Cloud architecture · AWS Support · Evidence review

AWS Well-Architected Agent

AWSBusiness+ Support required · Public preview

AWS Well-Architected Agent examines AWS cloud resources and architecture decisions against business goals, focusing on cost, security, performance and resilience. It is currently a restricted public preview.

CostSecurityResiliencePerformancePublic preview

Explore profile ↓Check primary sources ↓

StatusPublic preview

Support requirementBusiness+ or higher

Hosting3 US regions

Refresh cycleweekly recommendations

DIRECT ANSWER

AWS Well-Architected Agent entered public preview on October 1, 2026. Eligible customers need at least AWS Business+ Support and must host agent profiles in one of three US regions. It produces resource, application and architecture recommendations. Crucially, it does not execute AI-generated remediation steps by itself. Existing Trusted Advisor SSM runbooks may instead be automated with user consent. AWS source ↗ AWS source ↗

Direct answer: who is AWS Well-Architected Agent for?

AWS cloud architects, platform engineers, FinOps, security and SRE teams with eligible support plans. It is not a general-purpose chatbot or an unattended production-fix service. The agent identifies and prioritizes infrastructure recommendations; organizations remain responsible for approving and operating changes.

Documented

October 1 public preview, defined support eligibility, three profile-hosting regions, recommendation types and documented AWS integrations.

Vendor claims

Improved architecture and lower spending are plausible objectives, not outcomes independently measured by AgentenCode.

Unknown

Independent reliability benchmarks, production error rates, maturity of beta application recommendations and an all-in customer-specific price.

How the agent works: four verifiable steps

01 · Define scope

A profile specifies accounts, regions, business goals and application context. At least one goal and one application context are necessary for scheduled personalized recommendations.

02 · Establish authorized access

An IAM execution role in the profile account assumes access roles in workload accounts. Those roles allow discovery of relevant configuration and metadata.

03 · Prioritize findings

The service combines Trusted Advisor, Compute Optimizer, Security Hub, Resilience Hub and other AWS signals, considering goals, effort, impact and cross-pillar trade-offs.

04 · Require human change control

Teams review recommendations, request changes, test and approve them. Existing SSM runbooks can be automated with explicit authorization, whereas AI-generated CLI, SDK or IaC instructions are not executed by the agent.

AWS source ↗ AWS source ↗

Which capabilities are actually documented?

Resource recommendations

Targets individual services such as EC2, Lambda or RDS for optimization. Customer-specific cost figures depend on enabling suitable Cost Explorer data.

Refreshed on a weekly schedule; some AWS resource types are unsupported.

Application recommendations (beta)

Examines multiple related resources as one application, taking dependencies, RTO/RPO requirements and business criticality into account.

AWS explicitly labels this recommendation class as beta; completeness and operational reliability are not independently established.

Architecture and IaC review

Users initiate reviews of Terraform, CDK or CloudFormation projects to obtain architecture recommendations and potentially revised templates.

On-demand rather than weekly; there are input format, file size and run frequency limits.

AWS source ↗ AWS source ↗ AWS source ↗

Integrations and what the data does not prove

AWS documents Trusted Advisor for baseline checks, Compute Optimizer for rightsizing, Security Hub CSPM for security signals, Resilience Hub for resilience assessments, plus Cost Optimization Hub and Cost Explorer for expense insights. The new agent combines these signals with business context. If granular Cost Explorer data is unavailable, estimates may rely on public list prices rather than the organization's actual resource-level charges. A projected saving is not a measured, realized saving. AWS source ↗

Eligibility, quotas and AWS regions

Area	Limit	Caveat	Detail
AWS Support	Developer / Business	Not eligible	Business+, Enterprise On-Ramp, Enterprise Support and Unified Operations are supported.
Profile hosting	us-east-1, us-east-2, us-west-2	US only	Resources located in other commercial AWS regions can still be scanned.
Profiles per support tier	Business+: 2	Enterprise: up to 10	Up to 7 applications per Business+ profile or 30 at higher eligible tiers.
Accounts per profile	Up to 100	Not unlimited	Cross-account IAM roles must be configured in all relevant AWS accounts.
Recommendations per run	Up to 30	Per generation	Further recommendations may arrive in later cycles.
Architecture reviews	Up to 5 per day	Per profile	Manually initiated; ZIP upload up to 25 MB; S3 folder up to 100 MB.

AWS source ↗ AWS source ↗

How much does AWS Well-Architected Agent cost?

