A customer requires high availability in its AWS cloud infrastructure. What is the minimally viable Conjur deployment architecture to achieve this?

For high availability (HA) in an AWS environment, the architecture must be resilient to the failure of a single Availability Zone (AZ). The minimally viable Conjur deployment to achieve this involves distributing Followers across multiple AZs within a single region. Placing one Follower in each AZ and fronting them with a regional load balancer ensures that if one AZ fails, traffic is automatically redirected to the healthy Followers in the other AZs. This configuration maintains service availability for read operations, which constitutes the majority of client requests, thus meeting the HA requirement with the minimum necessary components.

B. two Followers in each region, load balanced for the region

This is incorrect because it doesn't specify distribution across AZs. Both Followers could be in the same AZ, which would not provide high availability against an AZ failure.

C. two Followers in each AZ. load balanced for the region

This architecture provides HA but is not "minimally viable." Placing one Follower per AZ is sufficient for AZ-level redundancy; two per AZ exceeds the minimum requirement.

D. two Followers in each region, load balanced across all regions

This describes a multi-region disaster recovery (DR) architecture, not a single-region high availability setup. It is more complex and costly than what is required for regional HA.

1. CyberArk Conjur Enterprise Documentation

"Deploy in AWS": The official deployment guide for Conjur Enterprise in AWS specifies the high availability architecture. The "High availability and disaster recovery" section states: "To provide high availability

the Conjur cluster nodes (Leader

Standbys

and Followers) are deployed in an Auto Scaling group across multiple Availability Zones (AZs)." This confirms that distributing nodes across AZs is the sanctioned method for achieving HA. The minimal implementation of this principle is one node per AZ.

2. CyberArk Conjur Enterprise Documentation

"System Architecture": This document outlines the roles of the different Conjur nodes. It explains that Followers handle read-only requests from clients

offloading the Leader. For HA

a cluster of Followers is required. The documentation implicitly supports distributing these Followers across failure domains (AZs in AWS) to ensure continuous read-only service. The minimal cluster for HA would be one Follower in at least two separate failure domains.