# Cost-Stable Architecture — Ceiling Checklist (July 2026)

## Hard ceilings (set and review quarterly)

- [ ] Lambda: reserved concurrency on every high-fanout / retry-prone function
- [ ] ECS/EKS: max tasks/pods on every ASG / Application Auto Scaling target
- [ ] API Gateway / ALB: stage/method throttle + WAF rate rules on public edges
- [ ] DynamoDB: provisioned Auto Scaling **max** RCU/WCU *or* on-demand with budget alert
- [ ] SQS → Lambda: reserved concurrency + DLQ + maxReceiveCount

## Shock absorbers

- [ ] Async path behind SQS/EventBridge for non-latency-critical work
- [ ] Idempotency keys on consumers (retries must not multiply bill × N)
- [ ] Gateway VPC endpoints for S3/DynamoDB (cut NAT GB on hot paths)

## FinOps backstops

- [ ] AWS Budgets + Budget Actions (deny / stop scale) on the spend account
- [ ] Cost Anomaly Detection (and FinOps Agent where enabled) wired to on-call
- [ ] Tag required for `Service` / `Environment` / `Owner` before prod deploy

## Per-event bound (fill in)

| Path | Max concurrency | Timeout | Est. $/1k events | Owner |
| --- | --- | --- | --- | --- |
| | | | | |