AWS Well-Architected Agent: AI-Powered Cloud Recommendations from Resource to Architecture

The AWS Well-Architected Framework has been the standard self-assessment tool for cloud architecture since 2015 — a lens for evaluating your architecture against AWS best practices across cost, security, performance, and resilience. The framework is thorough and the findings are valuable, but the manual review process is slow, the recommendations are often generic, and remediation is left entirely to the engineering team.

The Well-Architected Agent, now in public preview, replaces the manual review with an AI system that scans your environment and produces contextual recommendations with specific remediation options. The difference is operational: instead of audit findings that require interpretation, the agent produces actionable output across three levels of specificity.

Three Levels of Recommendation

Level 1 — Resource findings: Specific resources in your account that don’t meet Well-Architected principles. Each finding includes the dollar impact (for cost-relevant recommendations), the priority rank relative to your business objectives, and step-by-step remediation instructions. This is the “fix this specific thing” output.

Level 2 — Application-level consolidation: Findings across multiple resources are grouped by application, showing the cumulative impact of related issues and how they interact. Instead of 47 individual findings that may or may not be connected, you see that 12 of them relate to the same service boundary and fixing them together has three times the impact of addressing them independently.

Level 3 — Architectural patterns: Broad recommendations that require IaC changes rather than console operations. The agent generates updated Terraform, CloudFormation, or CDK templates reflecting the architectural improvement, not just documentation of what should change.

Goal-Aligned Intelligence

The generic Well-Architected finding — “you should enable access logging on this S3 bucket” — carries no weight about whether that matters for your specific workload right now. The agent replaces generic prioritization with context from your declared business objectives.

You define your goals when setting up an agent profile: cost reduction at 30% this quarter, SOC 2 compliance by Q1 2027, availability target at 99.95%. The agent’s recommendations are ranked and scoped by those objectives. A cost optimization recommendation ranks higher if you’ve declared cost as the priority; a security hardening recommendation ranks higher if compliance is the current goal.

Remediation Options

Each recommendation comes with at least one of three remediation paths:

1. Console walk-through: Step-by-step instructions for manual remediation through the AWS console
2. IaC templates: Updated Terraform, CloudFormation, or CDK code reflecting the change
3. AWS CLI commands: Direct commands to execute the change without a console workflow

The IaC template path is the most operationally useful for teams with infrastructure-as-code discipline: the agent produces the modified template, not just the specification for what the template should contain. Teams can review and apply the template directly to their existing IaC repository.

Current State and Limitations

The Well-Architected Agent is in public preview, available in US East (N. Virginia), US East (Ohio), and US West (Oregon). It requires an AWS Support plan — the exact tier required isn’t stated in the announcement.

The initial scan generates recommendations within 24 hours, after which the agent provides ongoing monitoring and alerting as the environment changes. This is a departure from the Well-Architected Tool’s point-in-time review model: instead of quarterly architectural reviews, the agent provides continuous coverage of the four optimization pillars.

Current coverage spans the four pillars the agent was trained on — cost, performance, resilience, and security. The five-pillar framework (cost, security, reliability, performance, operational excellence) isn’t fully covered in preview; operational excellence is the pillar not yet represented.

The Connection to Existing Well-Architected Coverage

Stack Archive has covered the stateless MCP-based approach to Well-Architected guidance and the cross-account workload review capabilities. The Agent is the next architectural layer: instead of a practitioner querying the Well-Architected framework through MCP or running point-in-time workload reviews, the agent runs continuously against your actual AWS environment and generates specific remediation artifacts.

The agent doesn’t replace architectural expertise — the architectural pattern recommendations require engineering judgment about whether the suggested pattern fits the specific workload context. But it compresses the discovery-to-remediation cycle from weeks (manual review, documentation, ticket creation, IaC implementation) to hours (agent scan, template generation, PR for review).

Content created with AI assistance and reviewed for accuracy.