Architecture Design Framework aspects and domains
Technology taxonomy of aspects and domains can be applied to develop end-to-end platform or application architectures on any cloud provider. Enterprise Cloud Solutions need to address requirements across the various aspects and domains.
Aspects
The Aspects are shown in column 1 and cover the different layers of the solution stack, from IT infrastructure through the application, as well as nonfunctional requirements and operational aspects.
Most of the aspects, like Compute, Storage, Networking, Security, and Resiliency are self-explanatory because they describe either the IT environment or common nonfunctional requirements that are table stakes for any enterprise solution.
The DevSecOps and Service Management cover the operational aspects of the solution.
Domains
Domains are the capabilities or functions within an aspect. For example, within the Security aspect, Data Security, Identity and Access Management, and Application Security are examples of functions that are contained in that aspect.
Each domain then contains a set of component options available to meet solution requirements.
Components
The component options for each domain are determined by the target cloud deployment model and cloud service provider under consideration.
Components are products or technology choices that satisfy the requirements for a specific category. Component options are determined by the target cloud service provider.
Domain details and sample components
The following table specifies the scope of each domain along with example IBM Cloud services that are component options for each.
| Aspect | Domain | Description | Sample components |
|---|---|---|---|
| Compute | Bare metal servers | Single-tenant, dedicated physical servers with no shared hypervisor. Use for performance-sensitive, licensing-bound, or compliance-isolated workloads, and when you need direct hardware access. | IBM Cloud Bare Metal Servers (VPC and Classic infrastructure) |
| Virtual servers | General-purpose virtual machines with selectable CPU, memory, and storage profiles. Use for lift-and-shift and traditional multi-tier application workloads. | IBM Cloud Virtual Server for VPC IBM Power Virtual Server |
|
| Virtualization | Hypervisor-based platforms that run and manage virtual machines using the same tooling as on-premises estates. Use to migrate or extend existing VMware or VM-based environments without re-platforming. | Red Hat OpenShift Virtualization Service on IBM Cloud | |
| Containers | Managed container orchestration and image management for cloud-native and modernized applications. Use when you need portability, scaling, and a Kubernetes-based application platform. | IBM Cloud Kubernetes Service Red Hat OpenShift on IBM Cloud IBM Cloud Container Registry |
|
| Serverless | Run code, containers, batch jobs, or functions without managing servers or clusters, with scale-to-zero and usage-based billing. Use for event-driven, bursty, or intermittent workloads. | IBM Cloud Code Engine (applications, jobs, functions) | |
| High-performance & GPU computing | Accelerated and clustered compute for AI training, simulation, and other compute-intensive batch workloads. Use when CPU-only virtual servers cannot meet performance or throughput needs. | IBM Cloud Virtual Server for VPC (GPU profiles) IBM Cloud Code Engine serverless fleets (GPU) |
|
| Storage | Primary Storage | Low-latency, persistent block and file storage attached to virtual servers, bare metal servers, and containers. Use for operating system disks, databases, and shared file systems that applications read and write frequently. | IBM Cloud Block Storage for VPC IBM Cloud File Storage for VPC |
| Object storage | Scalable, durable storage for unstructured data accessed through an S3-compatible API. Use for backups, data lakes, media, logs, and application assets that do not need a file system or block device. | IBM Cloud Object Storage | |
| Backup | Point-in-time copies of volumes and workloads that you create and manage to protect stored data from deletion, corruption, or loss. Use for scheduled copies of storage and servers. For application-level recovery objectives and failover planning, see the Resiliency aspect. | IBM Cloud Backup for VPC IBM Cloud Block Storage Snapshots for VPC IBM Cloud Backup and Recovery |
|
| Archive | Low-cost, long-term retention of infrequently accessed data for compliance or historical purposes, with slower or delayed retrieval. Use for data that must be kept but is rarely read. | IBM Cloud Object Storage (Archive and Accelerated Archive tiers) | |
