Design for failure on AWS: static stability, cells and blast radius
An email provider outage stopped customers from placing orders. Nothing about orders needed email. We rebuilt the service around three ideas: static stability, cell-based isolation and a blast-radius budget per dependency. Here is the worked design.