wtf( )unctionsystem design, drawn
← all problemsAWS SA ProHard

Two designs, and the zone that is not the zone

A partner consumes an internal service over PrivateLink from their own account. To keep latency down and avoid cross-zone charges, both teams agreed to put everything in one zone and wrote it into the standards document: us-east-1a, both sides, no exceptions.

The endpoint works. Latency is measurably worse than the single-zone design predicted, the cross-zone line on the bill did not go away, and on one occasion a newly created endpoint could not see the service at all.

Both designs pin consumer and provider to one zone. Choose the one where that is the same physical zone.
!A design that was supposed to eliminate cross-zone traffic produced it on every request, in two accounts that both believe they are in us-east-1a — and both are right.A zone NAME is per-account. Two accounts saying "us-east-1a" are not necessarily naming the same building.
Design ABoth sides pinned to us-east-1a

Boundaries, outermost first: Consumer account: Partner app (us-east-1a), Interface endpoint (us-east-1a) Provider account: Endpoint service (us-east-1a), Quote service (one zone) Connections: Partner app calls Interface endpoint Interface endpoint publishes to Endpoint service — one zone each Endpoint service calls Quote service

Partner appus-east-1a
Interface endpointus-east-1a
Endpoint serviceus-east-1a
Quote serviceone zone
Design BBoth sides pinned by AZ ID

Boundaries, outermost first: Consumer account: Partner app (us-east-1a), Interface endpoint (use1-az4) Provider account: Endpoint service (us-east-1c), Quote service (one zone) Connections: Partner app calls Interface endpoint Interface endpoint publishes to Endpoint service — same physical zone Endpoint service calls Quote service

Partner appus-east-1a
Interface endpointuse1-az4
Endpoint serviceus-east-1c
Quote serviceone zone
Two designs, one brief. Read both, then choose the one that meets it.