| Data migration | Move large data sets into IBM Cloud over the network. Use for initial data seeding and bulk transfers that need higher throughput than standard uploads. | IBM Aspera high-speed transfer (IBM Cloud Object Storage) | |
| Data | Data Ops | Discover, integrate, cleanse, govern, and catalog data so it is trusted and ready for analytics and AI. Use when data comes from many sources and needs consistent quality and lineage. | IBM watsonx.data integration IBM watsonx.data intelligence |
| Data analytics | Query and process large volumes of structured and unstructured data across lakes and warehouses. Use for ad hoc analysis, batch processing, and data engineering. | IBM watsonx.data (Presto and Spark engines) IBM Db2 Warehouse SaaS |
|
| Data storage | Analytical data stores such as data lakes, lakehouses, and warehouses that hold large datasets in open formats for analysis. Use for analytical data sets. For operational transaction data, use Databases. | IBM watsonx.data (open lakehouse with Apache Iceberg) IBM Db2 Warehouse SaaS |
|
| Business intelligence | Reporting, dashboards, and natural language insight on enterprise data for business users. Use to give decision-makers self-service access to data. | IBM watsonx BI Assistant IBM Cognos Analytics |
|
| Databases | Managed operational databases (relational, document, key-value, in-memory, and search) that serve application transactions and queries. Use as the system of record or cache for applications. | IBM Cloud Databases for PostgreSQL IBM Cloud Databases for MySQL IBM Cloud Databases for MongoDB IBM Cloud Databases for Redis IBM Cloud Databases for Elasticsearch IBM Cloudant IBM Db2 as a Service |
|
| AI | Foundation models & inference | Hosted large language and other foundation models, with APIs for text generation, embeddings, and reranking, including custom and on-demand model deployments. Use to add generative AI to applications without operating model infrastructure. | IBM watsonx.ai Runtime Red Hat AI Inference on IBM Cloud |
| AI development & MLOps | Tools to build, tune, test, and deploy generative AI and machine learning models, including prompt engineering, fine tuning, AutoML, notebooks, and AI-assisted coding. Use to develop and operationalize custom AI. | IBM watsonx.ai Studio (Prompt Lab, Tuning Studio, AutoAI) IBM watsonx Code Assistant |
|
| Conversational AI & agents | Build virtual assistants and AI agents that understand natural language and automate tasks across applications. Use for customer service, employee help, and workflow automation. | IBM watsonx Orchestrate (includes watsonx Assistant capabilities) | |
| Document & content AI | Search and analyze unstructured content such as documents and enterprise text, and convert between speech and text. Use to make documents and audio searchable and usable by applications. | IBM Watson Discovery IBM Watson Speech to Text IBM Watson Text to Speech |
|
| Vector & knowledge stores | Store and search vector embeddings and indexed content to ground generative AI responses (retrieval-augmented generation). Use when models need access to current, enterprise-specific knowledge. | IBM watsonx.data (Milvus) IBM Cloud Databases for Elasticsearch IBM watsonx.ai vector index |
|
| AI governance | Monitor, evaluate, document, and control AI models and agents for fairness, drift, risk, and regulatory compliance throughout their lifecycle. Use when AI use must be transparent and auditable. | IBM watsonx.governance | |
| Application Platform | Application Integration | Connect applications and exchange data reliably between systems by using enterprise messaging. Use to integrate on-premises and cloud systems without custom point-to-point code. | IBM MQ on IBM Cloud |
| API management | Create, secure, publish, and monitor APIs, and expose them to internal and external consumers through a gateway and developer portal. Use to govern and monetize API access. | IBM API Connect | |
| Messaging & event streaming | Asynchronous messaging and event streaming for decoupling services and processing real-time events. Use for event-driven architectures and reliable message delivery between components. | IBM Cloud Event Streams IBM Cloud Messages for RabbitMQ IBM MQ on IBM Cloud |
|
| Networking | Enterprise connectivity | Private, dedicated, or encrypted connections between your data centers, other clouds, and IBM Cloud, and routing between IBM Cloud networks. Use for hybrid cloud, predictable bandwidth, and connectivity that avoids the public internet. | IBM Cloud Direct Link IBM Cloud Transit Gateway IBM Cloud VPN for VPC |
