Skip to content

CLM-39516: Update AWS reference architecture to match L-sized architecture #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jmromeroes wants to merge 3 commits into
base: main
Choose a base branch
from
Open

CLM-39516: Update AWS reference architecture to match L-sized architecture #24

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8a5e327
CLM-39516: Update AWS reference architecture to match L-sized archite…
jmromeroes Apr 15, 2026
4c26cf4
Address PR review feedback
jmromeroes Apr 16, 2026
10d599a
Use variables consistently in infra-aws configuration
jmromeroes Apr 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 13 additions & 6 deletions infra-aws-ha/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,26 +162,32 @@ private_subnet_cidrs = ["10.0.10.0/24", "10.0.20.0/24", "10.0.30.0/24"]
db_subnet_cidrs = ["10.0.40.0/24", "10.0.50.0/24", "10.0.60.0/24"]
enable_nat_gateway = true

# ECS Configuration
# ECS Configuration - L Customer Profile
# L Profile: 8 vCPU ARM (Graviton), 64 GB RAM
ecs_cpu = 8192 # 8 vCPU
ecs_memory = 32768 # 32 GB
ecs_memory_reservation = 24576 # 24 GB soft limit
ecs_memory = 65536 # 64 GB
ecs_memory_reservation = 49152 # 48 GB soft limit

# IQ Server Configuration
iq_desired_count = 3
iq_desired_count = 2 # Minimum 2 for HA
iq_min_count = 2
iq_max_count = 5
iq_cpu_target_value = 70 # CPU target for auto scaling (%)
iq_memory_target_value = 80 # Memory target for auto scaling (%)
iq_docker_image = "sonatype/nexus-iq-server:latest"
java_opts = "-Xms24g -Xmx24g -XX:+UseG1GC -Djava.util.prefs.userRoot=/sonatype-work/javaprefs"

# Java options for L profile: 48GB heap (75% of 64GB RAM)
# AlwaysPreTouch: Pre-faults heap pages for consistent GC performance
# CrashOnOutOfMemoryError: Ensures clean crash for easier troubleshooting
# insight.threads.monitor=10: Enables monitoring thread pool
java_opts = "-Xms48g -Xmx48g -XX:+UseG1GC -XX:+AlwaysPreTouch -XX:+CrashOnOutOfMemoryError -Djava.util.prefs.userRoot=/sonatype-work/javaprefs -Dinsight.threads.monitor=10"

# Database Configuration (Aurora PostgreSQL)
db_name = "nexusiq"
db_username = "nexusiq"
db_password = "YourSecurePassword123!" # Change this!
aurora_engine_version = "15.10"
aurora_instance_class = "db.r6g.4xlarge"
aurora_instance_class = "db.r6g.2xlarge" # 8 vCPU, 64 GB RAM, ARM Graviton
aurora_instances = 2
db_backup_retention_period = 7
db_backup_window = "03:00-04:00"
Expand All @@ -192,6 +198,7 @@ db_deletion_protection = false
# Load Balancer Configuration
# ssl_certificate_arn = "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"
alb_deletion_protection = false
alb_idle_timeout = 180 # 3 minutes

# EFS Configuration
efs_throughput_mode = "provisioned"
Expand Down
103 changes: 49 additions & 54 deletions infra-aws-ha/terraform.tfvars.example
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
# Copy this file to terraform.tfvars and update the values
# Copy this file to terraform.tfvars and update the values
# cp terraform.tfvars.example terraform.tfvars

# ================================
# GENERAL CONFIGURATION
# ================================
aws_region = "us-east-1"
cluster_name = "ref-arch-iq-ha-cluster"

# ================================
# NETWORK CONFIGURATION
# ================================
Expand All @@ -15,72 +15,76 @@ public_subnet_cidrs = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
private_subnet_cidrs = ["10.0.10.0/24", "10.0.20.0/24", "10.0.30.0/24"]
db_subnet_cidrs = ["10.0.40.0/24", "10.0.50.0/24", "10.0.60.0/24"]
enable_nat_gateway = true

# ================================
# ECS CONFIGURATION
# ECS CONFIGURATION - L Customer Profile
# ================================
# L Profile: 8 vCPU ARM (Graviton), 64 GB RAM
ecs_cpu = 8192 # 8 vCPU
ecs_memory = 32768 # 32 GB
ecs_memory_reservation = 24576 # 24 GB soft limit

# ================================
# IQ SERVER CONFIGURATION
# ================================
iq_desired_count = 3 # 3 instances for better HA
iq_min_count = 2 # Minimum for auto scaling
iq_max_count = 5 # Maximum for auto scaling
iq_cpu_target_value = 70 # CPU target for auto scaling (%)
iq_memory_target_value = 80 # Memory target for auto scaling (%)
iq_docker_image = "sonatype/nexus-iq-server:latest"
java_opts = "-Xms24g -Xmx24g -XX:+UseG1GC -Djava.util.prefs.userRoot=/sonatype-work/javaprefs"

ecs_memory = 65536 # 64 GB
ecs_memory_reservation = 49152 # 48 GB soft limit

# IQ Server Configuration
iq_desired_count = 2 # Minimum 2 for HA
iq_min_count = 2 # Minimum for auto scaling
iq_max_count = 5 # Maximum for auto scaling
iq_cpu_target_value = 70 # CPU target for auto scaling (%)
iq_memory_target_value = 80 # Memory target for auto scaling (%)
iq_docker_image = "sonatype/nexus-iq-server:latest"

