AWS wellarchitected documentation change
Summary
Updated network redundancy guidance with expanded implementation details, including multi-AZ deployments, load balancing, automatic failover mechanisms, and cross-Region connectivity strategies for generative AI workloads
Security assessment
The changes focus on improving reliability and fault tolerance through network redundancy rather than addressing specific security vulnerabilities. While mentions of PrivateLink and private network connections have security benefits, these are presented as part of general reliability best practices rather than direct security controls. No evidence of patching vulnerabilities or addressing security incidents.
Diff
diff --git a/wellarchitected/latest/generative-ai-lens/genrel02-bp01.md b/wellarchitected/latest/generative-ai-lens/genrel02-bp01.md index 03e0d3242..18ff03d17 100644 --- a//wellarchitected/latest/generative-ai-lens/genrel02-bp01.md +++ b//wellarchitected/latest/generative-ai-lens/genrel02-bp01.md @@ -7 +7 @@ Implementation guidanceResources -# GENREL02-BP01 Implement redundant network connections between model endpoints and supporting infrastructure +# GENREL02-BP01 Implement redundant network connections among model endpoints and supporting infrastructure @@ -9 +9 @@ Implementation guidanceResources -Implement network connection redundancy between components in your generative AI application. +Implement network connection redundancy among components in your generative AI application. @@ -11 +11 @@ Implement network connection redundancy between components in your generative AI -**Desired outcome:** When implemented, this best practice improves the reliability of your generative AI workload by reducing the likelihood of performance degradation due to network configuration. +**Desired outcome:** When implemented, this best practice improves the reliability of your generative AI workload by reducing the likelihood of performance degradation due to network issues. @@ -19 +19 @@ Implement network connection redundancy between components in your generative AI -Deploy your generative AI application across multiple subnets within a VPC. Use AWS PrivateLink or a similar network technology to facilitate secure, private network communications between VPC-hosted applications and other AWS services. Use a multi-AZ architecture, with applications deployed across at least two Availability Zones. In addition to deploying applications with high availability, deploy vector databases and agentic systems across multiple Availability Zones as well. With vector database solutions like Amazon OpenSearch Service Serverless, customers can configure their OpenSearch cluster deployment across multiple Availability Zones, creating VPC Endpoints to have reliable network connectivity to the cluster. Similar considerations should be extended to agentic workflows. On Amazon Bedrock, agent workflows make calls to API endpoints and AWS Lambda functions. Consider deploying these capabilities in a multi-AZ deployment as well. +Implement network connection redundancy between components in your generative AI application to provide high availability and fault tolerance. This involves creating multiple network paths between critical components, using technologies such as multi-AZ deployments, cross-Region connectivity, and software-defined networking. Consider implementing load balancers to distribute traffic across redundant connections and automatically route around failures. @@ -21 +21,9 @@ Deploy your generative AI application across multiple subnets within a VPC. Use -For multi-Region deployments, continue deploying resources into VPCs, but consider using one of the various multi-Region VPC communication services to facilitate secure, reliable network connectivity for your services and applications. Customers can use network configuration tools like VPC peering, AWS Transit Gateway, or Amazon VPC Lattice to connect their applications and services in VPCs across Regions. Consider combining this capability with Amazon Bedrock's cross-Region inference capabilities for high availability network connectivity across Regions. +Deploy your generative AI application across multiple subnets within a VPC. Use AWS PrivateLink or a similar network technology to facilitate secure, private network communications between VPC-hosted applications and other AWS services. Use a multi-AZ architecture, with applications deployed across at least two Availability Zones. + +In addition to deploying applications with high availability, deploy vector databases and agentic systems across multiple Availability Zones as well. With vector database solutions like Amazon OpenSearch Service Serverless, you can configure your OpenSearch cluster deployment across multiple Availability Zones, creating VPC Endpoints to have reliable network connectivity to the cluster. + +Similar considerations should be extended to agentic workflows. On Amazon Bedrock, agent workflows make calls to API endpoints and AWS Lambda functions. Consider deploying these capabilities in a multi-AZ deployment as well. + +For multi-Region deployments, implement a global traffic management solution to route requests to the nearest available endpoint. Use private network connections where possible to improve security and reduce latency. Implement automatic failover mechanisms to reroute traffic in case of network issues. Continue deploying resources into VPCs, but consider using one of the various multi-Region VPC communication services to facilitate secure, reliable network connectivity for your services and applications. + +Use network configuration tools like VPC peering, AWS Transit Gateway, or Amazon VPC Lattice to connect your applications and services in VPCs across Regions. Consider combining this capability with Amazon Bedrock's cross-Region inference capabilities for high availability network connectivity across Regions. @@ -25 +33,9 @@ For multi-Region deployments, continue deploying resources into VPCs, but consid - 1. Determine the VPCs that host complementary systems for your generative AI workload. + 1. Identify critical network paths in your generative AI architecture: + + * Map dependencies between foundation models, databases, and other components + + * Determine required bandwidth and latency for each connection + + 2. Design redundant network topology: + + * Implement multi-AZ deployments for high availability @@ -27 +43 @@ For multi-Region deployments, continue deploying resources into VPCs, but consid - * Develop reliable network communications across (for example, VPC peering, VPC Lattice, or Transit Gateway). + * Set up cross-Region connectivity for disaster recovery @@ -29 +45 @@ For multi-Region deployments, continue deploying resources into VPCs, but consid - 2. Create private network connections across the various service and application endpoints in consideration. + * Configure load balancers for traffic distribution @@ -31 +47 @@ For multi-Region deployments, continue deploying resources into VPCs, but consid - 3. Ensure private network connections are replicated across subnets in multiple Availability Zones within a Region. + 3. Implement private networking: @@ -33 +49,15 @@ For multi-Region deployments, continue deploying resources into VPCs, but consid - * Consult a network specialist for multi-Region deployments which suit your architecture requirements. Consider using Amazon VPC Lattice, Amazon Transit Gateway, or other cross-Region networking solutions to facilitate network traffic. + * Use VPC peering or transit gateways for secure inter-component communication + + * Set up VPN or direct connect for on-premises integration if required + + 4. Configure automatic failover: + + * Implement health checks for network paths + + * Set up automated failover mechanisms using DNS or overlay networking + + 5. Test and validate redundancy: + + * Conduct failure simulations to verify failover effectiveness + + * Perform regular failover drills to verify operational readiness @@ -40 +70 @@ For multi-Region deployments, continue deploying resources into VPCs, but consid -**Related practices:** +**Related best practices:** @@ -49 +79 @@ For multi-Region deployments, continue deploying resources into VPCs, but consid -**Related guides, videos, and documentation:** +**Related documents:** @@ -57,0 +88,2 @@ For multi-Region deployments, continue deploying resources into VPCs, but consid + * [Connect to Amazon services using AWS PrivateLink in Amazon SageMaker AI](https://aws.amazon.com/blogs/machine-learning/connect-to-amazon-services-using-aws-privatelink-in-amazon-sagemaker/) +