Size L - Sonatype IQ - AWS Cloud-Native Reference Architecture

This Sonatype IQ Server large reference architecture describes the recommended infrastructure specifications for deploying a high-availability IQ Server environment in AWS using cloud-native services. It supports environments with 10,000–19,999 onboarded applications and an expected throughput of approximately 310 evaluations per hour per node, or approximately 14,880–22,320 evaluations per day total.

This reference architecture is designed for production environments that require high availability, increased evaluation capacity, and resilient managed infrastructure. The large profile expands the multi-node architecture introduced in the medium profile by using three IQ Server nodes and requiring Multi-AZ database deployment.

Infrastructure Specifications

The architecture includes the following layers:

• Compute Layer – High-availability IQ Server application cluster
• Database Layer – Aurora PostgreSQL metadata database
• Storage Layer – Shared file storage for IQ Server data
• Network Layer – Load balancing, connectivity, and security controls

Compute Layer (IQ Server)

The compute layer hosts the IQ Server application cluster and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Three IQ Server nodes:

• 8 vCPU per node
• 64 GB RAM per node

JVM configuration per node:

• -Xms48g
• -Xmx48g

Example AWS instance types:

• r6g.2xlarge for ARM-based deployments
• r5.2xlarge for x86-based deployments

This architecture uses three IQ Server nodes deployed behind a load balancer to provide application-level high availability and increased aggregate evaluation throughput.

Database Layer (Aurora PostgreSQL)

The database layer stores IQ Server application metadata, policy data, configuration information, and operational state.

This layer meets the following specifications:

• Service: Amazon Aurora PostgreSQL 15 or later
• Instance class: db.r6g.2xlarge
• Database resources:
  • 8 vCPU
  • 64 GB RAM
• Storage: 200 GB–1 TB auto-scaling
• Multi-AZ required
• Automated backups enabled

Aurora PostgreSQL is required at this tier to support production-grade availability, resilient database operations, and larger-scale IQ Server workloads.

Storage Layer (Amazon EFS)

Amazon EFS provides shared persistent storage for IQ Server application data, reports, logs, and scan-related content across all IQ Server nodes.

This layer meets the following specifications:

• Service: Amazon EFS
• Throughput mode: Elastic
• Estimated capacity: 500 GB–1.5 TB
• Shared storage mounted across all IQ Server nodes
• For cost optimization, use lifecycle policies to move infrequently accessed data or files older than 30 days to EFS Infrequent Access

Elastic throughput is required for this architecture because evaluation workloads, reporting operations, and multi-node activity may generate sustained storage throughput demands.

Network and Security

This architecture uses load-balanced high-availability connectivity across multiple IQ Server nodes.

Typical deployment patterns include the following:

• Application Load Balancer in front of IQ Server nodes
• Private connectivity between IQ Server, Aurora PostgreSQL, and EFS
• IQ Server nodes deployed across multiple Availability Zones
• Private subnets for database and storage infrastructure

Apply standard network security practices, including the following:

• Security Groups following least-privilege principle
• NAT Gateway for outbound internet access
• AWS Secrets Manager for credential management
• CloudWatch for centralized logging and monitoring
• TLS encryption for inbound and internal service communication
• Restricted administrative access through bastion hosts or approved management services

Limitations

This architecture has the following limitations:

• This architecture provides application-level high availability but does not provide cross-region disaster recovery.
• Increasing scan volume or concurrent evaluations beyond the recommended profile may require additional node scaling or migration to the XL profile.
• Shared storage throughput and database performance may become bottlenecks if infrastructure sizing is not adjusted alongside workload growth.
• Operational complexity is higher than smaller profiles because this architecture requires multiple IQ Server nodes, load balancing, shared storage, Aurora PostgreSQL, and Multi-AZ infrastructure.

Deploying this Architecture

You can quickly deploy this reference architecture using Sonatype's IQ Terraform configuration for AWS deployments. This automates the creation and configuration of all required AWS resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.