Usage Metering & Billing Pipeline  ·  View 12 of 22  ·  Runtime

Critical Flow — Event to Invoice Line

Fifteen messages from a produced event to an answered dispute, and the one that defines the architecture.

Editable source SVG draw.io All views
Producer Ingest API Event ledger Aggregator Rating service Invoice run Customer 1. POST /events — id, meter, qty, event_ts 2. validate schema, check dedup index 3. append, await replication 4. committed 5. 202 accepted — a durability promise 6. stream by event time 7. window, watermark, provisional 8. aggregate + event_range 9. plan version in force at event_ts 10. priced line with tier breakdown 11. anomaly gate, then issue 12. invoice issued — immutable 13. expand this line 14. evidence query over event_range 15. the events behind the figure Critical Flow — One Event Becomes One Invoice Line Message 5 is the whole design: the acknowledgement follows replication, so an accepted event cannot be lost and messages 13 to 15 are always answerable. v 1.0 · owner Architecture Practice · date 2026-10

The decisive message

  • Message 5 is the whole design: the 202 follows durable replication, so an accepted event cannot be lost. If the acknowledgement came first, the ledger would not be the system of record and messages 13 to 15 could not be answered honestly.
  • Message 9 applies the plan version in force at event time, not at rating time. That is what makes a mid-period plan change split the period instead of retroactively repricing it.
  • Messages 13 to 15 read the ledger, not the aggregate store. A dispute is answered from the record.

Assumptions

  • Accept path p99 ≤ 50 ms with replication inside it (stated assumption). This is the budget that decides how many replicas the ledger write can wait for.
  • The aggregate handed to rating carries its event_range, so the evidence query in message 14 is a bounded scan rather than a full-period one.

Risks

  • The self-messages hide the expensive parts: dedup lookup at rate, and window state size on the aggregator. Both are capacity questions this view does not answer.
  • Message 11's anomaly gate is the last chance to catch a wrong figure before it becomes a correction with a customer attached.
◀  Data Model All views Invoice Run  ▶
Solution Architecture v1.0 · Amazon Web Services · Billing Platform Architecture · 2026-1012-critical-flow-event-to-line