flowchart TB
users(["Users"]) --> dns["Global DNS<br/><i>latency routing + health checks</i>"]
subgraph r1["Region: primary"]
direction TB
lb1["Load Balancer<br/><i>public</i>"]
subgraph az1["Zone A"]
n1["Node Pool<br/><i>api ×3, worker ×2</i>"]
end
subgraph az2["Zone B"]
n2["Node Pool<br/><i>api ×3, worker ×2</i>"]
end
subgraph az3["Zone C"]
n3["Node Pool<br/><i>api ×2, worker ×1</i>"]
end
db1[("Primary DB<br/><i>synchronous replica in Zone B</i>")]
lb1 --> n1
lb1 --> n2
lb1 --> n3
n1 --> db1
n2 --> db1
n3 --> db1
end
subgraph r2["Region: secondary"]
direction TB
lb2["Load Balancer<br/><i>warm</i>"]
n4["Node Pool<br/><i>api ×2, scaled down</i>"]
db2[("Read Replica<br/><i>asynchronous — RPO 30s</i>")]
lb2 --> n4 --> db2
end
dns --> lb1
dns -.->|"failover only"| lb2
db1 -.->|"async replication"| db2What it is
The mapping from runtime artifacts to the physical or virtual places they run. The nesting is the content: process inside node inside zone inside region. What this view exists to answer is "what stops working when this boundary fails", and it can only answer that if the boundaries are drawn as containers rather than implied by labels.
When you produce it
Once the availability target is agreed and before anyone builds the infrastructure code, because the difference between two zones and three is a target, not a preference. Also for every disaster recovery test and every resilience review.
Who reads it
Operations and SRE, continuously. Engineers, to understand what "zonal" means for their service. Auditors and regulators, who ask where data physically resides. Finance, because the redundancy on this page is most of the infrastructure bill.
What good looks like
- Instance counts per zone, so the reader can see whether losing one zone leaves enough capacity — a three-zone deployment sized for exactly three zones is really a one-zone deployment.
- Replication mode and lag stated: synchronous or asynchronous, and the resulting RPO.
- The failover path drawn and marked as such.
- Regions named by role, not by provider code name, for a mixed audience.
Common mistakes
- Drawing the logical architecture again with the word "prod" on it. If it has no zones, regions or instance counts, it is not a deployment view.
- Symmetric secondary that is not funded. Draw what is actually running warm, not what the plan says.
- Omitting the data tier's replication semantics. That single annotation is the difference between a five-minute and a five-hour recovery.