AWS Well-Architected Agent: Turning Best Practices Into Automated Fixes

On October 2, 2026, AWS announced the preview of AWS Well-Architected Agent. Per AWS, it is an AI-powered service that is the next-gen evolution of AWS Trusted Advisor and the AWS Well-Architected Tool: it analyses and optimises AWS infrastructure across cost, security, performance and reliability, correlates key metrics and application topology against Well-Architected best practices, and analyses Terraform, CDK and CloudFormation templates to deliver automation-ready fixes where applicable. The interesting part is not that an AI helps you read your architecture. It is that best practices, long stuck at the level of a recommendations list, have finally crossed over to the side of fixes that ship with a runbook.

1. What it actually is: two old tools, agentified

Start with the facts. Per AWS's announcement, AWS Well-Architected Agent is an AI-powered service that is the next-gen evolution of AWS Trusted Advisor and the AWS Well-Architected Tool. It analyses and optimises AWS infrastructure across cost, security, performance and reliability, delivering contextualized recommendations prioritised by business goals. It automatically correlates key metrics and application topology against Well-Architected best practices, and it analyses Terraform, CDK and CloudFormation templates. That positioning matters: this is not another compliance-scoring dashboard, but the long-standing Well-Architected framework re-implemented as an agent that reads your actual estate to fill itself in. The service entered preview in October 2026.

# What AWS announced, in one object. The framing matters: this is not a
# new dashboard. It is the next-generation evolution of two existing
# tools, now driven by an agent.

WELL_ARCHITECTED_AGENT = {
    "announced": "2026-10-02 (preview)",
    "kind": "AI-powered service",
    "evolves": ["AWS Trusted Advisor", "AWS Well-Architected Tool"],
    "pillars": ["cost", "security", "performance", "reliability"],
    "output": "contextualized recommendations prioritized by business goals",
}

# The pillar set is the same Well-Architected frame teams already use;
# what changes is that an agent reads your actual estate to fill it in.

Not a new dashboard, but the next-gen evolution of two tools

2. What it analyses: live signals plus code templates

Per AWS, the analysis is meant to be evidence-based rather than checklist-based. The agent automatically correlates key metrics and application topology against Well-Architected best practices, and it brings infrastructure as code into view too: it analyses Terraform, CloudFormation and CDK templates, identifies gaps, and returns the specific code changes needed to align with best practices. So its inputs sit at both ends — live runtime signals on one side, the templates in your repository on the other — and together they set how accurate the recommendations can be. For teams already using IaC, the second half is often the more valuable one: the change lands in code rather than in someone's memory as a to-do.

# The analysis is meant to be evidence-based, not checklist-based.
# AWS describes correlating live signals against best practices.

ANALYSIS_INPUTS = {
    "key_metrics": "correlated automatically",
    "application_topology": "correlated against Well-Architected best practices",
    "infrastructure_as_code": ["Terraform", "CDK", "CloudFormation"],
}

def review(estate, goals):
    findings = correlate(estate.metrics, estate.topology, BEST_PRACTICES)
    findings += review_iac(estate.iac)       # identifies gaps in templates
    return prioritize(findings, by=goals)

# Where applicable, the IaC review returns the actual code changes needed
# to align with Well-Architected best practices.

3. Prioritised by business goals: making recommendations usable

Prioritisation is what makes a tool like this usable. Per AWS, teams can define their business goals and then get recommendations prioritised by impact and effort at the resource, application and architecture levels. AWS gives a concrete example: a team prioritising reliability might receive a recommendation to add multi-AZ failover to a critical database, complete with an SSM runbook that automates the configuration change and a cross-pillar analysis showing how the change affects cost and performance before you commit. That cross-pillar view is precisely what most tools miss — a fix for one pillar is almost always a cost or latency change in another.

# Prioritisation is the feature that makes this usable. You define
# business goals, and recommendations come back ranked by impact and
# effort at three levels.

LEVELS = ["resource", "application", "architecture"]

def example_reliability_first():
    """A team prioritising reliability gets specific, actionable output."""
    return {
        "recommendation": "add multi-AZ failover to a critical database",
        "delivered_with": [
            "an SSM runbook that automates the configuration change",
            "a cross-pillar analysis of cost and performance impact",
        ],
        "before_you_commit": "see the effect on cost and performance",
    }

# The cross-pillar view is the part most tools miss: a fix for one pillar
# is a cost or latency change in another.

One fix, many pillars: the cross-pillar view is the point

4. Automation-ready: from advice to artifacts

The real shift is that the output crosses from advice to artifacts. Per AWS, where applicable, recommendations are delivered with SSM runbooks, prescriptive CLI scripts and guided console walkthroughs; for IaC templates, it returns the actual code changes needed to align with best practices. For engineering teams, that means the produced items can enter existing code-review and change processes rather than stopping in an email. In practice, treat every generated runbook like code from a very fast teammate: read it, validate it in a sandbox or staging environment first, and always keep a rollback path.

# The recommendations are automation-ready, which is the real shift
# from advice to execution.

AUTOMATION_READY_OUTPUTS = [
    "SSM runbooks that automate the configuration change",
    "prescriptive CLI scripts",
    "guided console walkthroughs",
    "IaC code changes for Terraform / CloudFormation / CDK templates",
]

def apply_safely(rec, env):
    if env == "production":
        return "review runbook + stage change + roll back on regression"
    return "apply in sandbox first, then promote"

# Treat every generated runbook like code from a fast teammate: read it,
# stage it, and keep a rollback path.

5. Availability and prerequisites

Know the boundaries before you commit. Per AWS's announcement, access to AWS Well-Architected Agent and its recommendations is available in three regions: US East (N. Virginia), US East (Ohio) and US West (Oregon). You can onboard workloads from any AWS commercial Region. The agent is delivered by AWS Support and is available to AWS customers with an AWS Support plan; the entry point is the AWS Well-Architected console, with details in the User Guide. In short: analysis happens in a supported region, and remediation can happen anywhere the workload runs.

# Region and entitlement limits to plan around before you start.

AVAILABILITY = {
    "analysis_regions": ["US East (N. Virginia)",
                        "US East (Ohio)",
                        "US West (Oregon)"],
    "onboard_workloads_from": "any AWS commercial Region",
    "delivered_by": "AWS Support",
    "requires": "an AWS Support plan",
    "get_started": "AWS Well-Architected console",
}

def rollout_plan(workloads):
    # Analyse in a supported region, remediate wherever the workload runs.
    return [{"workload": w, "analyse": "supported region",
             "remediate": "any commercial region"} for w in workloads]

Know availability and prerequisites before you roll out

6. Wiring it into everyday operations

Turn the announcement into process. First, set your business goals before you read the recommendations — an optimisation list without a goal is just noise. Second, start with one real critical workload rather than everything at once, to validate recommendation quality and whether the runbooks are actually executable. Third, fold IaC checks into CI: route the returned template changes through pull requests, compare them with the Diff Checker, and protect refactor quality with the Code Complexity Analyzer. Fourth, translate reliability recommendations into measurable SLO numbers with our API Rate Limit Calculator and API Response Time Calculator, so decisions rest on data rather than instinct. Fifth, schedule the review: stand up a weekly architecture check with the Cron Expression Builder, so best practices become continuous engineering instead of a one-off exercise.