2 The AWS Well-Architected Framework · AWS Cloud Practitioner

In this chapter you will learn what the AWS Well-Architected Framework is and why AWS created it, the six pillars (Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability) and their key design principles, how a simple architecture improves when you apply the pillars, how the AWS Well-Architected Tool and Lenses support reviews, and how the exam phrases pillar questions. This chapter maps to Domain 1, Cloud Concepts, Task Statement 1.2 (identify design principles of the AWS Cloud), and supports Task Statement 1.1.

2.1 What the framework is

Imagine asking ten experienced builders to inspect a house. Each will check the foundation, the wiring, the plumbing, and the roof, because those are the things that make a house safe and livable regardless of its style. The AWS Well-Architected Framework does the same for cloud workloads. It is a set of questions, best practices, and design principles that AWS solutions architects developed from reviewing thousands of customer architectures.

The framework helps you answer one question: is this workload built in a way that will be secure, reliable, efficient, and cost-effective over time? It does not tell you which product to buy or force a single “correct” design. Instead, it gives you a consistent way to evaluate trade-offs and find risks.

The framework is organized into six pillars:

1. Operational Excellence
2. Security
3. Reliability
4. Performance Efficiency
5. Cost Optimization
6. Sustainability

Figure 2.1: The six pillars of the AWS Well-Architected Framework, resting on a foundation of general design principles. Sustainability was added as the sixth pillar in 2021.

A memory aid many learners use is “SPORCS”: Security, Performance efficiency, Operational excellence, Reliability, Cost optimization, Sustainability. The order does not matter for the exam; knowing all six names and what each covers does.

Good to know

In the framework, a workload is a set of components that together deliver business value, such as an online store or a payroll system. A component is the code, configuration, and AWS resources that together deliver against a requirement. Reviews are always done per workload.

General design principles

Before diving into the pillars, the framework lists general design principles that apply across all of them. They describe what the cloud makes possible that was hard on-premises:

Stop guessing your capacity needs. Scale up and down automatically instead of sizing for an estimated peak. Test systems at production scale. Create a full-size test environment on demand, then delete it. Automate with architectural experimentation in mind. Use automation to create and replicate systems at low cost.

Consider evolutionary architectures. Designs can change over time as needs change, instead of being fixed at launch.

Drive architectures using data. Collect data on how your architecture behaves and use it to make decisions. Improve through game days. Simulate events, such as a traffic surge or a failure, to test how your system and people respond.

2.2 Operational Excellence

Focus: running and monitoring systems to deliver business value, and continually improving processes and procedures. This pillar is about how you operate. It covers how teams organize, how they deploy changes, how they know whether a system is healthy, and how they learn from mistakes.

Design principles

Organize teams around business outcomes. Align team structure, leadership, and goals with what the business needs.

Safely automate where possible (perform operations as code). Older versions of the framework, and many exam questions, use the phrase “perform operations as code”. Define infrastructure and operational procedures as code (for example, AWS CloudFormation templates) so they can be versioned, reviewed, and run consistently, limiting human error.

Make frequent, small, reversible changes. Small changes are easier to test and easier to roll back if something goes wrong.

Refine operations procedures frequently. Review and improve runbooks as the workload evolves.

Anticipate failure. Run “pre-mortem” exercises to find potential failures and test your responses. Learn from all operational events and metrics. Review successes and failures and share lessons across teams. Use managed services. Reduce operational burden by letting AWS run what it can.

Implement observability for actionable insights. Understand workload behavior through metrics, logs, and traces.

Related services

AWS CloudFormation (infrastructure as code), Amazon CloudWatch (metrics, logs, alarms), AWS Systems Manager (operational tasks across many servers), AWS X-Ray (tracing requests through an application), AWS Config (recording configuration changes).

Real-world example

Real-world scenario: An online ticketing company deployed changes manually every two weeks, and each release took a long night with frequent rollbacks. It moved its infrastructure into CloudFormation templates, adopted small daily deployments through an automated pipeline, and set CloudWatch alarms on error rates. Releases became routine, and when a change did cause errors, the alarm triggered an automatic rollback within minutes. That is Operational Excellence in practice.

2.3 Security

Focus: protecting data, systems, and assets, and using cloud technologies to improve your security posture.

Design principles

Implement a strong identity foundation. Apply the principle of least privilege: give every person and system only the permissions they need. Centralize identity management and avoid long-term credentials.

