Size XL - Sonatype IQ - AWS Cloud-Native Reference Architecture

This Sonatype IQ Server extra-large reference architecture describes the recommended infrastructure specifications for deploying a large-scale high-availability IQ Server environment in AWS using cloud-native services. It supports environments with 20,000–80,000 onboarded applications and an expected throughput of approximately 405 evaluations per hour per node, or approximately 29,160–38,880 evaluations per day total.

This reference architecture is designed for enterprise-scale production environments that require maximum evaluation throughput, large onboarding capacity, resilient infrastructure services, and operational scalability.

Infrastructure Specifications

This architecture includes the following layers:

• Compute Layer – High-availability IQ Server application cluster

• Database Layer – Aurora PostgreSQL metadata database

• Storage Layer – Shared file storage for IQ Server data

• Network Layer – Load balancing, connectivity, and security controls

Compute Layer (IQ Server)

The compute layer hosts the IQ Server application cluster and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Four IQ Server nodes:

• 16 vCPU per node
• 128 GB RAM per node

JVM configuration per node:

• -Xms96g
• -Xmx96g

Example AWS instance types:

• r6g.4xlarge for ARM-based deployments
• r5.4xlarge for x86-based deployments

This architecture uses four IQ Server nodes deployed behind a load balancer to provide application-level high availability, increased aggregate evaluation throughput, and operational headroom for enterprise-scale workloads.

Typical deployment patterns include the following:

• Active-active IQ Server node configuration
• Stateless application nodes connected to shared infrastructure services
• Application Load Balancer distributing traffic across IQ Server nodes
• Multi-AZ deployment for all application infrastructure

Database Layer (Aurora PostgreSQL)

The database layer stores IQ Server application metadata, policy data, configuration information, and operational state.

This layer meets the following specifications:

• Service: Amazon Aurora PostgreSQL 15+

• Instance class: db.r6g.4xlarge

• Database resources:

  • 16 vCPU
  • 128 GB RAM

• Storage: 500 GB–2 TB auto-scaling

• Multi-AZ with automatic failover required

• Automated backups enabled

Aurora PostgreSQL is required at this tier to support enterprise-scale workloads, resilient database operations, and automatic failover capabilities.

Storage Layer (Amazon EFS)

Amazon EFS provides shared persistent storage for IQ Server application data, reports, logs, and scan-related content across all IQ Server nodes.

This layer meets the following specifications:

• Service: Amazon EFS
• Throughput mode: Elastic
• Estimated capacity: 1.5 TB–4 TB
• Shared storage mounted across all IQ Server nodes
• For cost optimization, use lifecycle policies to move infrequently accessed data or files older than 30 days to EFS Infrequent Access

Elastic throughput is required for this architecture because large-scale concurrent evaluation workloads and reporting operations may generate sustained storage throughput demands across multiple nodes.

Network and Security

This architecture uses load-balanced high-availability connectivity across multiple IQ Server nodes.

Typical deployment patterns include the following:

• Application Load Balancer in front of IQ Server nodes
• Private connectivity between IQ Server, Aurora PostgreSQL, and EFS
• IQ Server nodes distributed across multiple Availability Zones
• Private subnets for database and storage infrastructure

Apply standard network security practices, including the following:

• Security Groups following least-privilege principle
• NAT Gateway for outbound internet access
• AWS Secrets Manager for credential management
• CloudWatch for centralized logging and monitoring
• TLS encryption for inbound and internal service communication
• Restricted administrative access through bastion hosts or approved management services
• Monitoring and alerting for infrastructure scaling, storage throughput, and database performance

Limitations

This architecture has the following limitations:

• This architecture provides application-level high availability but does not provide cross-region disaster recovery.
• Large evaluation spikes or rapid onboarding growth beyond the validated profile may require additional infrastructure tuning or architectural review.
• Shared storage throughput and database performance remain critical scaling dependencies and should be continuously monitored.
• Operational complexity is significantly higher than smaller profiles because this architecture requires coordinated management of multiple IQ Server nodes, load balancing, shared storage, Aurora PostgreSQL, and Multi-AZ infrastructure services.

Deploying this Architecture

You can quickly deploy this reference architecture using Sonatype's IQ Terraform configuration for AWS deployments. This automates the creation and configuration of all required AWS resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.