# Size XL - Sonatype IQ - AWS Cloud-Native Reference Architecture

This Sonatype IQ Server extra-large reference architecture describes the recommended infrastructure specifications for deploying a large-scale high-availability IQ Server environment in AWS using cloud-native services. It supports environments with **20,000–80,000 onboarded applications** and an expected throughput of approximately **405 evaluations per hour per node**, or approximately **29,160–38,880 evaluations per day total**.

This reference architecture is designed for enterprise-scale production environments that require maximum evaluation throughput, large onboarding capacity, resilient infrastructure services, and operational scalability.

## Infrastructure Specifications

This architecture includes the following layers:

- **Compute Layer** – High-availability IQ Server application cluster

- **Database Layer** – Aurora PostgreSQL metadata database

- **Storage Layer** – Shared file storage for IQ Server data

- **Network Layer** – Load balancing, connectivity, and security controls

### Compute Layer (IQ Server)

The compute layer hosts the IQ Server application cluster and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Four IQ Server nodes:

- 16 vCPU per node  
- 128 GB RAM per node

JVM configuration per node:

- `-Xms96g`  
- `-Xmx96g`

Example AWS instance types:

- `r6g.4xlarge` for ARM-based deployments  
- `r5.4xlarge` for x86-based deployments

This architecture uses four IQ Server nodes deployed behind a load balancer to provide application-level high availability, increased aggregate evaluation throughput, and operational headroom for enterprise-scale workloads.

Typical deployment patterns include the following:

- Active-active IQ Server node configuration  
- Stateless application nodes connected to shared infrastructure services  
- Application Load Balancer distributing traffic across IQ Server nodes  
- Multi-AZ deployment for all application infrastructure

### Database Layer (Aurora PostgreSQL)

The database layer stores IQ Server application metadata, policy data, configuration information, and operational state.

This layer meets the following specifications:

- Service: Amazon Aurora PostgreSQL 15+  
- Instance class: `db.r6g.4xlarge`  
- Database resources:
  - 16 vCPU  
  - 128 GB RAM

- Storage: 500 GB–2 TB auto-scaling  
- Multi-AZ with automatic failover required  
- Automated backups enabled

Aurora PostgreSQL is required at this tier to support enterprise-scale workloads, resilient database operations, and automatic failover capabilities.

### Storage Layer (Amazon EFS)

Amazon EFS provides shared persistent storage for IQ Server application data, reports, logs, and scan-related content across all IQ Server nodes.

This layer meets the following specifications:

- Service: Amazon EFS  
- Throughput mode: Elastic  
- Estimated capacity: 1.5 TB–4 TB  
- Shared storage mounted across all IQ Server nodes  
- For cost optimization, use lifecycle policies to move infrequently accessed data or files older than 30 days to EFS Infrequent Access

Elastic throughput is required for this architecture because large-scale concurrent evaluation workloads and reporting operations may generate sustained storage throughput demands across multiple nodes.

### Network and Security

This architecture uses load-balanced high-availability connectivity across multiple IQ Server nodes.

Typical deployment patterns include the following:

- Application Load Balancer in front of IQ Server nodes  
- Private connectivity between IQ Server, Aurora PostgreSQL, and EFS  
- IQ Server nodes distributed across multiple Availability Zones  
- Private subnets for database and storage infrastructure

Apply standard network security practices, including the following:

- Security Groups following least-privilege principle  
- NAT Gateway for outbound internet access  
- AWS Secrets Manager for credential management  
- CloudWatch for centralized logging and monitoring  
- TLS encryption for inbound and internal service communication  
- Restricted administrative access through bastion hosts or approved management services  
- Monitoring and alerting for infrastructure scaling, storage throughput, and database performance

## Limitations

This architecture has the following limitations:

- This architecture provides application-level high availability but does not provide cross-region disaster recovery.  
- Large evaluation spikes or rapid onboarding growth beyond the validated profile may require additional infrastructure tuning or architectural review.  
- Shared storage throughput and database performance remain critical scaling dependencies and should be continuously monitored.  
- Operational complexity is significantly higher than smaller profiles because this architecture requires coordinated management of multiple IQ Server nodes, load balancing, shared storage, Aurora PostgreSQL, and Multi-AZ infrastructure services.

## Deploying this Architecture

You can quickly deploy this reference architecture using [Sonatype's IQ Terraform configuration for AWS deployments](https://github.com/sonatype/sca-reference-architectures/tree/main). This automates the creation and configuration of all required AWS resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.