Resilience Patterns · Capstone
Capstone: Design a Resilient Checkout
Make checkout survive dependency failures and traffic spikes.
Scenario
Checkout calls: cart, pricing, inventory, tax (third-party), fraud scoring (third-party), payments (third-party), loyalty points, recommendations ("you may also like"), email. Black Friday traffic is 20× normal. Last year a slow tax provider took checkout down for 40 minutes.
Requirements
- Checkout success ≥ 99.95% during peaks
- No double charges
- Third-party failures degrade gracefully where possible
Constraints
- Payment provider: 300 req/s limit
- Tax must be correct for orders in regulated regions
Deliverables
- Classify dependencies and define per-dependency policies.
- How does checkout handle 20× traffic and the payment provider's rate limit?
- How will you verify the design before Black Friday?
Draft each deliverable below before revealing the model answer and rubric.
Further reading: Amazon Builders' Library
Deliverables
Classify dependencies and define per-dependency policies.
Model answer
Critical: cart, pricing, inventory, payments (idempotency keys, breaker, 2 s timeout, async completion path). Tax: critical for regulated regions (timeout 800 ms, retry once, cached rates fallback where legally allowed, otherwise queue order as pending tax); Fraud: degrade to rules-based scoring + manual review for high-value orders; Loyalty, recommendations: optional (timeouts 200 ms, no retries, hide on failure); Email: async via outbox.
Rubric
Strong answers distinguish critical vs optional, give concrete timeouts, and handle legal/correctness constraints (tax) explicitly.
How does checkout handle 20× traffic and the payment provider's rate limit?
Model answer
Edge rate limits + bot protection; autoscaling with pre-warming before the event; load shedding prioritizing checkout over browsing extras; queue-based leveling for payment capture (authorize synchronously within budget, capture via workers at ≤ 280 req/s); bulkheads per third party; recommendations disabled via kill switch at peak if needed; load test at 25× beforehand.
Rubric
Look for capacity planning plus leveling against the provider limit and priority-based shedding.
How will you verify the design before Black Friday?
Model answer
Stress test at 25× with fault injection (tax latency +2 s, fraud 50% errors, payment 503s) in a production-like environment; game day with on-call; check breaker/fallback dashboards; readiness review with evidence; rollback and kill-switch drills.
Rubric
Strong answers combine load and fault injection with human practice.
Open in the app to mark lessons complete, take notes and track your progress.