AWS architecture designed on the six pillars of the Well-Architected Framework, with documented decisions and explicit trade-offs.
The context
Cloud architecture is not drawing a diagram and provisioning resources. It is making engineering decisions that will determine, for years to come, how much your operation costs, how fast your team ships and what happens when something fails at three in the morning. Every decision carries a trade-off, and the value of a good architect lies in making those trade-offs visible before they turn into technical debt.
Núvoli designs AWS environments following the Well-Architected Framework, which AWS organizes into six pillars: operational excellence, security, reliability, performance efficiency, cost optimization and sustainability. In practice, this means an architecture decision is never judged by cost alone, nor by performance alone. It is assessed across all six dimensions, and whatever is left out is recorded as a known risk.
We work with a multi-account structure from day one. The AWS Security Reference Architecture recommends organizing accounts inside an AWS Organization into Organizational Units with defined purposes, isolating production, development, security and network environments. That limits blast radius, simplifies auditing and avoids the classic scenario where a single account grows until nobody knows what is inside it anymore.
When this solution applies
If two or more of these scenarios sound familiar, it is worth a conversation.
Your AWS infrastructure grew organically and nobody has the full picture of it
There are resources running that no team claims as their own
Production and development environments share the same AWS account
The AWS bill climbs month after month with no clear link to business growth
You need documented architecture for an audit, a client or an investor
A recent incident exposed a single point of failure nobody had mapped
The exact composition depends on your environment and on the requirements identified during the assessment. This is the baseline we work from for this solution.
AWS Organizations
Multi-account structure with Organizational Units, service control policies and consolidated billing
AWS Control Tower
Landing zone with preventive and detective guardrails applied from the moment each account is created
Amazon VPC
Network segmentation into public and private subnets, with explicit routes and security groups
AWS Transit Gateway
Hub-and-spoke network topology connecting VPCs, accounts and the on-premises environment
Elastic Load Balancing
Traffic distribution across Availability Zones with health checks and automatic failover
Amazon EC2 Auto Scaling
Capacity adjusted to real demand, avoiding permanent overprovisioning
Amazon RDS / Amazon Aurora
Managed relational database with Multi-AZ deployment and read replicas
AWS CloudFormation / AWS CDK
Infrastructure as code: the architecture design becomes a versioned, reproducible artifact
AWS Well-Architected Tool
Formal review against the six pillars, with a prioritized improvement plan
AWS Cost Explorer and AWS Budgets
Cost visibility and alerts by account, tag and service
Methodology
How we run it
1
Discovery and inventory
We map what exists today: accounts, resources, dependencies, data flows and who owns what. Without a reliable inventory, any later design is speculation.
2
Business requirements and constraints
We translate business goals into measurable architectural requirements: expected availability, acceptable maintenance windows, regulatory requirements, cost ceiling and growth projection.
3
Well-Architected review
We assess the current environment across the six pillars using the AWS Well-Architected Tool. The output is a list of risks ranked by severity, not a generic report.
4
Target architecture design
We produce the intended architecture with diagrams, recorded decisions (ADRs) and the trade-offs of each choice spelled out. You understand why every piece is there.
5
Infrastructure as code
We materialize the architecture in CloudFormation or CDK. The environment becomes reproducible, reviewable in a pull request and recoverable from the repository.
6
Rollout and knowledge transfer
We deploy in stages, validating each one, and train your team on the delivered environment. Architecture that only the vendor understands is a risk, not an asset.
Deliverables
What you receive
Current and target architecture diagrams (network, application and data views)
Well-Architected review report with risks prioritized by severity
Architecture decision records (ADRs) with documented trade-offs
Versioned, reviewable infrastructure as code repository
Multi-account structure with Organizational Units and guardrails configured
Tagging and cost allocation model by cost center
Operational runbooks for critical routines
Evolution plan with prioritized next steps
Indicators
What we measure
Availability
Multi-AZ architectures with automatic failover raise the availability ceiling of the application
Cost per business unit
Tagging and right-sizing make visible how much each product, client or environment costs
Provisioning time
Environments that used to take days are created in minutes through IaC
Audit coverage
Share of resources that are traceable, tagged and covered by guardrails
References
Case studies published by AWS
Market references documented by AWS itself in equivalent scenarios. Each card links to the original story published on the AWS site.
Hospital Sírio-Libanês
Brazil
After migrating workloads and building a data lake on AWS, the hospital saw environment complexity grow and cloud costs run over budget. The work involved reorganizing the financial management of the environment.
Published result
AWS published that cloud financial management was reshaped in five months.
Creating AWS accounts for new projects was a manual, time-consuming task that delayed the start of any initiative. The bank automated account provisioning.
Published result
According to AWS, the manual process took around five days on average per project before automation.
The cases above are customer stories published by Amazon Web Services. The results cited belong to the companies mentioned and serve as a reference for what is technically achievable on AWS. They do not represent results delivered by Núvoli, nor a guarantee of equivalent performance, since every environment has its own context.
Technical basis
Official AWS documentation behind this solution
Our approach is not opinion. It follows guidance documented by AWS, and you can check the source yourself.
Want to assess cloud architecture in your environment?
The first step is an assessment of your current setup, at no cost and with no commitment. You come out of it with risks mapped and priorities defined, even if you decide not to move forward with Núvoli.