Maintain traceability. Monitor, alert on, and audit actions and changes in real time. Integrate logs (for example, from AWS CloudTrail) with automated responses.

Apply security at all layers. Use defense in depth: protect the network edge, the VPC, subnets, load balancers, instances, operating systems, and application code, not just one layer.

Automate security best practices. Software-based security controls, defined as code, scale better than manual ones. Protect data in transit and at rest. Classify data by sensitivity and use encryption, tokenization, and access control where appropriate.

Keep people away from data. Reduce direct human access to data to lower the risk of mishandling or error. Prepare for security events. Have incident management processes and run simulations.

Related services

AWS Identity and Access Management (IAM), IAM Identity Center, AWS CloudTrail, AWS Key Management Service (KMS), AWS Shield, AWS WAF, Amazon GuardDuty, AWS Security Hub.

Exam tip

“Least privilege”, “encryption”, “MFA”, “traceability”, and “audit logs” in a question almost always point to the Security pillar. If the question asks about protecting data confidentiality or integrity, it is also Security.

2.4 Reliability

Focus: the ability of a workload to perform its intended function correctly and consistently when expected, including the ability to recover from failures and meet demand.

Design principles

Automatically recover from failure. Monitor key performance indicators and trigger automated recovery when a threshold is breached.

Test recovery procedures. In the cloud you can deliberately cause failures to verify that recovery works, rather than waiting for a real outage.

Scale horizontally to increase aggregate workload availability. Replace one large resource with multiple small resources so a single failure has less impact.

Stop guessing capacity. Monitor demand and add or remove resources automatically, so you are neither overloaded nor wasteful.

Manage change through automation. Make infrastructure changes with automation, which can be tracked and reviewed.

Related services

Amazon EC2 Auto Scaling, Elastic Load Balancing, Amazon Route 53 health checks, Amazon RDS Multi-AZ deployments, AWS Backup, Amazon CloudWatch, Service Quotas.

Reliability in action: before and after

The easiest way to see Reliability (and several other pillars) at work is to compare two designs for the same web application.

the whole site is down.

If traffic doubles, pages

slow down for everyone.

Figure 2.2: A single EC2 instance in one Availability Zone (left) has a single point of failure. The improved design (right) uses a load balancer,

an Auto Scaling group across two Availability Zones, and a Multi-AZ database.

In the before design, one EC2 instance runs both the web server and the database. If the instance fails, or the Availability Zone has a problem, the whole site goes down. If traffic doubles, the instance slows down and nobody adds capacity. In the after design:

An Application Load Balancer receives all traffic and sends it only to healthy instances.

An Auto Scaling group keeps a minimum number of instances running across two Availability Zones, replaces any instance that fails a health check, and adds instances when demand rises.

The database moves to Amazon RDS with a Multi-AZ deployment, so a standby copy in a second Availability Zone takes over automatically if the primary fails.

The after design improves Reliability (no single point of failure), Performance Efficiency (capacity grows with demand), Operational Excellence (failed instances are replaced automatically, and the database is managed), and even Cost Optimization (Auto Scaling removes instances when traffic drops).

2.5 Performance Efficiency

Focus: using computing resources efficiently to meet system requirements, and maintaining that efficiency as demand changes and technologies evolve.

Design principles

Democratize advanced technologies. Instead of asking your team to learn to host and run complex technology such as machine learning or NoSQL databases, consume it as a managed service.

Go global in minutes. Deploy in multiple Regions to lower latency for users around the world.

Use serverless architectures. Remove the need to run and maintain servers for traditional compute activities. Experiment more often. With virtual resources, you can quickly compare different instance types, storage, or configurations.

Consider mechanical sympathy. Use the technology approach that aligns best with what you are trying to achieve, for example a key-value database for simple, high-speed lookups.

Related services

Amazon EC2 instance families (choose compute-, memory-, or storage-optimized types), AWS Lambda, Amazon CloudFront (caching content near users), Amazon ElastiCache (in-memory caching), Amazon DynamoDB, AWS Compute Optimizer.

Real-world example

Real-world scenario: A news website’s pages load slowly for readers in Asia because its servers are in a single North American Region. It puts Amazon CloudFront in front of the site so images and pages are cached at edge locations close to readers, and adds an ElastiCache cluster so popular articles are not read from the database on every request. Page load time drops sharply without adding large servers. That is Performance Efficiency.

