Well-Architected Agent turns the architecture review into a weekly queue of 30 findings per profile
AWS put Well-Architected Agent into preview on 10/01/2026, capping each scheduled run at 30 recommendations with a 7-day cooldown. A dev.to post says that makes the triage team the bottleneck.
The Engineer · Build desk
Comparison of weekly limits: a Business+ account with 2 profiles sees at most 60 scheduled recommendations a week. A top-tier account with 10 profiles sees at most 300.
Scheduled recommendations a week, at most, per account In recommendations
| Item | Value | Claim |
|---|---|---|
| Business+ account, 2 profiles | 60 recommendations | 20 |
| Top-tier account, 10 profiles | 300 recommendations | 20 |
What happened
- Each profile covers up to 100 accounts and scans every commercial Region, running from us-east-1, us-east-2 or us-west-2.
- Access needs a Business+ Support plan or higher: Business+ gets 2 profiles with 7 applications each, and the top tiers get 10 profiles with 30.
- The agent builds on Trusted Advisor, Compute Optimizer, Security Hub CSPM, Resilience Hub and Cost Optimization Hub signals, then adds goal-based prioritization and remediation.
- Infrastructure-as-code reviews are limited to 5 per day per profile, with size caps on zips, S3 folders and single files.
- The quotas page lists CloudFormation types the agent does not analyze, including WAFv2 WebACL, Organizations Policy and IAM RolePolicy.
Why it matters
- constraint Triage volume has a fixed ceiling: a Business+ account with 2 profiles sees at most 60 scheduled recommendations a week, and a top-tier account with 10 profiles at most 300.
- exposure A clean security pillar can mean WAF rules, SCPs and inline IAM policies were never analyzed, and the post says an auditor under BACEN 4.893 or PCI-DSS checks those controls first.
- cost With Cost Explorer off, dollar impact comes from public pricing, and in an account with an EDP the post says that can invert the priority order.
- decision Teams have to name a triage owner and record each unsupported type next to the tool that covers it, which the post suggests should be AWS Config conformance packs or Security Hub CSPM.
Two inputs that teams write set how the agent prioritizes. Goals are plain text, up to 10 per profile, one pillar each, and they order the queue [8]. Application context takes one of four criticality values: MISSION_CRITICAL, BUSINESS_CRITICAL, NON_CRITICAL or TEST_DEVELOPMENT [9]. Per the post, a badly written goal mis-prioritizes without raising an error, and skipping criticality gets recommendations tuned for the average case [8][9]. The post does not say how the agent chooses which 30 when a run finds more.
Template reviews have a separate quota. Architecture-level recommendations come from CloudFormation, Terraform or CDK templates, sent as a zip or S3 URI before deployment [10]. At 5 reviews per day per profile [6], a profile gets 35 a week [21]. The author says that is too few to gate every pull request and enough for a merge to the release branch [12].
The author cites 16 years operating financial platforms on AWS [23]. The open question, in the author's words, is "who triages 30 findings a week, and what happens to what it cannot see?" [13] The answer offered for the first half is an owner: "a findings tool without a triage owner becomes just another red dashboard everyone learns to ignore." [22]
In our view the fixed-size queue is a sound default for a team with a named triage owner and a short list of goals, because it forces a ranking. It is a poor fit for a team that wants a pass/fail gate, since the quotas cap how many findings and reviews each profile gets [1][6].
Publishing the unsupported-type list is good engineering. A documented gap can be covered by something else. The agent is in preview, and the post expects the list to shrink and says to review it each quarter [17].
What to watch
- Whether AWS shortens the list of unsupported CloudFormation types as the preview matures, as the post expects.
- Whether application-level recommendations, which the documentation marks as beta, leave beta.
- Whether AWS changes the 30-per-run cap or the 5-per-day IaC review quota before general availability.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap
- Insufficient
- Incentives
- Insufficient
- Confidence52
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
AWS put AWS Well-Architected Agent into preview on 10/01/2026, replacing the event-style review with scheduled scans, up to 30 recommendations per run, and a weekly refresh.
- [2]
There is a 7-day cooldown between scheduled runs of the same profile.
- [3]
Each profile covers up to 100 accounts and scans every commercial Region from us-east-1, us-east-2 or us-west-2.
- [4]
Access requires a Business+ Support plan or higher. Business+ gets 2 profiles and 7 applications per profile; Enterprise On-Ramp, Enterprise and Unified Operations get 10 and 30. Developer and Business are excluded.
- [5]
The agent ingests Trusted Advisor findings, Compute Optimizer rightsizing signals for EC2, Lambda and RDS, Security Hub CSPM, Resilience Hub assessment data and Cost Optimization Hub, and adds prioritization against written goals, cross-pillar trade-off analysis and ready remediation.
- [6]
Infrastructure-as-code reviews are limited to 5 per day per profile; zip files up to 25 MB, S3 folders up to 100 MB, individual files up to 1 MB.
- [7]
The quotas page lists CloudFormation resource types the agent does not analyze, including AWS::WAFv2::WebACL, AWS::Organizations::Policy and AWS::IAM::RolePolicy.
- [8]
Goals are configuration: up to 10 per profile, plain text, one pillar each, and they order the queue. A badly written goal mis-prioritizes without raising any error.
- [9]
Application context accepts MISSION_CRITICAL, BUSINESS_CRITICAL, NON_CRITICAL and TEST_DEVELOPMENT; whoever skips it gets recommendations tuned for the average case.
- [10]
Architecture-level recommendations are generated from CloudFormation, Terraform or CDK templates sent as a zip or S3 URI, before deployment.
- [11]
Without Cost Explorer enabled, the agent estimates cost from public pricing, which ignores Savings Plans, Reserved Instances and contractual discounts; in an account with an EDP, the dollar impact can be inflated enough to invert prioritization.
- [12]
Five IaC reviews per day per profile cannot back a gate on every pull request; they fit on merge to the release branch.
- [13]
who triages 30 findings a week, and what happens to what it cannot see?
- [14]
The failure mode is silent: the report arrives clean on the security pillar, someone takes the screenshot to the risk committee, and the absence of WAF findings is read as a well-configured WAF when it is an unanalyzed WAF.
- [15]
The unsupported types include controls an auditor checks first in an environment under BACEN 4.893 or PCI-DSS: the WAF edge, SCPs, and inline IAM policies.
- [16]
The post's mitigation is to keep those controls covered by AWS Config conformance packs and Security Hub CSPM directly, outside the agent, and to write in the governance document which types the agent does not cover and which tool covers each one.
- [17]
The unsupported list is marked preview and should shrink, so it should be reviewed every quarter instead of assumed stable.
- [18]
Thirty recommendations per run and a 7-day cooldown mean a triage ceiling per profile, and the bottleneck becomes the team.
- [19]
Application-level recommendations consolidate findings across related resources, a format the documentation itself marks as beta.
- [20]
At one scheduled run per profile per week at the cap, a Business+ account with 2 profiles sees at most 60 scheduled recommendations a week and a top-tier account with 10 profiles at most 300.
- [21]
At 5 IaC reviews per day, a profile gets 35 IaC reviews per week.
- [22]
a findings tool without a triage owner becomes just another red dashboard everyone learns to ignore.
- [23]
The post's author cites 16 years operating financial platforms on AWS.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toWell-Architected Agent: architecture review becomes a weekly process
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- AWS Well-ArchitectedFollow
- Infrastructure as CodeFollow
- Cloud governance and complianceFollow
Entities
- Amazon Web ServicesFollow
- AWS Well-Architected AgentFollow
- dev.toFollow
- AWS Security HubFollow
- AWS Trusted AdvisorFollow