Size M - Sonatype IQ - AWS Cloud-Native Reference Architecture

This Sonatype IQ Server medium reference architecture describes the recommended infrastructure specifications for deploying a high-availability IQ Server environment in AWS using cloud-native services. It supports environments with 2,000–9,999 onboarded applications and an expected throughput of approximately 310 evaluations per hour per node, or approximately 7,440 evaluations per day per node.

This reference architecture introduces a multi-node IQ Server deployment designed for production environments that require improved scalability, higher evaluation throughput, and application-level redundancy. The M profile represents the transition point from single-instance deployments to clustered high-availability architectures.

Infrastructure Specifications

This architecture includes the following layers:

• Compute Layer – High-availability IQ Server application cluster
• Database Layer – PostgreSQL metadata database
• Storage Layer – Shared file storage for IQ Server data
• Network Layer – Load balancing, connectivity, and security controls

Compute Layer (IQ Server)

The compute layer hosts the IQ Server application cluster and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Two IQ Server nodes:

• 8 vCPU per node
• 64 GB RAM per node

JVM configuration per node:

• -Xms48g
• -Xmx48g

Example AWS instance types:

• r6g.2xlarge for ARM-based deployments
• r5.2xlarge for x86-based deployments

This architecture uses two IQ Server nodes deployed behind a load balancer to provide application-level high availability and increased evaluation throughput.

Database Layer (RDS PostgreSQL or Aurora PostgreSQL)

The database layer stores IQ Server application metadata, policy data, configuration information, and operational state.

This layer meets the following specifications:

• Service:
  • Amazon RDS for PostgreSQL 15+ or
  • Amazon Aurora PostgreSQL
• Instance class: db.r6g.2xlarge
• Database resources:
  • 8 vCPU
  • 64 GB RAM
• Storage:
  • 100 GB gp3
  • Auto-scaling up to 500 GB
• Multi-AZ recommended
• Automated backups enabled

Storage Layer (Amazon EFS)

Amazon EFS provides shared persistent storage for IQ Server application data, reports, logs, and scan-related content across all IQ Server nodes.

This layer meets the following specifications:

• Service: Amazon EFS
• Throughput mode: Elastic
• Estimated capacity: 200–500 GB
• Shared storage mounted across all IQ Server nodes
• For cost optimization, use lifecycle policies to move infrequently accessed data or files older than 30 days to EFS Infrequent Access

Elastic throughput is recommended for this architecture because evaluation workloads and reporting operations may generate sustained storage throughput demands across multiple nodes.

Network and Security

This architecture introduces load-balanced high-availability connectivity across multiple IQ Server nodes.

Typical deployment patterns include the following:

• Application Load Balancer in front of IQ Server nodes
• Private connectivity between IQ Server, PostgreSQL, and EFS
• IQ Server nodes deployed across multiple Availability Zones
• Private subnets for database and storage infrastructure

Apply standard network security practices, including:

• Security Groups following least-privilege principle
• NAT Gateway for outbound internet access
• AWS Secrets Manager for credential management
• CloudWatch for centralized logging and monitoring
• TLS encryption for inbound and internal service communication
• Restricted administrative access through bastion hosts or approved management services

Limitations

This architecture has the following limitations:

• While this architecture provides application-level high availability, it does not provide cross-region disaster recovery.
• Increasing scan volume or concurrent evaluations significantly beyond the recommended profile may require additional node scaling.
• Shared storage throughput and database performance may become bottlenecks if infrastructure sizing is not adjusted alongside workload growth.
• Operational complexity increases compared to single-instance deployments because clustered deployments require load balancing, shared storage, and coordinated infrastructure management.

Deploying this Architecture

You can quickly deploy this reference architecture using Sonatype's IQ Terraform configuration for AWS deployments. This automates the creation and configuration of all required AWS resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.