On 1 October 2026, AWS launched the public preview of the AWS Well-Architected Agent, an AI-powered service that analyses your AWS environment and returns prioritised recommendations for cost, security, performance, and resilience, each with a ready-to-implement fix. For years a Well-Architected review meant workshops, questionnaires, and a spreadsheet of risks that went stale within a quarter. The agent’s pitch is different: continuous, goal-aligned findings with IaC changes, CLI commands, or console steps attached. This guide explains what the agent actually does, what it takes to switch it on safely, where its limits are, and how to fold it into a real optimisation programme.
What Is the AWS Well-Architected Agent?
AWS describes the agent as evaluating your environment “as an experienced cloud architect would.” It correlates utilisation metrics, resource configurations, and application topology, then checks them against Well-Architected best practices across 65+ AWS services. Recommendations are ranked against the business goals you declare, and each one surfaces cross-pillar trade-offs, so you can see when a cost saving might weaken resilience (AWS News Blog, Channy Yun, 1 Oct 2026).
Findings arrive at three levels:
- Resource: a single EC2 instance, Lambda function, or RDS database, with dollar impact where applicable and step-by-step remediation.
- Application: consolidated findings across related resources that make up one workload.
- Architecture: generated on demand from your Infrastructure as Code, returning updated templates aligned with best practices (AWS WA Agent concepts).
The release notes add two details that matter for operations teams: the agent re-analyses your environment on a weekly cadence, and recommendations can include AI-generated AWS Systems Manager (SSM) runbooks, not just written findings (AWS Well-Architected release notes).
Agent vs. the Well-Architected Tool
The agent does not replace the existing AWS Well-Architected Tool. AWS positions them as complementary, and you can use both from the same console (What is AWS Well-Architected?):
| Well-Architected Agent | Well-Architected Tool | |
|---|---|---|
| Approach | Automated, AI-driven analysis of deployed resources and IaC | Manual, guided self-review |
| Main entity | Profile (accounts, Regions, pillars, goals) | Workload |
| Output | Prioritised recommendations, trade-offs, scripts, IaC updates | High/medium risks and an improvement plan |
| Best for | Continuous, goal-driven optimisation | Structured reviews, governance, milestones |
One nuance worth knowing: the Well-Architected Framework has six pillars, including operational excellence and sustainability (Framework pillars), but the agent’s profiles currently focus on four: Cost optimisation, Security, Resilience, and Performance. If operational excellence or sustainability are board-level priorities, keep running Tool-based reviews for those.
Prerequisites: Check These Before You Start
Most stalled rollouts trace back to one of these prerequisites (Getting started guide):
- Support plan: Business+ or higher (Business+, Enterprise On-Ramp, Enterprise Support, or Unified Operations). Developer and Business tiers have no access. The plan must cover every monitored account; accounts on Basic or Developer get only application-level (beta) recommendations, because the agent can’t call Trusted Advisor APIs for them.
- Service control policies: in AWS Organizations, SCPs must allow
wellarchitected:*actions and the actions in theWellArchitectedAgentResourceScanningmanaged policy at every level up to the root. Otherwise you may create a profile that returns empty results. - Scope: up to 100 account IDs per profile, at least one pillar, and at least one goal statement.
- Cost data (optional): without Cost Explorer, the agent estimates costs from public pricing. With Cost Explorer and resource-level daily granularity enabled, it uses your actual costs. Note that Cost Explorer can’t be disabled once enabled, and API requests and granular data are charged.
Entitlements also scale with the support tier: Business+ allows 2 profiles with 7 applications each, while Enterprise On-Ramp, Enterprise Support, and Unified Operations allow 10 profiles with 30 applications each (Quotas and limits).
Setting It Up Securely
The agent uses customer-managed IAM roles rather than service-linked roles, so you decide exactly what it can see (WA Agent access model). The pattern is a role chain:
- An execution role in the profile account trusts
wellarchitected.amazonaws.comand may only callsts:AssumeRoleon your access roles. - An access role with the same name (AWS recommends
AccessRoleForWellArchitectedAgent) in every workload account trusts the execution role and carries the read-onlyWellArchitectedAgentResourceScanningpolicy. - The agent passes the profile ARN as an external ID, which protects against confused-deputy misuse.
The console creates the execution role for you, but not the access roles. You have to create those in IAM in each workload account; until you do, the agent won’t analyse that account. A common gotcha: console-created execution roles sit under the service-role/ path, so the trust policy ARN must include it (AWS docs). In a multi-account estate, deploy the access role with CloudFormation StackSets or your existing Infrastructure as Code pipeline instead of clicking through dozens of consoles.
