Appearance
Enterprise AI-Native Architecture on AWS
title: Enterprise AI-Native Architecture on AWS description: Reference architecture and conceptual overview for AI-native systems on AWS.
Reference architecture — conceptual only. No deployable artifacts live in this repository.
- Compare options: Decision guides (pros, cons, pitfalls)
- Who decides: GOVERNANCE.md (adapt to your org)
- How to operate: processes/overview.md · sops/ (reference playbooks)
Executive summary
Six layers flow left to right; monitoring feeds back to planning:
Intent → Contract → Generation → Verification → Delivery → Assurance
AI accelerates layers 1–3 and parts of 4. Layers 4–6 are predominantly automated. Humans hold decision rights at architecture approval, contract approval, PR review, Tier-1 deploy, and incident command.
1. System context
SOP mapping: Planning = SOP-001–003 · Build = SOP-004–005 · Release = SOP-006 · Operate = SOP-007–008
2. Layer model
| Layer | Primary AWS | Primary tools | Human gate |
|---|---|---|---|
| 1 Intent | Bedrock | Jira, planning agent | ARCH + PO (SOP-002, SOP-003) |
| 2 Contract | — | OpenAPI, CDK, OPA | ARCH |
| 3 Generation | Q, Bedrock | Cursor, MCP | — |
| 4 Verification | CodeBuild, Inspector | pytest, Playwright, ESLint/Ruff, Semgrep | Reviewer (SOP-005) |
| 5 Delivery | CodeDeploy, AppConfig | CodePipeline, ECR | SRE T1 (SOP-006) |
| 6 Assurance | CloudWatch, X-Ray | Synthetics, EventBridge | SRE (SOP-007) |
3. Tooling: primary vs optional
See guides/index.md for full alternatives and pitfalls. Summary:
| Category | Often start with | Also consider |
|---|---|---|
| IDE AI | Cursor + MCP | Amazon Q, Copilot |
| Planning AI | Bedrock (VPC) | Custom agents |
| ADR / spec store | Git | Backstage, OpenSearch — guide |
| Linters & static analysis | ESLint/Ruff + pre-commit + Semgrep | guide |
| CI/CD | CodePipeline or GitHub Actions | guide |
| Runtime | ECS Fargate + Lambda | EKS if required — guide |
| Data governance | Macie + Glue catalog + classification ADR | guide |
| Observability signals | OTel + CloudWatch + X-Ray | guide |
| Dashboards & reporting | AMG / CloudWatch + SLO reports | guide |
| Incident management | PagerDuty + runbooks | guide |
| Monitoring as QA | Synthetics + deploy diff | guide |
Avoid adopting every tool at once. Roll out by lifecycle phase (processes/overview.md).
4. Knowledge plane (ADR & specs)
Non-production artifacts live in Git, publish on merge, index for humans and agents.
Rules: Only accepted ADRs and approved specs are indexed. See planning-and-adr.md and SOP-009.
5. Verification model
Automated verification standard (not "zero QA"):
| Activity | Automated | Human |
|---|---|---|
| Unit / contract / E2E tests | CI runs all | Reviews test quality in PR |
| Security / policy scans | CI blocks | SEC exceptions via SOP-012 |
| AI diff review | CI advisory or rule-based | Reviewer reads summary |
| Staging behavior | Synthetics + metrics | PO demo sign-off (SOP-006) |
| Production health | SLOs + canaries | SRE incident command |
Detail: qa-guardrails.md · Linters & static analysis
6. CI/CD & observability (summary)
Tier-specific gates: GOVERNANCE.md · Pipeline detail: cicd-observability.md · Procedure: SOP-006
7. Data governance (cross-cutting)
Spans planning through operations — especially critical with AI prompts and RAG.
Detail: data-governance.md · Guide: Data governance layers · Identity, access & secrets
7b. Identity, access & secrets (cross-cutting)
Workforce SSO, CI OIDC, task roles, application RBAC, and secret lifecycle span build through operate.
Detail: identity-access-secrets.md · Guide: Identity, access & secrets
8. Operations & observability stack
| Concern | Guide |
|---|---|
| Instrumentation | monitoring-tracing-logging.md |
| Dashboards & SLO reports | dashboards-reporting.md |
| Incidents & on-call | incident-management.md |
| Monitoring as QA loop | observability-monitoring-qa.md |
| Umbrella topic doc | operations-observability.md |
9. Monitoring feedback loop
Hard rule: Sev-1/2 requires regression test merged within 48h / 5 days respectively (SOP-008).
10. Human-in-the-loop (decision map)
| Gate | Approver | SOP |
|---|---|---|
| ADR accepted | ARCH | SOP-002 |
| Spec approved | ARCH + PO | SOP-003 |
| PR merged | DEV reviewer + CI | SOP-005 |
| Staging OK | PO (user-facing) | SOP-006 |
| Prod T1 deploy | SRE + ARCH | SOP-006 |
| Incident command | SRE | SOP-007 |
| Security exception | SEC | SOP-012 |
11. Velocity vs quality
| Risk | Mitigation |
|---|---|
| AI hallucinates APIs | Approved spec + contract tests |
| Architecture drift | Accepted ADRs in agent context + ARB |
| Weak tests | Mutation floor by tier |
| Review bottleneck | AI first pass; human spot-check |
| Prod regressions | Deploy metric gate + mandatory regression loop |
| Knowledge silos | Git + Backstage + OpenSearch |
12. AWS reference topology
Related documents
- GOVERNANCE.md — RACI, tiers, artifact lifecycle
- processes/overview.md — value stream, ceremonies
- sops/index.md — all procedures
- data-governance.md · operations-observability.md
- planning-and-adr.md · developer-workflow.md · qa-guardrails.md · cicd-observability.md