需避开跨 Region 数据同步。
- - **最终一致性**: 部分服务（如 S3 部分操作、DynamoDB 最终一致性读取）在特定并发场景下需处理数据不一致。
- - **非全能银弹**: CloudFront 无法加速非 HTTP/HTTPS 协议流量；Lambda 无法处理超过 15 分钟的计算任务。
- - **锁死风险**: 过度依赖 AWS 特定服务（如 AppSync, DynamoDB）可能导致供应商锁死（Vendor Lock-in），架构设计时应权衡便利性与可迁移性。
+ ---
+
+ ## Output Formats
+
+ ### Architecture Design
+
+ - Pattern recommendation with rationale
+ - Service stack diagram (ASCII)
+ - Monthly cost estimate and trade-offs
+
+ ### IaC Templates
+
+ - **CloudFormation YAML**: Production-ready SAM/CFN templates
+ - **CDK TypeScript**: Type-safe infrastructure code
+ - **Terraform HCL**: Multi-cloud compatible configs
+
+ ### Cost Analysis
+
+ - Current spend breakdown with optimization recommendations
+ - Priority action list (high/medium/low) and implementation checklist
+
+ ---
+
+ ## Reference Documentation
+
+ | Document | Contents |
+ |----------|----------|
+ | `references/architecture_patterns.md` | 6 patterns: serverless, microservices, three-tier, data processing, GraphQL, multi-region |
+ | `references/service_selection.md` | Decision matrices for compute, database, storage, messaging |
+ | `references/best_practices.md` | Serverless design, cost optimization, security hardening, scalability |