AWS Well-Architected Agent: Your Architecture Review, Now Done by an Agent (Preview)

Description and use

The agent delivers cost, security, resilience, and performance recommendations within 24 hours, ranked by priority, effort, impact, ROI, and trade‑offs, and offers remediation via console, IaC, CLI, SDK, or runbooks.

Problem

Manual Well‑Architected reviews are costly, time‑consuming, and produce stale reports.

Outcome

The agent delivers cost, security, resilience, and performance recommendations within 24 hours, ranked by priority, effort, impact, ROI, and trade‑offs, and offers remediation via console, IaC, CLI, SDK, or runbooks.

Workflow

• Create an execution role in the host account that trusts wellarchitected.amazonaws.com and can assume access roles in target accounts.
• Create an access role in each target account with the WellArchitectedAgentResourceScanning managed policy and trust the execution role, using the profile ARN as external ID.
• Create an agent profile via the AWS CLI, specifying business overview, pillars, execution role ARN, aggregation configuration (list of target accounts, regions, access role ARNs), and enable deletion protection.
• (Optional) Define application context by tagging applications and specifying their locations to improve recommendation relevance.
• Upload a .zip of the IaC project (e.g., Terraform) to S3 and start an architecture review in the console, selecting lens and pillars.
• Pull recommendations from the CLI with aws wellarchitected list-agent-recommendations and remediate using console actions, updated IaC templates, or CLI commands.

Evidence

On October 1, 2026, AWS launched AWS Well‑Architected Agent in public preview.

Source

It continuously analyzes your accounts and returns cost, security, resilience, and performance recommendations ranked against goals you write yourself, and it hands you the fix: console steps, CLI commands, or the change to your infrastructure code.

Source

You create a profile: up to 100 accounts, their Regions, the pillars you care about, and a goal per pillar. First recommendations land within 24 hours.

Source

It reads resource configuration across 65+ services, utilization metrics, and application topology via read‑only roles.

Source

Remediation via console, updated IaC, CLI, SDK, SSM runbooks, and MCP. In what AWS showed, it doesn't change resources on its own.

Source

Requires an AWS Support plan. No published preview pricing.

Source