Common trap

Performance Efficiency is not “make it faster at any cost”. It is about choosing the right resource type and size for the job and keeping that choice right as things change. Over-provisioning a huge instance is not efficient.

2.6 Cost Optimization

Focus: running systems to deliver business value at the lowest price point, avoiding unnecessary costs.

Design principles

Implement cloud financial management. Invest in the people, processes, and tools that make the organization cost-aware (sometimes called FinOps).

Adopt a consumption model. Pay only for the resources you need, and scale down or turn off resources when not in use. For example, stop development servers outside working hours.

Measure overall efficiency. Measure the business output of a workload and the cost to deliver it, such as cost per order.

Stop spending money on undifferentiated heavy lifting. Let AWS run data centers and managed services so you can focus on customers.

Analyze and attribute expenditure. Identify the cost and usage of each workload and team, for example with cost allocation tags, so owners can be held accountable.

Related services

AWS Cost Explorer, AWS Budgets, AWS Cost and Usage Report, Savings Plans and Reserved Instances, Spot Instances, AWS Trusted Advisor (cost checks), AWS Compute Optimizer (rightsizing recommendations), Amazon S3 storage classes and lifecycle policies.

Exam tip

“Rightsizing”, “turning off unused resources”, “choosing the right pricing model”, “lowest price point”, and “tagging to track spending” all signal the Cost Optimization pillar.

2.7 Sustainability

Focus: minimizing the environmental impact of running cloud workloads, especially energy consumption and efficiency. Sustainability became the sixth pillar in late 2021. It recognizes that the cloud uses real energy and hardware, and that architectural choices affect how much. Like security, sustainability is a shared responsibility: AWS is responsible for the sustainability of the cloud (efficient data centers, power, and cooling), and customers are responsible for sustainability in the cloud (efficient use of the resources they run).

Design principles

Understand your impact. Measure the environmental impact of your workload. The AWS customer carbon footprint tool, in the Billing and Cost Management console, reports estimated emissions from your AWS usage. Establish sustainability goals. Set long-term goals for each workload, such as reducing the compute needed per transaction.

Maximize utilization. Rightsize workloads so resources run at high utilization; two hosts at 30% use more energy than one host at 60%.

Anticipate and adopt new, more efficient hardware and software offerings. For example, AWS Graviton processors are designed for better energy efficiency.

Use managed services. Shared services operated at scale use resources more efficiently than many small self-managed ones.

Reduce the downstream impact of your cloud workloads. Reduce the energy or resources customers need to use your service, for example by sending smaller files to their devices.

Common trap

Sustainability and Cost Optimization overlap, since using fewer resources usually saves both money and energy. Decide by what the question emphasizes: “environmental impact”, “energy”, “carbon”, or “utilization to reduce footprint” means Sustainability; “lowest price” or “billing” means Cost Optimization.

2.8 Trade-offs between pillars

The pillars sometimes pull in different directions. Running a fully redundant copy of a workload in a second Region improves Reliability but increases cost. Encrypting and inspecting all traffic improves Security but can add latency. The framework does not say one pillar always wins. It asks you to make trade-offs deliberately, based on business requirements.

In general, AWS advises that Security and Operational Excellence are rarely traded off, while Reliability, Performance Efficiency, and Cost Optimization are commonly balanced against each other. A development environment, for example, might reasonably accept lower reliability to cut costs; a payment system would not.

Pillar One-line question it answers

Operational Excellence How do we run, monitor, and improve the workload?

Security How do we protect data, systems, and assets?

Reliability Will it work correctly and recover from failure?

Performance Efficiency Are we using the right resources efficiently?

Cost Optimization Are we delivering valueat the lowest price?

Sustainability Are we minimizing environmental impact?

2.9 The AWS Well-Architected Tool

The AWS Well-Architected Tool is a free service in the AWS Management Console that helps you review a workload against the framework. You pay nothing for the tool itself, only for any AWS resources you use. It turns the framework into a guided questionnaire.

A typical review works like this:

1. Define the workload. Give it a name, describe it, choose its environment (production or pre-production), and list the Regions or accounts it uses.
2. Choose lenses. The Well-Architected Framework lens is applied by default. You can add others (see the next section).
3. Answer the questions. For each pillar, the tool asks questions such as “How do you protect your data at rest?” and lists best practices as checkboxes. You select the ones you follow.
4. Review the risks. Based on your answers, the tool flags high-risk issues (HRIs) and medium-risk issues (MRIs) and links to guidance for fixing each one.
5. Create an improvement plan. The tool produces a prioritized list of improvements. You can save a milestone to record the state of the workload at a point in time, then compare later milestones to show progress.
6. Repeat. Re-review after significant changes or on a regular schedule.