# Java options for L profile: 48GB heap (75% of 64GB RAM)
# AlwaysPreTouch: Pre-faults heap pages for consistent GC performance
# CrashOnOutOfMemoryError: Ensures clean crash for easier troubleshooting
# insight.threads.monitor=10: Enables monitoring thread pool
java_opts = "-Xms48g -Xmx48g -XX:+UseG1GC -XX:+AlwaysPreTouch -XX:+CrashOnOutOfMemoryError -Djava.util.prefs.userRoot=/sonatype-work/javaprefs -Dinsight.threads.monitor=10"

# ================================
# DATABASE CONFIGURATION (Aurora PostgreSQL)
# ================================
db_name = "nexusiq"
db_username = "nexusiq"
db_password = "YourSecurePassword123!" # CHANGE THIS!
aurora_engine_version = "15.10"
aurora_instance_class = "db.r6g.4xlarge"
aurora_instance_class = "db.r6g.2xlarge" # 8 vCPU, 64 GB RAM, ARM Graviton
aurora_instances = 2 # Minimum 2 for HA
db_backup_retention_period = 7
db_backup_window = "03:00-04:00"
db_maintenance_window = "sun:04:00-sun:05:00"
db_skip_final_snapshot = false # Set to true for development
db_deletion_protection = false # Set to false for development
db_backup_retention_period = 7
db_backup_window = "03:00-04:00"
db_maintenance_window = "sun:04:00-sun:05:00"
db_skip_final_snapshot = true
db_deletion_protection = false

# ================================
# LOAD BALANCER CONFIGURATION
# ================================
# Uncomment and provide SSL certificate ARN for HTTPS
# ssl_certificate_arn = "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"
alb_deletion_protection = false # Set to true for production

alb_deletion_protection = false
alb_idle_timeout = 180

# ================================
# EFS CONFIGURATION
# ================================
efs_throughput_mode = "provisioned"
efs_provisioned_throughput_in_mibps = 100


# ================================
# MONITORING CONFIGURATION
# ================================
enable_container_insights = true
enable_prometheus = true
log_retention_days = 30
enable_prometheus = true
log_retention_days = 30

# ================================
# COMMON TAGS
# ================================
common_tags = {
Project = "nexus-iq-server-ha"
Environment = "production" # or "development", "staging"
Environment = "production"
Terraform = "true"
Owner = "platform-team"
CostCenter = "engineering"
}

# ================================
# SECURITY NOTES
# ================================
Expand All @@ -89,23 +93,14 @@ common_tags = {
# 3. Provide an SSL certificate ARN for HTTPS termination
# 4. Restrict public access CIDRs in production
# 5. Enable deletion protection for production resources
# 6. Use specific Helm chart versions rather than "latest" in production

# ================================
# COST OPTIMIZATION NOTES
# ================================
# 1. ECS Fargate pricing based on vCPU and memory usage
# 2. Use smaller task sizes (ecs_cpu/ecs_memory) for development
# 3. Adjust backup retention periods based on requirements
# 4. Use burstable EFS throughput mode if consistent high throughput isn't needed
# 5. Consider using Fargate Spot for non-production workloads

# ================================
# HIGH AVAILABILITY NOTES
# ================================
# 1. Minimum 2 IQ Server tasks (iq_desired_count = 2)
# 2. Minimum 2 Aurora instances (aurora_instances = 2)
# 3. ECS tasks run across multiple Availability Zones
# 4. Auto scaling based on CPU and memory utilization
# 5. Service discovery for inter-task communication
# 6. Shared EFS storage for stateful data

# ================================
# L CUSTOMER PROFILE NOTES
# ================================
# This configuration is optimized for large-scale deployments:
# - 8 vCPU ARM Graviton (cost-optimized)
# - 64 GB RAM with 48 GB Java heap for policy evaluation workloads
# - Suitable for ~15,000 applications with continuous monitoring
Comment thread
mealingr marked this conversation as resolved.
Outdated
# - Database: 64 GB RAM, 500 GB storage, up to 2000 GB auto-scale
# - Aurora Multi-AZ with 2 instances for HA
# - EFS provisioned throughput for shared storage
65 changes: 46 additions & 19 deletions infra-aws-ha/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
# Sonatype IQ Server - AWS Cloud-Native HA Configuration
# L Customer Profile: 8 vCPU ARM, 64 GB RAM, 48 GB Java heap

variable "aws_region" {
description = "AWS region for resources"
Expand All @@ -11,7 +13,7 @@ variable "cluster_name" {
default = "ref-arch-iq-ha-cluster"
}


