# Size XS - Sonatype IQ - AWS Cloud-Native Reference Architecture

This Sonatype IQ Server extra-small reference architecture describes the minimum supported infrastructure specifications for deploying a single IQ Server instance in AWS using cloud-native services. It supports environments with **fewer than 500 applications** and an expected throughput of approximately **80–120 evaluations per hour**, or approximately **1,920–2,880 evaluations per day**.

This reference architecture represents the smallest supported infrastructure footprint for running IQ Server. It is appropriate for evaluation environments, proof-of-concept deployments, and small teams with light evaluation volume. It is not designed for high availability and is not recommended for production environments that require automatic failover or continuous availability.

## Infrastructure Specifications

The architecture includes the following layers:

- **Compute Layer** – IQ Server application runtime

- **Database Layer** – PostgreSQL metadata database

- **Storage Layer** – Shared file storage for IQ Server data

- **Network Layer** – Connectivity, access control, and optional load balancing

### Compute Layer (IQ Server)

The compute layer hosts the IQ Server application and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Single IQ Server node:

- 2 vCPU

- 16 GB RAM

JVM configuration:

- `-Xms12g`

- `-Xmx12g`

Example AWS instance types:

- `r6g.large` for ARM-based deployments

- `r5.large` for x86-based deployments

This architecture uses a single IQ Server node. Because it does not include multiple application nodes, it does not provide application-level high availability.

### Database Layer (RDS PostgreSQL)

Amazon RDS provides high-performance database operations and fast storage with automatic scaling.

This layer meets the following specifications:

- Service: Amazon RDS for PostgreSQL 15 or later

- Instance class: `db.t4g.medium`

- Database resources:

- 2 vCPU

- 4 GB RAM

- Storage:

- 20 GB gp3

- Auto-scaling up to 100 GB

- Multi-AZ optional; recommended for production

- 7-day automated retention for backups

### Storage Layer (Amazon EFS)

Amazon EFS provides persistent data storage and log aggregation. This layer meets the following specifications:

- Service: Amazon EFS

- Throughput mode: Bursting (appropriate for low-usage environments where evaluation activity is light/intermittent)

- Estimated capacity: 50–100 GB

- For cost optimization, use lifecycle policies to move infrequently accessed data/files older than 30 days to EFS Infrequent Access

### Network and Security

Typical deployment patterns include the following:

- Direct access to the IQ Server node

- Optional Application Load Balancer in front of the IQ Server node

- Private connectivity between IQ Server, PostgreSQL, and EFS

Apply standard network security practices, including the following:

- Security Groups following least-privilege principle

- NAT Gateway for outbound internet access

- AWS Secrets Manager for credential management

- CloudWatch for unified logging

## Limitations

This architecture has the following limitations:

- This architecture supports a single IQ instance only. It does not support a multi-instance high-availability deployment.

- Increasing scan volume or concurrent evaluations beyond the recommended profile may lead to degraded performance.

- While RDS can use Multi-AZ for database resilience, the application layer itself is not redundant.

- This architecture is not intended for disaster recovery and does not provide cross-region failover.

## Deploying this Architecture

You can quickly deploy this reference architecture using [Sonatype's IQ Terraform configuration for AWS deployments](https://github.com/sonatype/sca-reference-architectures/tree/main). This automates the creation and configuration of all required AWS resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.