Preview eligibility requires a qualifying paid AWS Support plan. That does not translate into one universal monthly total for the agent. AWS also describes potential charges for underlying services, including granular Cost Explorer data, API requests and execution of remedial automation. Review your own support terms, AWS service pricing and possible follow-on actions before using it in production. Without an authoritative product-specific quote, AgentenCode does not invent a starting price. AWS source ↗

IAM, automation and governance

Read-only discovery is not write authorization

The documented WellArchitectedAgentResourceScanning policy supports reading resource metadata and configuration. Review the execution role, per-account access roles, trust relationships and SCPs.

Trusted Advisor runbooks are not AI-generated fixes

Predefined, deterministic SSM runbooks may be executed with consent. AI-generated resource, application and architecture guidance remains advisory and is not executed autonomously by the agent.

Production safeguards are still necessary

Generated scripts can be wrong or incomplete. Require IAM least privilege, a clear blast radius, change tickets, IaC diffs, staging tests, rollbacks and human sign-off.

Trust evidence remains unknown

AgentenCode has no independently verified field-level trust controls for this product. An unknown status is an evidence gap, not a finding of insecurity.

AWS source ↗ AWS source ↗

Use cases with realistic boundaries

FinOps and optimization

Prioritize opportunities and reconcile recommendations with Cost Explorer and actual invoices.

No proven ROI or guaranteed percentage cost reduction.

Cloud security

Rank configuration risks in the context of security-service signals and business priorities.

Not a penetration test, attack protection guarantee or compliance certificate.

Resilience and design

Review multi-AZ, failover and dependency recommendations using RTO/RPO objectives.

Availability must still be validated through actual failover testing.

Infrastructure as Code

Review proposed Terraform, CloudFormation and CDK changes against best practices.

Diff, plan, code review and approval required before deployment.

Well-Architected Agent vs DevOps Agent vs AgentCore

Product	Primary purpose	Scope
AWS Well-Architected Agent	Cloud architecture quality and optimization recommendations	Public preview; Business+ Support eligibility
AWS DevOps Agent	Incident investigation, operations and SRE workflows	Separate product availability and billing requirements
Amazon Bedrock AgentCore	Infrastructure for developing and operating custom AI agents	Not a direct cloud architecture review alternative

Adoption checklist

Verify that the support plan qualifies for every relevant account.
Limit IAM execution/access roles and verify SCP boundaries.
Define meaningful business goals, optimization pillars and application context.
Assign a reviewer to validate AI-generated recommendations.
Require explicit consent and audit trails for SSM runbook execution.
Inspect Cost Explorer availability, billing and related service charges.
Test production changes in staging with a documented rollback.

AgentenCode assessment: valuable, but not an autopilot

Combining AWS configurations, business goals and cross-pillar trade-offs could help large cloud teams prioritize architectural work. The important boundary is execution: convincing AI-generated guidance is not a validated production change. What AWS has documented is preview availability and specific capabilities, not independently demonstrated cost savings, universal architectural improvements or an external audit.

Trust: no field-level controls independently verified · Methodology and source verification →

Frequently asked questions

Is AWS Well-Architected Agent free?

Preview access requires Business+ or a higher AWS Support tier. The cited documents do not establish a universal stand-alone monthly price; additional AWS service charges may apply.

Is AWS Well-Architected Agent generally available?

No. It was announced as a public preview on October 1, 2026. Profiles can be hosted in three US regions.

Can it analyze resources in Europe?

AWS says workloads in all commercial regions can be scanned, even when the agent profile is hosted in the US. Data residency and organizational compliance need separate evaluation.

Does the agent autonomously repair AWS infrastructure?

Not generally. Prebuilt Systems Manager runbooks may be executed with consent; AI-generated remediation instructions are advisory and are not executed by the agent.

Which AWS permissions are required?

An execution role in the profile account and appropriate per-workload-account access roles are required. Validate their trust policies, least-privilege permissions and SCP compatibility.

How often are recommendations updated?

Current AWS documentation specifies approximately weekly resource and application recommendations. IaC architecture reviews are started manually.

How is it different from AWS DevOps Agent?

DevOps Agent concentrates on incidents and operations. Well-Architected Agent evaluates architecture and optimization opportunities.

Has AgentenCode independently tested this product?

No. Capabilities and quotas are sourced from AWS documentation, and unverified product-specific trust controls remain unknown.

Change log and editorial verification

2026-10-01 · AWS announced the public preview and related documentation.
2026-10-21 · AgentenCode reviewed official eligibility, quotas, IAM, remediation distinctions, recommendation cadence and preview scope. No hands-on product test.

Primary sources and evidence limits

Reviewed on October 21, 2026. Product behavior and quotas are described by AWS itself; AgentenCode has not conducted an independent functional or security audit. Preview access, pricing and APIs may change.

AWS setup and IAM documentation ↗

← All agents