Free Tool

AWS Architecture
Scorecard

12 questions. 5 pillars. Under 5 minutes. Find out where your AWS infrastructure is solid — and where it's quietly creating risk.

Security Cost Optimization Resilience Observability Delivery

Start Free Assessment No account required · Results emailed to you

0 of 12 answered 0%

Security

IAM posture, data protection, and network perimeter controls

01How do you manage AWS IAM access for your team?

We use root credentials or long-lived access keys for most access IAM users with MFA, but permissions are broad or not regularly reviewed IAM roles with basic scoping — some over-permissioned accounts remain Least-privilege IAM roles everywhere, no root usage, credentials in Secrets Manager

02How are your S3 buckets and data stores protected?

Public access not reviewed — some buckets may be publicly accessible Block public access enabled on most buckets, but not consistently audited Public access blocked everywhere; encryption enabled on most data stores Full data classification, encryption at rest and in transit, access audited via CloudTrail

03How is your network perimeter secured?

Services exposed directly to the internet; security groups are the only control VPC in use with security groups and NACLs, but no WAF or CDN layer WAF or CloudFront in front of public endpoints; services in private subnets WAF with managed rule sets, private VPC topology, VPN/PrivateLink for internal traffic

Cost Optimization

Tagging, budgets, rightsizing, and compute efficiency

04How do you manage and optimize AWS costs?

We check the bill when it arrives and react to surprises Cost Explorer access, but no proactive optimization or budget alerts AWS Budgets alerts are set up; occasional rightsizing and cost reviews Full cost allocation tagging, Savings Plans/RIs, and monthly optimization reviews

05How are your compute resources sized and scaled?

Fixed instance sizes running 24/7 regardless of actual load Manual scaling during known high-traffic periods; no automation Auto Scaling Groups configured, but not tuned or regularly reviewed Dynamic auto-scaling, Spot/Graviton where appropriate, scheduled scaling for predictable patterns

Resilience

Multi-AZ strategy, backups, recovery, and failure tolerance

06What is your availability zone strategy for critical workloads?

Single AZ for most or all workloads Multi-AZ for databases only; compute is single-AZ Most services span multiple AZs, but not consistently applied All critical paths span multiple AZs; failover tested regularly

07What is your backup and recovery posture?

No formal backup strategy; relying on provider defaults Automated backups enabled but restore process has never been tested Backups tested at least annually; RTO/RPO defined but not regularly validated Regular automated backups, quarterly restore drills, documented RTO/RPO consistently met

08How well does your system handle dependency failures?

Cascading failures are common; no circuit breakers or timeouts configured Basic timeouts in place, but no graceful degradation patterns Retry logic and some graceful degradation implemented on key services Circuit breakers, bulkheads, and graceful degradation across all critical dependencies

Observability

Logging, alerting, metrics, and distributed tracing

09What is your logging and alerting coverage?

Logs exist but are not centralized; no proactive alerting Centralized logs (CloudWatch/ELK) but minimal or no alerting rules Alerts on key error rates and latency thresholds, reviewed regularly Structured logging, SLOs defined, and business-critical alerts tied to on-call rotation

10How do you track performance and diagnose production issues?

No APM or tracing — we rely on log searches when something breaks Basic CloudWatch metrics only; no distributed tracing APM tool in place (Datadog/New Relic/X-Ray) covering main services Distributed tracing across all service boundaries; p99 latency tracked per service

Delivery

CI/CD pipelines, deployment safety, and rollback capability

11What is your CI/CD pipeline maturity?

Deployments are manual or semi-automated scripts with no pipeline Basic CI (tests on PRs) but production deployments are still manual CI/CD pipeline with automated testing gates before production deploys Full pipeline with staging, automated smoke tests, feature flags, and progressive rollout

12How quickly can you recover from a bad production deployment?

No rollback mechanism — requires a full new deployment cycle Rollback is possible but takes 30+ minutes and requires manual steps Can roll back in under 15 minutes with a documented runbook Automated rollback on health check failures; recovery under 5 minutes

Please answer all 12 questions before continuing.

Your scorecard is ready.

Enter your work email to unlock your full pillar-by-pillar breakdown, score interpretation, and the specific gaps most likely to hurt you in a real incident or audit.

Security score Cost efficiency score Resilience score Observability score Delivery score

No spam. We'll send you the scorecard results and one follow-up only. Contact us to be removed.

Pillar Score

Security

Cost

Resilience

Observability

Delivery

Key findings

Want a deeper look?

A 30-minute architecture review with Nick covers your top three risk areas in detail — with specific remediation recommendations tailored to your stack. No prep required. Free, no commitment.

Book a 30-Min Review See engagement options

AWS ArchitectureScorecard

Security

Cost Optimization

Resilience

Observability

Delivery

Your scorecard is ready.

Key findings

Want a deeper look?

AWS Architecture
Scorecard