Deliverables

The curriculum covers what an architect should know. This covers what an architect actually hands over: 22 artifacts, each with a worked example, a note on when it is worth producing, who reads it, and the ways it usually goes wrong. Filter by the artifact's type, the kind of engagement that calls for it, the stack or industry it is drawn against, or the audience it is written for.

Identify the deliverable → 18 diagrams, shown one at a time with the answer withheld. Nothing to submit.

3 of 22 deliverables shown.

flowchart TB
  root["Organisation Root<br/><i>policy: deny unapproved regions</i>"]

  subgraph plat["Platform"]
    direction TB
    ident["Identity<br/><i>directory, privileged access</i>"]
    conn["Connectivity<br/><i>hub VNet/VPC, firewall, DNS, VPN</i>"]
    mgmt["Management<br/><i>logs, backup, monitoring</i>"]
  end

  subgraph land["Landing Zones"]
    direction TB
    subgraph corp["Corporate"]
      p1["Prod A<br/><i>spoke</i>"]
      n1["Non-Prod A<br/><i>spoke</i>"]
    end
    subgraph online["Internet-Facing"]
      p2["Prod B<br/><i>spoke</i>"]
      n2["Non-Prod B<br/><i>spoke</i>"]
    end
  end

  sandbox["Sandbox<br/><i>spend cap, no connectivity, auto-expire</i>"]
  decom["Decommissioned<br/><i>deny all</i>"]

  root --> plat
  root --> land
  root --> sandbox
  root --> decom
  conn --- p1
  conn --- n1
  conn --- p2
  conn --- n2
  mgmt -.->|"diagnostics forwarded"| land
  ident -.->|"roles and groups"| land

Deployment & Infrastructure View

Cloud Landing Zone Diagram

The account, network, identity and policy scaffolding every future workload will be dropped into, drawn before the first workload exists.

Landing Zones Design

flowchart TB
  users(["Users"]) --> dns["Global DNS<br/><i>latency routing + health checks</i>"]

  subgraph r1["Region: primary"]
    direction TB
    lb1["Load Balancer<br/><i>public</i>"]
    subgraph az1["Zone A"]
      n1["Node Pool<br/><i>api ×3, worker ×2</i>"]
    end
    subgraph az2["Zone B"]
      n2["Node Pool<br/><i>api ×3, worker ×2</i>"]
    end
    subgraph az3["Zone C"]
      n3["Node Pool<br/><i>api ×2, worker ×1</i>"]
    end
    db1[("Primary DB<br/><i>synchronous replica in Zone B</i>")]
    lb1 --> n1
    lb1 --> n2
    lb1 --> n3
    n1 --> db1
    n2 --> db1
    n3 --> db1
  end

  subgraph r2["Region: secondary"]
    direction TB
    lb2["Load Balancer<br/><i>warm</i>"]
    n4["Node Pool<br/><i>api ×2, scaled down</i>"]
    db2[("Read Replica<br/><i>asynchronous — RPO 30s</i>")]
    lb2 --> n4 --> db2
  end

  dns --> lb1
  dns -.->|"failover only"| lb2
  db1 -.->|"async replication"| db2

Deployment & Infrastructure View

Deployment Diagram

Which runtime artifact runs on which infrastructure, in which zone and region, and what fails when one of those boundaries fails.

Deployment Diagrams Design

flowchart TB
  inet(["Internet"])
  dc["Corporate Data Centre<br/><i>10.0.0.0/8</i>"]

  subgraph hub["Hub — 10.100.0.0/16"]
    direction TB
    fw["Egress Firewall<br/><i>FQDN allow-list</i>"]
    vpn["VPN / Direct Link<br/><i>BGP</i>"]
    dns["Private DNS Resolver"]
  end

  subgraph spokeA["Spoke: Prod — 10.101.0.0/16"]
    direction TB
    pub["Public Subnet<br/><i>10.101.0.0/24 — ingress LB only</i>"]
    app["App Subnet<br/><i>10.101.10.0/23 — no public IPs</i>"]
    data["Data Subnet<br/><i>10.101.20.0/24 — private endpoints</i>"]
    pub --> app --> data
  end

  subgraph spokeB["Spoke: Non-Prod — 10.102.0.0/16"]
    appn["App Subnet<br/><i>10.102.10.0/23</i>"]
  end

  inet -->|"443 only"| pub
  app -->|"all egress"| fw --> inet
  appn --> fw
  dc <-->|"BGP"| vpn
  vpn --- spokeA
  vpn --- spokeB
  spokeA x--x spokeB

Deployment & Infrastructure View

Network Topology Diagram

Segments, address ranges, routes and the control points between them — the view that says what can reach what at layer three.

Networking Design