Observability Platform · View 10 of 25 · Structure
Decisions
- The alert evaluation plane runs on its own node groups and reads the metric store directly, never through the query frontend. A query-tier outage therefore cannot stop a page — this is the separation that lets alerting carry 99.99% while interactive query carries 99.9%.
- The control plane is the only non-derived state. It is held twice: in Aurora for serving and in Git for recovery.
- Everything on the read plane fails static on a control-plane outage: last-known rules, budgets and classes keep working, and only changes are impossible.
Numbers
- Rule evaluation period 30 s by default, with the full rule set evaluating within one period at p99; missed evaluations ≤ 0.01% per month, each one recorded.
- Control plane ≥ 99.5% monthly — deliberately the weakest target in the platform, because nothing serving depends on it.
Risks
- Isolating the ruler costs real capacity that sits idle most of the time. It is the first thing a cost review will propose merging back, and merging it back silently removes the independence the availability targets were written against.
