Size XS - Sonatype IQ - AWS Cloud-Native Reference Architecture

This Sonatype IQ Server extra-small reference architecture describes the minimum supported infrastructure specifications for deploying a single IQ Server instance in AWS using cloud-native services. It supports environments with fewer than 500 applications and an expected throughput of approximately 80–120 evaluations per hour, or approximately 1,920–2,880 evaluations per day.

This reference architecture represents the smallest supported infrastructure footprint for running IQ Server. It is appropriate for evaluation environments, proof-of-concept deployments, and small teams with light evaluation volume. It is not designed for high availability and is not recommended for production environments that require automatic failover or continuous availability.

Infrastructure Specifications

The architecture includes the following layers:

• Compute Layer – IQ Server application runtime

• Database Layer – PostgreSQL metadata database

• Storage Layer – Shared file storage for IQ Server data

• Network Layer – Connectivity, access control, and optional load balancing

Compute Layer (IQ Server)

The compute layer hosts the IQ Server application and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Single IQ Server node:

• 2 vCPU

• 16 GB RAM

JVM configuration:

• -Xms12g

• -Xmx12g

Example AWS instance types:

• r6g.large for ARM-based deployments

• r5.large for x86-based deployments

This architecture uses a single IQ Server node. Because it does not include multiple application nodes, it does not provide application-level high availability.

Database Layer (RDS PostgreSQL)

Amazon RDS provides high-performance database operations and fast storage with automatic scaling.

This layer meets the following specifications:

• Service: Amazon RDS for PostgreSQL 15 or later

• Instance class: db.t4g.medium

• Database resources:

• 2 vCPU

• 4 GB RAM

• Storage:

• 20 GB gp3

• Auto-scaling up to 100 GB

• Multi-AZ optional; recommended for production

• 7-day automated retention for backups

Storage Layer (Amazon EFS)

Amazon EFS provides persistent data storage and log aggregation. This layer meets the following specifications:

• Service: Amazon EFS

• Throughput mode: Bursting (appropriate for low-usage environments where evaluation activity is light/intermittent)

• Estimated capacity: 50–100 GB

• For cost optimization, use lifecycle policies to move infrequently accessed data/files older than 30 days to EFS Infrequent Access

Network and Security

Typical deployment patterns include the following:

• Direct access to the IQ Server node

• Optional Application Load Balancer in front of the IQ Server node

• Private connectivity between IQ Server, PostgreSQL, and EFS

Apply standard network security practices, including the following:

• Security Groups following least-privilege principle

• NAT Gateway for outbound internet access

• AWS Secrets Manager for credential management

• CloudWatch for unified logging

Limitations

This architecture has the following limitations:

• This architecture supports a single IQ instance only. It does not support a multi-instance high-availability deployment.

• Increasing scan volume or concurrent evaluations beyond the recommended profile may lead to degraded performance.

• While RDS can use Multi-AZ for database resilience, the application layer itself is not redundant.

• This architecture is not intended for disaster recovery and does not provide cross-region failover.

Deploying this Architecture

You can quickly deploy this reference architecture using Sonatype's IQ Terraform configuration for AWS deployments. This automates the creation and configuration of all required AWS resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.