Scale the work without losing the state
Learn what must survive when a server disappears, then scale each tier without pushing more work than the next tier can handle.
LESSON GOALS
By the end, you can
- Separate replaceable compute from sessions, files, and other durable state.
- Choose vertical scaling, horizontal scaling, or a queue from the workload’s real constraint.
01
Ask what must survive replacement
Imagine one storefront server disappears during checkout. What must still exist when its replacement starts? The customer’s session, uploaded files, cart, and completed payment cannot depend only on that server’s memory or local disk. Those items are state: information that must survive beyond one running process.
Compute is stateless when another healthy unit can handle the next request without needing hidden local history. Put durable state in a shared store that every replacement can reach. A load balancer can then send requests only to healthy targets, and an Auto Scaling group can replace or add targets.
Load-balancer stickiness keeps one customer returning to one target while it is healthy. It does not copy the session elsewhere. If that target fails, its local session still disappears. External state—not stickiness—is what makes the compute safely replaceable.
02
Let each tier do one kind of work
A tier is a part of the request path with its own job. A simple storefront might have a load balancer, an application tier, a worker tier, and a database. Separating tiers lets the application add capacity without pretending the database also became larger.
Some work must finish before the caller receives an answer. Checkout authorization is usually synchronous: the customer needs a result now. Other work can finish later. Image resizing can be accepted first and placed in Amazon SQS, where workers process retained messages at their own pace.
Use one SQS queue when one competing worker pool should process each job. Use Amazon SNS with a separate queue per subscriber when billing, analytics, and resizing each need their own retained copy. Use Amazon EventBridge when matching event content to several targets is the deciding requirement.
Microservices are not required for this shape. A well-separated modular application can remain one deployment and still use shared state, multiple targets, and a queue. Split services only when independent ownership, release, scaling, or failure isolation pays for the extra operational work.
03
Scale from the bottleneck, not the headline number
Vertical scaling makes one unit larger. It is the smallest change for software that cannot distribute work, but the unit still has a maximum size and may need a restart. Horizontal scaling adds interchangeable units. It works only when requests can be distributed and state is not trapped inside one unit.
Choose a signal that changes with usable capacity. Requests per target can guide an HTTP tier. Backlog per worker or oldest-message age can guide workers. Scheduled scaling can prepare for a known promotion, while target tracking reacts to observed demand. Neither removes startup time, so leave room for warming capacity.
The whole request path is limited by its narrowest tier. Ten application targets are not safe if they can send 1,800 requests per second to a database rated for 1,000. Limit concurrency at the dependency, queue work where delay is acceptable, and recalculate after losing one Availability Zone.
DECISION TABLE
Compare the architecture constraints
| requirement | choose | because | reject |
|---|---|---|---|
| Software cannot split work across units | Vertical scaling | It needs the least redesign. | Claiming it removes the one-unit failure or size ceiling. |
| Bursty HTTP requests can reach any healthy target | Horizontal scaling across AZs | Replaceable targets add capacity and reduce one-target risk. | Keeping sessions only on each target. |
| Accepted work may finish after the response | Amazon SQS | The queue buffers the burst between producer and workers. | Making the caller wait for a slow worker. |
GUIDED WORKED SCENARIO
Reason from the stated constraints
This is a guided example, not a question to memorise. The knowledge check uses new situations to test the same reasoning.
A storefront normally receives 120 requests per second. A promotion raises that to 900 for 20 minutes. Each target handles 180 requests per second, sessions are local, and the database safely handles 1,000 requests per second. Checkout must continue if one AZ fails.
Requirements
- Keep customer sessions when a target fails.
- Meet the 900 requests/s promotion peak.
- Continue through one AZ failure.
- Stay below the database’s 1,000 requests/s safe rate.
- Avoid a mandatory microservice rewrite.
Reasoning path
- Move sessions to shared durable storage so targets are replaceable.
- Calculate at least five targets for 900 requests/s, then add headroom for warm-up and AZ loss.
- Spread targets across two AZs and scale on requests per target.
- Cap database concurrency and queue only work that may finish later.
Why it wins
- Targets can be replaced without losing sessions.
- Horizontal capacity covers the short burst without an unnecessary service split.
- The database limit remains an explicit gate instead of being hidden by more application servers.
Why the alternatives lose
Single failure domain and finite ceiling.
Becomes correct when: Software cannot distribute and downtime is accepted.No deciding requirement justifies the complexity.
Becomes correct when: Independent ownership/deployment/scaling is required.Failed targets still lose sessions.
Becomes correct when: Temporary compatibility accepts residual loss.The caller requires the checkout result within the interactive response contract.
Becomes correct when: The caller only needs a durable accepted receipt and completion may occur asynchronously.INTERACTIVE ARCHITECTURE VISUAL
Find the real scaling limit
Change demand, session placement, or an AZ failure. The lowest reachable capacity—and any lost state—decides the result.
× Request stopsThe application can accept 1200 requests/s, but the database-safe limit is 1,000.
Read the diagram as text
Trace one request through load balancer, replaceable app target, shared session store, and database. Then remove one target or AZ and compare app capacity with the database-safe limit.
KNOWLEDGE CHECK
Answer one question at a time
Pass every question to complete this lesson. Each answer includes reasoning before you continue.
KEY TERMS
Glossary
- State
- Information that must survive beyond one running process, such as a session, file, cart, or completed payment.
- Stateless compute
- Compute that another healthy unit can replace without needing hidden local history.
- Load balancer
- A service that sends requests to healthy targets instead of relying on one server.
- Auto Scaling group
- A group that maintains and adjusts a desired number of replaceable compute targets.
- Tier
- One part of a request path with its own job and capacity limit.
- Synchronous work
- Work that must finish before the caller receives its answer.
- Asynchronous work
- Work that may be accepted now and completed later.
- Horizontal scaling
- Adding interchangeable compute units so work can be distributed across them.
- Vertical scaling
- Giving one compute unit more CPU, memory, or other capacity.
- Bottleneck
- The narrowest reachable tier that limits the whole request path.
PRIMARY SOURCES
Verify the claims
- primaryDesign principlesaws-reliability-design-principles · retrieved 2026-07-30
- primaryWhat is Amazon EC2 Auto Scaling?aws-compute-asg · retrieved 2026-07-29
- primaryWhat is Elastic Load Balancing?aws-compute-elb · retrieved 2026-07-29
- primaryTarget tracking scaling policies for Amazon EC2 Auto Scalingaws-asg-target-tracking · retrieved 2026-07-30
- primaryAmazon SQS Developer Guideaws-int-sqs · retrieved 2026-07-29
- primaryAmazon SNS Developer Guideaws-int-sns · retrieved 2026-07-29
- primaryWhat is Amazon EventBridge?aws-int-eventbridge · retrieved 2026-07-29