AWS just shipped an AI that reviews your cloud architecture, and the Well-Architected Agent is going to land on a lot of leadership agendas this quarter with the same question attached: can we trust it? Short answer: yes, as an analyst, not as an approver. The longer answer is about what it costs, what it can and cannot touch, and how it changes the way your teams do architecture reviews.
What the Well-Architected Agent is, in business terms
Announced in preview on October 1 (launch post), the agent is an AWS Support offering that continuously reads your resource configurations, utilization metrics and application topology, then checks them against the Well-Architected Framework across 65+ services and four pillars: cost optimization, security, resilience and performance.
The twist is prioritization. You give it goals in plain language, such as “reduce compute spend 20% by year end” or “payments must survive an Availability Zone failure,” and it ranks recommendations against those goals. That is the difference between a useful briefing and the wall of yellow warnings your teams learned to ignore in Trusted Advisor years ago.
The real price tag is your support plan
AWS has not published a separate line-item price for the agent during preview. What it has published is the gate: the agent profile requires Business+, Enterprise On-Ramp, Enterprise, or Unified Operations support. The Developer tier and the plain Business tier are excluded. Check where you sit on the AWS Support plans page.
If you are already on Enterprise or Enterprise On-Ramp, this is essentially a new capability bundled into money you already spend, and the decision is easy. If you are on Business, the question becomes whether the agent plus the other benefits of a higher tier justify the uplift. For a company with a meaningful AWS bill and a lean platform team, it often will. For a startup running a handful of services, probably not yet.
There is a second, smaller cost. For accurate dollar figures, the agent uses Cost Explorer’s resource-level daily data. Without it, savings estimates are based on public list prices, which ignore your Savings Plans and negotiated discounts. Granular data carries its own charges (see Cost Explorer pricing), and AWS notes it cannot simply be switched off once enabled. Make that call deliberately, with finance in the room.
Risk: what it can touch, and what it cannot
This is the part your CISO will ask about first, and the design is reassuring. The agent works through IAM roles that you create in each account. The managed policy AWS provides for scanning is read-only. Nothing auto-applies. The agent cannot resize an instance, change a security group or delete a snapshot. It reads, it recommends, and a human decides.
That matters because AWS is also refreshingly blunt that generative output “may contain errors.” Read-only access plus fallible advice is a perfectly fine combination. Write access plus fallible advice would be a very different conversation.
Three governance controls we recommend before broad rollout:
- Named owners for recommendations. Every application context should map to a team that triages its findings. Unowned recommendations rot.
- Change control stays in charge. Recommendations enter your normal backlog and change process. Architecture recommendations that come with updated infrastructure templates go through code review like any other change.
- Guardrails at the organization level. A service control policy that prevents anyone from expanding the agent’s roles beyond read-only is cheap insurance.
Preview risk is real, but manageable
Preview means APIs, output formats and behavior can change, and that service levels are not what you would expect at general availability. The agent runs in three US Regions (us-east-1, us-east-2, us-west-2) while onboarding workloads from any commercial Region, which may matter to teams with data-residency questions about where analysis happens.
The sensible move is a scoped pilot: one or two important workloads, a clear owner, a 60-day window, and a short list of questions you want answered. Did it surface anything your teams did not already know? Were its dollar figures close to reality? How much triage time did it consume? Those answers make the rollout decision for you.
What changes about architecture reviews
The traditional Well-Architected Review is a periodic event. A partner or internal architect interviews the team, works through the question set, and produces a findings report that starts aging the day it is delivered. It is valuable, but it is a snapshot built on what people remember about their own systems.
The agent flips that. It reads what is actually deployed, keeps reading, and re-prioritizes as your goals change. It can also review infrastructure-as-code before deployment and propose corrected templates, which pushes architectural feedback to the point where it is cheapest to act on.
That does not make human reviews obsolete. It changes their job. Instead of spending a workshop discovering that backups are not configured, your architects and partners can spend it on the judgment calls software cannot make well: trade-offs between pillars, organizational constraints, roadmap fit, and whether a recommendation makes sense for this business at this moment. Expect partner engagements to shift the same way, toward interpretation and implementation rather than inventory.
Where it fits next to tools you already pay for
- Trusted Advisor stays as the baseline. Its recommendations are visible without setting up an agent profile. The agent adds goal-aware ranking and application-level reasoning on top.
- Third-party CSPM and FinOps tools still cover multi-cloud estates and compliance reporting that an AWS-native agent will not. For AWS-heavy shops, expect overlap worth rationalizing at renewal time.
- The annual review becomes a quarterly or continuous conversation, with the agent doing the evidence gathering.
The executive checklist
- Confirm your support tier qualifies, or price the upgrade against expected savings and avoided incidents.
- Decide on Cost Explorer granular data with finance, knowing it is sticky.
- Pick one or two pilot workloads with named owners and specific, measurable goals (the getting started guide shows the setup).
- Keep every recommendation flowing through existing change control. No exceptions for “the AI said so.”
- Review results at 60 days and decide on scale-out, which is capped at 100 accounts per profile.
Our take: this is one of the more practical AI launches AWS has made this year. It reads instead of writes, it ranks against goals you control, and it shrinks the gap between “we did a review” and “we know what is running.” Trust it the way you trust a capable analyst: listen closely, verify before you act. The user guide is worth a skim before the pilot kickoff.
At Enkompass (enkompass.net), this is our home turf. We run Well-Architected reviews and remediation programs for AWS customers and help leadership teams turn findings into prioritized, funded roadmaps. If you’d rather have seasoned cloud people handle it instead of learning the hard way at 2 AM, let’s talk. Reach out through our contact page or call us directly at +1-828-436-5667 — we’ll help you turn this from a someday-project into a done-deal.