| BYOIP/Edge Gateways | Bring your own IP addresses and provide controlled ingress and egress points between private networks and the internet. Use to keep existing IP address ranges and to control how workloads reach external networks. | IBM Cloud VPC public gateways and floating IPs IBM Cloud Gateway Appliance (Classic infrastructure) |
|
| Load balancing | Distribute traffic across multiple servers or containers, across zones, to improve scale and availability. Use for any workload that must handle variable load or tolerate instance failure. | IBM Cloud Load Balancer for VPC (application and network load balancers) | |
| Cloud native connectivity | Private, service-level connectivity from your VPC to IBM Cloud services and between application services, without exposing them to the public internet. Use for secure access to managed services and for publishing your own services privately. | IBM Cloud Virtual Private Endpoints IBM Cloud Private Path IBM Cloud service endpoints |
|
| Isolation | Segment and separate workloads, tenants, and environments at the network and host level. Use to meet security, compliance, and blast-radius requirements. | IBM Cloud Virtual Private Cloud (subnets, network ACLs, security groups) IBM Cloud Dedicated Hosts for VPC |
|
| Content delivery network | Cache content at edge locations close to users to reduce latency and origin load. Use for global websites, media delivery, and API acceleration. | IBM Cloud Internet Services | |
| Domain name service | Resolve names for public and private domains and route traffic with health-checked, global load balancing. Use to publish applications under your own domains and to resolve private service names inside a VPC. | IBM Cloud Internet Services (public DNS) IBM Cloud DNS Services (private DNS) |
|
| Network security | Protect the network perimeter and traffic flows with filtering, web application firewalls, and denial-of-service defenses. Use to block malicious traffic before it reaches applications. For identity, data, and application controls, see the Security aspect. | IBM Cloud Internet Services (WAF, DDoS protection) IBM Cloud VPC security groups and network ACLs IBM Cloud Flow Logs for VPC |
|
| Security | Data security | Protect data at rest and in use through encryption, customer-controlled keys, and confidential computing. Use to meet data protection, privacy, and data sovereignty requirements. | IBM Cloud Key Protect |
| Identity & access | Authenticate users, services, and applications, and authorize access to resources with fine-grained, least-privilege policies. Use for workforce and service identities, federation with an external identity provider, and access governance. | IBM Cloud Identity and Access Management (IAM) IBM Verify |
|
| Application security | Find and fix vulnerabilities in application code, dependencies, and container images before and after deployment. Use to secure the software supply chain and running workloads. | IBM Cloud Container Registry (image vulnerability scanning) IBM Cloud Security and Compliance Center Workload Protection |
|
| Infrastructure & endpoints | Harden and protect hosts, clusters, and runtime environments, and confirm that their configuration meets security baselines. Use to protect compute and container platforms from misconfiguration and compromise. | IBM Cloud Security and Compliance Center Workload Protection | |
| Threat detection & response | Detect, investigate, and respond to attacks and suspicious behavior by correlating events, logs, and runtime activity. Use for security operations and incident response. | IBM QRadar Suite SIEM IBM Cloud Security and Compliance Center Workload Protection IBM Cloud Logs |
|
| Governance, risk & compliance | Define, assess, and report on security and regulatory controls across your cloud accounts and resources. Use to demonstrate compliance with standards and to monitor configuration drift. | IBM Cloud Security and Compliance Center Workload Protection | |
| Key & secrets management | Create, store, rotate, and control cryptographic keys, secrets, and TLS certificates used by applications and services. Use to keep credentials and keys out of code and to automate certificate lifecycles. | IBM Cloud Key Protect | |
| Service management | Monitoring | Collect and visualize metrics, traces, and health data for applications and infrastructure. Use to understand performance and capacity and to support service level objectives. | IBM Instana Observability IBM Cloud Monitoring |
| Logging | Collect, store, search, and analyze log data from applications, platform services, and infrastructure. Use for troubleshooting, analytics, and retention. | IBM Cloud Logs | |
