AWS Well-Architected Agent

• Setting a goal such as reducing EC2 spend by 20% and getting rightsizing and other cost recommendations ranked against it
• Uploading a Terraform or CDK project before deployment and getting back updated templates with Well-Architected fixes
• Finding which resources in a mission-critical application lack multi-AZ resilience and seeing what the fix does to cost and performance
• Downloading a resource-specific CLI remediation procedure and attaching it to a change-management ticket
• Scheduling an SSM runbook to apply a Trusted Advisor-derived fix on a recurring basis
• Sharing a prioritized recommendation with the account team that owns the affected resources

Well-Architected Agent turns the familiar pile of Trusted Advisor and Security Hub findings into a shorter list ranked against goals you write in plain language, and each item comes with a fix you can review and run. That makes it most useful for multi-account AWS teams that already pay for Business Support+ or higher and struggle to prioritize optimization work, rather than for teams looking for an agent that changes infrastructure on its own. It is a preview with a beta application view, a 30-recommendation cap per run, and AI-written fixes that AWS itself says to verify. The sensible rollout is one profile with a few concrete goals, scoped to a non-production account first, with its remediation procedures checked through your normal change process.

About AWS Well-Architected Agent

AWS Well-Architected Agent entered public preview on October 1, 2026, and AWS describes it as the next-generation evolution of AWS Trusted Advisor and the AWS Well-Architected Tool. You open it from the Well-Architected console and create an agent profile: up to 100 AWS accounts, the Regions to scan, the pillars you care about (cost optimization, security, resilience, performance), and plain-text business goals such as reducing EC2 spend by 20%. The agent reads configurations, utilization metrics, and topology through read-only IAM roles you create in each account. It also builds on findings and signals from Trusted Advisor, Compute Optimizer, Security Hub CSPM, Resilience Hub, and Cost Optimization Hub, plus Cost Explorer data when you enable it. It then ranks recommendations by impact and effort against those goals. Recommendations come at three levels. Resource findings target one resource and show dollar impact where applicable. Application findings span related resources and are still in beta. Architecture findings come from on-demand reviews of Terraform or AWS CDK projects uploaded through Amazon S3, and the agent returns updated templates in the same language. Each recommendation lists cross-pillar effects and trade-offs, and Start remediation produces a resource-specific procedure for the console, the AWS CLI, or Python SDK code that you can download for a change ticket. The agent does not run its AI-generated fixes itself. Only recommendations derived from Trusted Advisor checks come with pre-built Systems Manager runbooks, which can run with your consent or on a schedule. What sets it apart from generic checklists is the goal-based ranking and the ready-made fix for each finding. The tradeoffs are access and scope. The agent is limited to customers on Business Support+, Enterprise On-Ramp, Enterprise Support, or Unified Operations plans. It covers AWS only, profiles can be hosted only in three US Regions, and output is capped at 30 recommendations per run and five architecture reviews per profile per day. AWS also warns that its AI-generated output may contain errors.