# Network Configuration
variable "vpc_cidr" {
description = "CIDR block for VPC"
type = string
Expand All @@ -25,7 +27,7 @@ variable "public_subnet_cidrs" {
}

variable "private_subnet_cidrs" {
description = "CIDR blocks for private subnets (EKS nodes)"
description = "CIDR blocks for private subnets (ECS tasks)"
type = list(string)
default = ["10.0.10.0/24", "10.0.20.0/24", "10.0.30.0/24"]
}
Expand All @@ -42,23 +44,37 @@ variable "enable_nat_gateway" {
default = true
}


# ECS Configuration - L Customer Profile
# Note: Using ARM-based Graviton processors for better price/performance
# Fargate ARM requires platform_version = "LATEST" in ECS service
variable "ecs_cpu" {
description = "CPU units for ECS task (1024 = 1 vCPU)"
description = "CPU units for ECS task (1024 = 1 vCPU). L profile: 8 vCPU (8192)"
type = number
default = 8192
}

variable "ecs_memory" {
description = "Memory for ECS task in MiB"
description = "Memory for ECS task in MiB. L profile: 64 GB (65536 MiB)"
type = number
default = 32768
default = 65536
}

variable "ecs_memory_reservation" {
description = "Soft memory limit for ECS task in MiB"
type = number
default = 24576
default = 49152 # 48 GB soft limit
}

variable "ecs_runtime_platform" {
Comment thread
mealingr marked this conversation as resolved.
Outdated
description = "ECS runtime platform configuration for ARM (Graviton)"
type = object({
cpu_architecture = string
operating_system_family = string
})
default = {
cpu_architecture = "ARM64"
operating_system_family = "LINUX"
}
}

variable "enable_container_insights" {
Expand All @@ -67,11 +83,11 @@ variable "enable_container_insights" {
default = true
}


# IQ Server Configuration
variable "iq_desired_count" {
description = "Desired number of IQ Server tasks (HA requires minimum 2)"
type = number
default = 3
default = 2

validation {
condition = var.iq_desired_count >= 2
Expand Down Expand Up @@ -115,12 +131,17 @@ variable "iq_docker_image" {
}

variable "java_opts" {
description = "Java options for IQ Server"
description = "Java options for IQ Server (L profile: 48GB heap, 75% of 64GB RAM)"
type = string
default = "-Xms24g -Xmx24g -XX:+UseG1GC -Djava.util.prefs.userRoot=/sonatype-work/javaprefs"
default = "-Xms48g -Xmx48g -XX:+UseG1GC -XX:+AlwaysPreTouch -XX:+CrashOnOutOfMemoryError -Djava.util.prefs.userRoot=/sonatype-work/javaprefs -Dinsight.threads.monitor=10"
# Note: Using 48GB heap (75% of 64GB RAM) for large-scale workloads
# Can increase to 55GB (86%) if needed for peak continuous monitoring loads
# AlwaysPreTouch: Pre-faults all heap pages during startup for consistent GC performance
# CrashOnOutOfMemoryError: Ensures clean crash for easier troubleshooting
# insight.threads.monitor=10: Enables monitoring thread pool for continuous monitoring
}


# Database Configuration (Aurora PostgreSQL)
variable "db_name" {
description = "Database name"
type = string
Expand All @@ -146,9 +167,9 @@ variable "aurora_engine_version" {
}

variable "aurora_instance_class" {
description = "Aurora instance class"
description = "Aurora instance class (ARM Graviton for better price/performance)"
type = string
default = "db.r6g.4xlarge"
default = "db.r6g.2xlarge" # 8 vCPU, 64 GB RAM, ARM Graviton
}

variable "aurora_instances" {
Expand Down Expand Up @@ -192,7 +213,7 @@ variable "db_deletion_protection" {
default = false
}


# Load Balancer Configuration
variable "ssl_certificate_arn" {
description = "ARN of SSL certificate for ALB HTTPS listener"
type = string
Expand All @@ -205,7 +226,13 @@ variable "alb_deletion_protection" {
default = false
}

variable "alb_idle_timeout" {
description = "ALB idle timeout in seconds"
type = number
default = 180
}

# EFS Configuration
variable "efs_throughput_mode" {
description = "EFS throughput mode"
type = string
Expand All @@ -223,7 +250,7 @@ variable "efs_provisioned_throughput_in_mibps" {
default = 100
}


# Logging Configuration
variable "log_retention_days" {
description = "CloudWatch log retention in days"
type = number
Expand All @@ -248,14 +275,14 @@ variable "log_archive_retention_days" {
default = 2555
}


# Monitoring Configuration
variable "enable_prometheus" {
description = "Enable Prometheus monitoring"
type = bool
default = true
}


# Common Tags
variable "common_tags" {
description = "Common tags to apply to all resources"
type = map(string)
Expand All @@ -264,4 +291,4 @@ variable "common_tags" {
Environment = "production"
Terraform = "true"
}
}
}
Loading