The Well-Architected review loop

1. Define

workload

2. Choose

lenses

3. Answer pillar

questions

4. Identify

HRIs and MRIs

5. Improvement

plan, milestone

6. Implement

Figure 2.3: The Well-Architected review loop. Reviews are not one-time audits; teams measure, improve, and review again as the workload changes.

High

Medium
Lens: AWS Well-Architected Framework
SEC 3. How do you manage permissions

for people and machines?

Select the best practices your workload follows.

Admin role reviewed quarterly; no root access keys.

High risk: no emergency access process. See guidance.

Previous Save and exit Next

Figure 2.4: A simplified view of a workload review in the AWS Well-Architected Tool, showing pillar questions, best-practice checkboxes, and risk counts. (Illustration, not an actual AWS screenshot.)

Hands-on lab

1. Sign in to the AWS Management Console with your everyday administrative identity (not the root user).
2. In the search bar, type Well-Architected and open AWS Well-Architected Tool.
3. Choose Define workload. Enter a name such as “study-blog”, a short description, select Pre-production as the environment, and choose your home Region. Choose Next.
4. On the lenses page, leave AWS Well-Architected Framework selected and choose Define workload.
5. Choose Start reviewing, then select the Security pillar in the left panel.
6. Read the first question and its best practices. Tick the ones that are true for an imagined small blog, for example “root user secured with MFA”. Choose Next to continue through a few questions.
7. Choose Save and exit, then open the workload’s Overview to see the count of high-risk and medium-risk issues.
8. Open the Improvement plan tab and read the top recommendation and its linked guidance.
9. Choose Save milestone and name it “baseline”.
10. Clean up: the tool does not create billable resources, but you can delete the workload from the workload list if you wish.

Good to know

The Well-Architected Tool can share workloads with other AWS accounts and, through Trusted Advisor integration, can show related Trusted Advisor checks for resources in the workload. AWS Partners and AWS solutions architects can also run reviews with you.

2.10 Lenses

A lens extends the framework with questions and best practices for a specific technology, industry, or type of workload. The general framework asks “How do you protect your data at rest?”; a lens asks more targeted questions that only make sense for that kind of workload.

AWS publishes lenses in the Lens Catalog, inside the Well-Architected Tool. Examples include the Serverless Applications Lens, SaaS Lens, Data Analytics Lens, Machine Learning Lens, Generative AI Lens, Financial Services Industry Lens, Healthcare Industry Lens, and IoT Lens. Organizations can also write custom lenses that encode their own internal standards and apply them in the tool.

Exam tip

If a question asks how to review a workload against best practices for a specific type of application (such as serverless or machine learning), the answer is to apply the relevant Well-Architected lens in the Well-Architected Tool.

2.11 How the exam phrases pillar questions

Pillar questions follow a few predictable patterns. Learn to spot the keyword that maps to each pillar. Pattern 1: “Which pillar…?” The question describes a practice and asks which pillar it belongs to. A company uses AWS CloudFormation to deploy all infrastructure changes and performs small, frequent deployments that can be rolled back. Which pillar does this support? Operational Excellence: operations as code, small reversible changes.

Pattern 2: “Which design principle…?” The question describes a practice and asks which principle it follows. Which design principle is followed when a company uses Auto Scaling to replace failed instances automatically? Automatically recover from failure (Reliability).

Pattern 3: “Which action would improve X?” The question names a pillar and asks you to pick a matching action. Which action aligns with the Sustainability pillar? Rightsizing underutilized instances to maximize utilization.

Keyword map for quick review:

Keywords in the question Pillar

runbooks, operationsas code, small changes, observability Operational Excellence least privilege, encryption, MFA, audit, traceability Security

recover from failure, Multi-AZ, test recovery, quotas Reliability
right resource type, serverless, global, caching Performance Efficiency
lowest price, rightsizing, pricing model, tags for cost Cost Optimization
energy, carbon, utilization, environmental impact Sustainability

Common trap

“Scale horizontally” appears in the Reliability pillar (many small resources reduce the impact of one failure). “Use serverless” and “go global in minutes” appear in Performance Efficiency. “Stop guessing capacity” appears in the general principles and in Reliability. Read the whole scenario to see which goal it emphasizes.

