AWS's Well-Architected Agent reviews live accounts across 65+ services against goals teams declare

The review starts with access. The customer provisions IAM roles, and the agent uses them to read resource configurations, utilization metrics and application topology ^[10]. The agent profile also records the permissions required, next to the accounts and pillars in scope ^[3]. Whoever owns those roles decides how much of the estate the agent can see.

With that access, the agent correlates the three data sets and checks them against Well-Architected best practices across 65+ AWS services ^[4]. AWS contrasts this with "generic checklists" ^[14]. Joining utilization to configuration lets a finding name a single resource. AWS says those findings carry a specific dollar impact where applicable, plus step-by-step remediation ^[5]. Above that, the agent consolidates findings across the resources of one application, then proposes architectural patterns with the IaC changes needed to reach them ^[5].

The declared goals come in at the ranking step. The agent orders recommendations by impact and effort against the objectives the team states ^[2], and it surfaces trade-offs between pillars ^[7]. The post does not say how impact and effort are weighted against each other. I'd expect vague goals to produce a vague ranking.

Timing decides where this fits. Resource and application recommendations arrive within 24 hours of creating the profile ^[11]. A day's wait suits a monthly or quarterly review better than a pre-merge check.

AWS's post says the agent "evaluates your environment as an experienced cloud architect would" ^[13]. An experienced architect would also ask for read access before saying anything, so the comparison at least holds for setup. For the claim to hold on a given account, the agent's findings there would have to match what a human reviewer finds. Its ranking would also have to follow the trade-offs that team actually accepts. The post describes the agent's behaviour but does not report a comparison of that kind.

Remediation comes in three forms: console walk-throughs, updated IaC for architecture-level recommendations, and AWS CLI commands ^[6]. For an estate defined in Terraform or CDK, I'd take the IaC output and treat the other two as reference. A console or CLI fix changes the live resource and leaves the code that defines it unchanged. The service is in public preview ^[1].