Size S - Sonatype IQ - AWS Cloud-Native Reference Architecture

This Sonatype IQ Server small reference architecture describes the recommended infrastructure specifications for deploying a single IQ Server instance in AWS using cloud-native services. It supports environments with 500–1,999 onboarded applications and an expected throughput of approximately 150–220 evaluations per hour, or approximately 3,600–5,280 evaluations per day.

This reference architecture is appropriate for small-to-medium production environments that require increased evaluation throughput, larger application onboarding capacity, and improved infrastructure resilience compared to the XS profile. While this architecture still uses a single IQ Server node, it introduces stronger production recommendations around database resilience and storage scalability.

Infrastructure Specifications

The architecture includes the following layers:

• Compute Layer – IQ Server application runtime

• Database Layer – PostgreSQL metadata database

• Storage Layer – Shared file storage for IQ Server data

• Network Layer – Connectivity, access control, and optional load balancing

Compute Layer (IQ Server)

The compute layer hosts the IQ Server application and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Single IQ Server node:

• 4 vCPU

• 32 GB RAM

JVM configuration:

• -Xms24g

• -Xmx24g

Example AWS instance types:

• r6g.xlarge for ARM-based deployments

• r5.xlarge for x86-based deployments

Database Layer (RDS PostgreSQL)

Amazon RDS provides high-performance database operations and scalable storage for production IQ Server deployments.

This layer meets the following specifications:

• Service: Amazon RDS for PostgreSQL 15 or later

• Instance class:

  • db.r6g.large or
  • db.t4g.large

• Database resources:

  • 2 vCPU
  • 16 GB RAM (db.r6g.large) or
  • 8 GB RAM (db.t4g.large)

• Storage:

  • 50 GB gp3
  • Auto-scaling up to 200 GB

• Multi-AZ recommended for production deployments

• 7-day automated retention for backups

Storage Layer (Amazon EFS)

Amazon EFS provides persistent shared storage for IQ Server operational data, reporting artifacts, and scan-related content.

This layer meets the following specifications:

• Service: Amazon EFS

• Throughput mode:

  • Elastic (recommended) or
  • Bursting

• Estimated capacity: 100–300 GB

• For cost optimization, use lifecycle policies to move infrequently accessed data or files older than 30 days to EFS Infrequent Access

Elastic throughput is recommended for production environments because it automatically scales with workload demand and reduces the risk of throughput bottlenecks during peak evaluation periods.

Network and Security

Typical deployment patterns include the following:

• Direct access to the IQ Server node

• Optional Application Load Balancer in front of the IQ Server node

• Private connectivity between IQ Server, PostgreSQL, and EFS

Apply standard network security practices, including the following:

• Security Groups following least-privilege principle

• NAT Gateway for outbound internet access

• AWS Secrets Manager for credential management

• CloudWatch for unified logging and monitoring

• Private subnets for database and storage services

Limitations

This architecture has the following limitations:

• This architecture supports a single IQ Server instance only. It does not support a multi-instance high-availability deployment.

• Increasing scan volume or concurrent evaluations beyond the recommended profile may lead to degraded performance.

• While Multi-AZ is recommended for the database layer, the application layer itself is not redundant.

• This architecture is not intended for cross-region disaster recovery and does not provide automatic regional failover.

Deploying this Architecture

You can quickly deploy this reference architecture using Sonatype's IQ Terraform configuration for AWS deployments. This automates the creation and configuration of all required AWS resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.