| Auditing & tracking | Record who did what, when, and where across the cloud account for security investigation and compliance evidence. Use to meet audit requirements and to track configuration and access changes. | IBM Cloud Activity Tracker Event Routing IBM Cloud Logs |
|
| Alerting | Notify teams when metrics, logs, or events cross defined thresholds. Use to detect problems early and route them to the right people. | IBM Instana Observability (Smart Alerts) IBM Cloud Logs (alerts) IBM Cloud Event Notifications |
|
| Event management | Correlate, filter, and route operational events and notifications to responders and automated processes. Use to reduce noise and to trigger workflows from events. | IBM Cloud Event Notifications IBM Concert |
|
| Automated deployment | Provision and configure cloud infrastructure and applications from code so environments are repeatable. Use for infrastructure as code and standardized deployable architectures. | IBM Cloud Schematics IBM Cloud Projects IBM Cloud Continuous Delivery |
|
| Management & orchestration | Centrally operate, govern, and coordinate resources and workloads across accounts, locations, and hybrid or distributed environments. Use for fleet-wide configuration and consistent operations. | IBM Cloud Satellite IBM Cloud Schematics IBM Concert |
|
| Cost management | Track, allocate, forecast, and optimize cloud spend and resource usage. Use to control budgets and to right-size workloads. | IBM Cloud Billing and usage reporting IBM Turbonomic IBM Apptio |
|
| Resiliency | Backup & restore | Define and verify how an application and its data are recovered after deletion, corruption, or failure, against stated recovery point and recovery time objectives (RPO and RTO). Use to plan retention, test restores, and meet recovery objectives for whole workloads. For the underlying storage copies, see Storage > Backup. | IBM Cloud Backup for VPC IBM Cloud Databases (automated backups and point-in-time recovery) IBM Cloud Backup and Recovery |
| Disaster recovery | Recover workloads in a different zone, region, or site after a major outage by replicating data and infrastructure. Use when regional failure must not cause unacceptable downtime or data loss. | IBM Cloud Object Storage (cross region resiliency) IBM Cloud Block Storage for VPC (cross-region snapshot copy) IBM Power Virtual Server HA and DR Automation |
|
| High availability | Eliminate single points of failure by distributing workloads and data across zones and instances, with automatic failover. Use for services that must tolerate component and zone failures. | IBM Cloud multizone regions with IBM Cloud Load Balancer for VPC IBM Cloud Kubernetes Service (multizone clusters) IBM Cloud Databases (high availability) |
|
| DevSecOps | Build & Test | Automate compiling, packaging, and testing of application code and container images, including security scans. Use to produce consistent, validated build artifacts. | IBM Cloud Continuous Delivery (Tekton pipelines) IBM Cloud Code Engine builds IBM Cloud Container Registry |
| Delivery pipeline | Orchestrate the promotion of validated artifacts through environments with approvals, gates, and automated deployment. Use for repeatable, auditable delivery of applications and infrastructure. | IBM Cloud Continuous Delivery (toolchains and delivery pipelines) | |
| Code repository | Version-controlled storage of source code, infrastructure definitions, and configuration with collaboration and change history. Use as the single source of truth that triggers builds and deployments. | IBM Cloud Continuous Delivery (Git, issue tracking, and toolchain integrations) |
Example taxonomy
The following are examples of cloud deployments and cloud service providers.
- Cloud deployment model
- Public, Private, Hybrid, Multi-Cloud, Distributed Cloud
- Cloud platform
- IBM Cloud, AWS, Azure, GCP, other cloud
The following table illustrates component options for the Containers domain across various Public Cloud Service Providers. Note that this is just a sample and not a comprehensive list of available services on each cloud provider. How to make component architecture decisions for your solution is covered in Designing a cloud solution by using the Architecture Design Framework.
| Aspect | Domain | IBM Cloud | AWS | Azure | Google Cloud Platform |
|---|---|---|---|---|---|
| Compute | Containers | IBM Kubernetes Service Red Hat OpenShift on IBM Cloud |
Elastic Kubernetes Service Elastic Container Service Red Hat OpenShift on AWS |
Azure Kubernetes Service Azure Red Hat OpenShift |
Google Kubernetes Engine Red Hat OpenShift on GCP |