Trace the dependencies behind a resilience claim
What This Concept Is
A failure domain is a set of components that can fail together. A service depends on more than its replicas: routes, data, credentials, name resolution and deployment configuration can couple otherwise separated components. Dependency closure means following those required paths until every dependency has an explicit boundary and failure assumption.
Why It Matters Here
A diagram with three application boxes in different zones does not establish three independent request paths. The original network lab requires explaining how requests reach data, not simply placing icons. Use one concrete operation, such as accepting a trip, to decide which dependencies are mandatory and which permit degraded service.
Concrete Example
An API has 60 requests/second of usable capacity in each of zones A and B; demand is 50. Its database exists only in A and handles 80 operations/second, with one operation required per request. Losing A leaves 60 API capacity but no database. The request path is unavailable despite sufficient API capacity. Losing B leaves both capacity and database in A. These two failures are not equivalent.
If the API can serve cached public information without the database, model that as a separate operation with its own freshness contract. Do not silently remove the database dependency from writes. A service may be available for one operation and unavailable for another.
Common Confusion / Misconception
A regional or global label is a resource scope, not a guarantee that every dependency survives every outage. Shared credentials, incorrect configuration, cross-region replication and application calls can carry failure across geographical boundaries. A private subnet label does not prove a route or access policy is correct.
How To Use It
Trace client → ingress → application → data for one operation, then add required naming, identity and egress paths. Label each edge with purpose, failure behavior and evidence. Separate steady-state request dependencies from provisioning/recovery dependencies. The lab uses an acyclic mandatory-service graph; explain any real feedback loop rather than deleting it to make the model pass.
Check Yourself
Which node breaks the write path in the example? Could a functioning database still be unreachable? Does surviving compute imply fresh data? Which failure is correlated across all replicas?
Mini Drill or Application
Draw the same workload twice: all application replicas use one zonal egress dependency, then each uses an appropriate surviving path. Enumerate a single-zone failure for each layout and identify which observations would distinguish them. Keep a route/firewall evidence record beside the model.
Read This Only If Stuck
AWS EC2 Regions and Zones supplies resource geography. AWS static stability connects topology to operational dependencies. Read only enough to challenge one assumption in your diagram.
The Linux Command Line is selective prerequisite support for inspecting local processes, network paths and resource inventories. Provider documentation above remains authoritative for cloud behavior.