Chapter 2 summary

The AWS Well-Architected Framework is a set of best practices, questions, and design principles for evaluating cloud workloads.

It has six pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability.

Operational Excellence: operations as code, small reversible changes, learning from failure, observability. Security: strong identity foundation and least privilege, traceability, security at all layers, data protection. Reliability: automatic recovery, testing recovery, horizontal scaling, automated change.

Performance Efficiency: right resources, managed and serverless services, global deployment, experimentation. Cost Optimization: consumption model, measuring efficiency, attributing spend, cloud financial management. Sustainability: maximize utilization, efficient hardware, managed services, reduce downstream impact; it is a shared responsibility.

The free AWS Well-Architected Tool guides reviews, flags high- and medium-risk issues, and records milestones; lenses add workload-specific questions.

Key terms

Term Definition

Well-Architected Framework AWS best practices for designing and operating cloud workloads Pillar One of six focusareas of the framework

Workload Components that together deliver business value
Least privilege Granting only the permissions needed foratask
Operationsas code Defining infrastructureand procedures in code

High-risk issue (HRI) A review finding with significant potential negative impact Milestone A saved snapshot ofa workload review ata point in time

Lens Extra questionsand best practices foraspecific workload type
Custom lens A lens written by an organization with its own standards
Game day A planned simulation ofan event to test systemsand people
Practice questions

1. Which pillar of the AWS Well-Architected Framework focuses on minimizing the environmental impact of running cloud workloads?

A. Cost Optimization B. Performance Efficiency
C. Sustainability D. Operational Excellence

2. A company defines all of its infrastructure in AWS CloudFormation templates and deploys small, frequent changes that can be easily rolled back. Which pillar does this BEST support?

A. Operational Excellence B. Security
C. Cost Optimization D. Sustainability

3. Which design principle of the Security pillar recommends granting users only the permissions they need to perform their tasks?

A. Apply security at all layers B. Implement a strong identity foundation
C. Keep people away from data D. Maintain traceability

4. A web application runs on a single EC2 instance. The company wants the application to keep running if the instance fails. Which change BEST aligns with the Reliability pillar?

A. Move to a larger EC2 instance type B. Use an Auto Scaling group across multiple Availability Zones behind a load balancer
C. Purchase a Savings Plan for the instance D. Enable detailed billing reports

5. Which AWS service can a company use, at no additional charge, to review its workloads against AWS architectural best practices?

A. AWS Trusted Advisor B. AWS Well-Architected Tool
C. AWS Config D. AWS Artifact

6. A company wants to evaluate its serverless application against best practices that are specific to serverless architectures. What should it use?

A. The Serverless Applications Lens in the AWS Well-Architected ToolB. AWS CloudTrail
C. Amazon Inspector D. The AWS Pricing Calculator

7. Which of the following are design principles of the Cost Optimization pillar? (Choose two.)

A. Adopt a consumption model B. Apply security at all layers
C. Analyze and attribute expenditure D. Test recovery procedures
E. Use serverless architectures

8. A media company caches images at edge locations close to viewers and uses a managed in-memory cache to reduce database reads. Which pillar does this BEST represent?

A. Security B. Reliability
C. Performance Efficiency D. Sustainability

9. A company reduces the number of lightly used EC2 instances so the remaining instances run at higher utilization, specifically to reduce its energy footprint. Which pillar does this action MOST directly support?

A. Sustainability B. Reliability
C. Security D. Operational Excellence

10. Which design principle is followed when a company deliberately shuts down instances in a test environment to verify that its application recovers automatically?

A. Stop guessing capacity B. Test recovery procedures
C. Perform operations as code D. Democratize advanced technologies

11. Which statement about the AWS Well-Architected Framework is correct?

A. It requires every workload to run in at least three

Regions.

B. It provides a consistent approach for evaluating

architectures and identifying risks.

C. It is a paid consulting service available only to Enterprise

Support customers.

D. It replaces the AWS shared responsibility model.

12. A company enables AWS CloudTrail in all accounts and sends logs to a central location where unusual API activity triggers alerts. Which Security design principle does this follow?