AWS’s own best practices: host profiles in a dedicated account with no production workloads, reference the execution role ARN (not the account root) in trust policies, monitor agent API activity in AWS CloudTrail, and review access periodically.
Write Goals the Agent Can Act On
Goals drive ranking, so vague goals produce vague results. AWS’s guidance is to be specific, include metrics, set timeframes, name the pillar, and avoid overlapping goals (Goals and personalisation). Compare:
- Weak: “Improve security.” Strong: “Eliminate all public Amazon S3 buckets in production accounts by 31 December.”
- Weak: “Save money.” Strong: “Reduce compute cost for the payments platform by 20% year-over-year without increasing p95 latency.”
Add application context too. A profile needs at least one application context, or it’s flagged invalid and scheduled recommendations don’t run.
Shift-Left with IaC Architecture Reviews
The feature most useful to DevOps teams is the on-demand architecture review. You point the agent at an IaC project in Amazon S3 (a .zip up to 25 MB, or a folder up to 100 MB with no file over 1 MB). It reviews the project against the Well-Architected Framework lens and returns updated templates in the same language you submitted, so Terraform comes back as Terraform (Conducting architecture reviews). It’s also scriptable:
aws wellarchitected start-agent-recommendation-generation \
--profile-arn "arn:aws:wellarchitected:us-east-1:111122223333:agent-profile/my-profile" \
--types ARCHITECTURE \
--name "payments-pr-review" \
--scope '{"pillars": ["COST_OPTIMIZATION", "SECURITY"]}' \
--additional-context '{"s3Uri": "s3://your-bucket/iac.zip",
"lensArns": ["arn:aws:wellarchitected::aws:lens/wellarchitected"]}'
Budget for the limits: 5 architecture reviews per profile per day, and the S3 bucket must be in the same Region as the profile. Scheduled runs produce up to 30 recommendations each, with a 7-day cooldown between them (Quotas and limits). That makes reviews a good fit for release candidates and major merges, not every commit.
Limits and Caveats for Production Use
- Profile Regions: profiles are hosted only in US East (N. Virginia), US East (Ohio), and US West (Oregon), though the agent scans resources in all commercial Regions. Teams in India and the UAE with data residency requirements should check with compliance whether resource metadata may be analysed from a US-hosted profile.
- Coverage gaps: some CloudFormation resource types, including several WAFv2, Shield, IAM inline policy, and IAM Identity Center types, aren’t analysed today (unsupported resource types).
- Human review is required: AWS states plainly that generative AI recommendations “may contain errors or incomplete information” and that you’re responsible for evaluating them (AWS News Blog). Route fixes through pull requests and change management. Don’t run generated runbooks straight against production.
- It’s a preview: features and limits may change before general availability.
A 30-Day Adoption Plan
- Week 1: confirm support plans across accounts, audit SCPs, and create a dedicated profile account.
- Week 2: deploy access roles via IaC, define 3–5 measurable goals, and add context for your most important application.
- Week 3: triage the first recommendations with architects and app owners; ship low-risk fixes through your CI/CD pipeline.
- Week 4: add IaC architecture reviews to your release process and track cost and risk trends against your goals.
The agent removes much of the discovery work, but someone still needs to own prioritisation, trade-offs, and safe rollout. That’s where a structured cost optimisation and infrastructure management practice pays off.
Frequently Asked Questions
Who can use the AWS Well-Architected Agent?
AWS delivers the agent through AWS Support. It’s available to customers on Business+, Enterprise On-Ramp, Enterprise Support, or Unified Operations plans, and Developer and Business plans don’t get access. Enabling Cost Explorer for precise cost data has its own charges for API requests and resource-level data (AWS docs).
Can it analyse workloads in Mumbai or the UAE?
Yes. Profiles are hosted in three US Regions, but the agent can scan resources in any commercial AWS Region (Quotas and limits). Validate this against your residency obligations first.
Does the agent change my resources automatically?
No. It reads through the access roles you create with a read-only scanning policy, and you choose how to remediate: console steps, updated IaC, or CLI commands. You can revoke access at any time by editing or deleting the access roles (access model).
Should we stop doing Well-Architected Framework Reviews?
No. Use the agent for continuous, automated optimisation, and keep Tool-based reviews for governance, milestones, and the pillars the agent doesn’t cover yet, such as operational excellence and sustainability.
Turn Recommendations into Results
Shanav is an AWS Advanced Tier Partner with offices in Jaipur and the UAE. We help teams set up Well-Architected programmes, fix high-risk findings, and keep cloud spend under control. Explore our cloud consulting and architecture services, or if you want help onboarding the Well-Architected Agent and acting on what it finds, talk to our AWS experts.