A. Maintain traceability B. Protect data in transit and at rest
C. Keep people away from data D. Make frequent, small, reversible changes

13. Which design principle of the Performance Efficiency pillar encourages using managed services such as machine learning or NoSQL databases instead of building and running them in-house?

A. Go global in minutes B. Democratize advanced technologies
C. Measure overall efficiency D. Anticipate failure

14. In the AWS Well-Architected Tool, what does saving a milestone allow a team to do?

A. Automatically fix high-risk issues B. Record the state of a workload review at a point in time to track progress
C. Purchase Reserved Instances D. Share billing data with AWS Partners

15. A finance team uses cost allocation tags to show each department how much its applications cost each month. Which pillar does this support?

A. Cost Optimization B. Performance Efficiency
C. Reliability D. Security

16. Which pillars of the Well-Architected Framework are generally NOT traded off against others? (Choose two.)

A. Security B. Cost Optimization
C. Operational Excellence D. Performance Efficiency
E. Reliability

17. Under the Sustainability pillar, which responsibility belongs to the customer?

A. Improving the energy efficiency of AWS data center

cooling

B. Choosing efficient instance types and rightsizing

workloads

C. Purchasing renewable energy for AWS Regions D. Designing AWS server hardware

18. A company wants to encode its own internal architecture standards as questions and apply them during workload reviews in the AWS Well-Architected Tool. What should it create?

A. A custom lens B. An AWS Config rule
C. A service control policy D. An AWS Budgets alert

Answers and explanations

1. C. Sustainability focuses on minimizing environmental impact, such as energy use. Cost Optimization (A) focuses on price, which often overlaps but is not the stated goal.
2. A. Operations as code and frequent, small, reversible changes are Operational Excellence design principles. Security (B) and Cost Optimization (C) are not about how changes are deployed.
3. B. Implementing a strong identity foundation includes the principle of least privilege. “Apply security at all layers” (A) is about defense in depth; “maintain traceability” (D) is about logging and auditing.
4. B. Multiple instances across Availability Zones with automatic replacement remove the single point of failure. A larger instance (A) is still one instance; Savings Plans (C) and billing reports (D) affect cost, not availability.
5. B. The AWS Well-Architected Tool is a free console service for reviewing workloads against the framework. Trusted Advisor (A) runs automated checks on resources but is not the framework review tool; AWS Artifact (D) provides compliance reports.
6. A. Lenses add workload-specific best practices, and the Serverless Applications Lens covers serverless designs. CloudTrail (B) records API activity, and Inspector (C) scans for software vulnerabilities.
7. A and C. Adopting a consumption model and analyzing and attributing expenditure are Cost Optimization principles. B is Security, D is Reliability, and E is Performance Efficiency.
8. C. Edge caching and in-memory caching use the right resources to serve content efficiently, which is Performance Efficiency. These choices do not primarily address security or failure recovery.
9. A. The stated goal is reducing the energy footprint by maximizing utilization, a Sustainability design principle. It may also save money, but the question emphasizes environmental impact.
10. B. Deliberately causing failures to confirm recovery works is “test recovery procedures” from the Reliability pillar. The other principles are unrelated to verifying recovery.
11. B. The framework provides a consistent way to evaluate architectures and find risks. It does not mandate a number of Regions (A), it is freely available (C), and it complements rather than replaces the shared responsibility model (D).
12. A. Logging, monitoring, and alerting on actions is “maintain traceability”. Encryption (B) and reducing human data access (C) are different Security principles, and D is Operational Excellence.
13. B. Democratizing advanced technologies means consuming complex technologies as managed services. “Go global in minutes” (A) is about multi-Region deployment, and C and D belong to other pillars.
14. B. A milestone saves the state of a review so progress can be compared over time. The tool does not fix issues automatically (A) or handle purchasing or billing (C, D).
15. A. Analyzing and attributing expenditure, for example with tags, is a Cost Optimization principle. The other pillars do not deal with cost visibility.
16. A and C. AWS guidance is that Security and Operational Excellence are generally not traded off, while Reliability, Performance Efficiency, and Cost Optimization are often balanced.
17. B. Customers are responsible for sustainability in the cloud, such as choosing efficient resources and rightsizing. Data center efficiency, energy sourcing, and hardware design (A, C, D) are AWS’s responsibility.
18. A. Custom lenses let organizations add their own questions and best practices to the Well-Architected Tool. AWS Config rules (B) evaluate resource configurations, and service control policies (C) restrict permissions in AWS Organizations.