---
title: AWS Well-Architected Agent Ultimate Guide: Preview Access, Quotas, and IaC Reviews (October 2026)
description: On October 1, 2026, AWS opened Well-Architected Agent in preview. One profile covers up to 100 accounts on a 7-day refresh, and Business+ is limited to 2 profiles. Developer and Business support have no access.
url: https://www.factualminds.com/blog/aws-well-architected-agent-preview-guide/
datePublished: 2026-10-03T00:00:00.000Z
dateModified: 2026-10-03T00:00:00.000Z
author: palaniappan-p
category: Cloud Architecture
tags: well-architected, trusted-advisor, aws-support, cloud-architecture
---

# AWS Well-Architected Agent Ultimate Guide: Preview Access, Quotas, and IaC Reviews (October 2026)

> On October 1, 2026, AWS opened Well-Architected Agent in preview. One profile covers up to 100 accounts on a 7-day refresh, and Business+ is limited to 2 profiles. Developer and Business support have no access.

On **October 1, 2026**, AWS opened [Well-Architected Agent](https://aws.amazon.com/about-aws/whats-new/2026/10/aws-well-architected-agent/) in preview. One profile can analyze **up to 100 accounts** and scan resources in any commercial Region. Scheduled recommendations cool down for **7 days**, and each run stops at **30** recommendations. Access starts at **Business+**. The [quotas page](https://docs.aws.amazon.com/wellarchitected/latest/userguide/agent-quotas.html) lists **Developer** and **Business** as no access.

The agent analyzes four optimization pillars: cost, security, resilience, and performance. Operational Excellence and Sustainability stay on the Well-Architected Tool. Resilience is the name the agent uses for reliability concerns. Pillar definitions live in the [six-pillar guide](/blog/aws-well-architected-framework-6-pillars-explained/). Review cadence and the self-versus-partner choice live in the [buyer guide](/blog/aws-well-architected-review-buyer-guide-2026/). Adoption sequencing lives in the [CAF practice map](/blog/aws-cloud-adoption-framework-practice-map-well-architected/).

FactualMinds has not created an agent profile in a customer account. The figures below are the October 1, 2026 user guide, checked again on October 3, 2026. Preview text can move. Re-open the quotas page the week you onboard.

## Who can turn it on

| Support tier | Access | Max profiles | Max applications per profile |
| --- | --- | --- | --- |
| Developer | No | none | none |
| Business | No | none | none |
| Business+ | Yes | 2 | 7 |
| Enterprise On-Ramp | Yes | 10 | 30 |
| Enterprise Support | Yes | 10 | 30 |
| Unified Operations | Yes | 10 | 30 |

A Business plan is a paid support plan. The quotas page still excludes it. Read the plan name in the AWS Support console before you put the agent on a quarterly architecture agenda. A landing zone of 40 accounts still fits inside the **100-account** profile cap. Business+ allows **2** profiles, enough for one production profile and one non-production profile. A sandbox organization needs a third profile. Enterprise On-Ramp, Enterprise Support, and Unified Operations allow **10**.

Profiles are hosted in **US East (N. Virginia)**, **US East (Ohio)**, or **US West (Oregon)**. From one of those three Regions, the agent scans resources in any commercial Region. The October 1, 2026 pages cited here do not list GovCloud as a host Region or a scan target.

> **What broke** — Documented access gap, October 1, 2026. The quotas page lists Developer and Business as no access. The what's-new post says the agent is available to customers with an AWS Support plan. Follow that sentence on a Business-tier account and the Well-Architected console offers no create-profile action. Detection is the plan name in the AWS Support console. Until the payer account is Business+ or higher, stay on the Well-Architected Tool.

## Four paths, four jobs

AWS describes the agent and the Tool as two ways to review architecture, usable at the same time from the Well-Architected console. Trusted Advisor is an input the agent ingests. A partner review is still a person in a working session.

| Path | Use it for | Leave this in place |
| --- | --- | --- |
| Trusted Advisor | Checks the agent can ingest | The checks. The agent adds goal ranking and remediation packaging. |
| Well-Architected Tool | Milestones, your answers, HRI and MRI history, lenses | Operational Excellence, Sustainability, and any lens the agent architecture review will not accept. |
| Well-Architected Agent | A 7-day refresh of at most 30 recommendations, plus on-demand IaC reviews | A named owner on every generated fix. Application-level recommendations are beta. |
| Partner-led review | A facilitated workshop and a written plan | The review calendar in the [buyer guide](/blog/aws-well-architected-review-buyer-guide-2026/). |

**We recommend this split.** Keep the Tool review, self-serve or partner-led, on the buyer-guide calendar. Add the agent as the 7-day triage layer when the payer account is Business+ or higher. Trade-off: the scanning role reads widely across every account in the profile, the service is preview, and 30 recommendations per run leave a diligence pack unfinished.

## How a profile runs

The [agent overview](https://docs.aws.amazon.com/wellarchitected/latest/userguide/agent.html) describes four steps.

1. Create a profile that names accounts, Regions, optimization pillars, and business goals. Caps: **100** accounts and **10** active goals.
2. The agent scans the resources in those accounts.
3. It writes recommendations at resource, application, and architecture levels. Scheduled runs wait **7 days** between generations for the same profile and return at most **30** recommendations. Stored recommendations can accumulate across runs.
4. A person reviews the recommendations and deploys from the supplied guidance.

Application-level recommendations are a new format, and AWS marks them **beta**. The same page tells you to review each recommendation before you act on it. The quotas page caps how many applications a profile may hold: **7** on Business+, **30** on Enterprise On-Ramp, Enterprise Support, and Unified Operations. Record how many applications you will group. Treat the cap as a preview limit and leave the rest unused.

## Three recommendation levels

**Resource.** A finding against a resource the scan could read. These arrive on the schedule. The architecture-review page says resource and application recommendations cannot be started on demand.

**Application.** The beta format, bounded by the applications-per-profile cap above. Grade the first set as a sample before you assign owners.

**Architecture.** An on-demand review of IaC, before that template is deployed. You start it yourself. The limit is **5** architecture reviews per day per profile, and these reviews sit outside the 7-day scheduled cycle. You can run them back to back while the daily quota remains.

That split changes the pull-request habit. A template review can happen the day you open the PR, up to five times. A resource finding waits for the next scheduled run.

## IaC reviews, and where the docs disagree

[Conducting architecture reviews](https://docs.aws.amazon.com/wellarchitected/latest/userguide/agent-architecture-reviews.html), dated with the October 1, 2026 preview, says **AWS CDK and Terraform** projects are supported. You pass an S3 URI. Accepted inputs:

- A **.zip of 25 MB** or smaller.
- An S3 folder of **100 MB** or smaller, with each file **1 MB** or smaller.

The bucket has to be in the **same Region as the agent profile**. If the console shows no objects, check the bucket Region before you debug the template. You must select the consent checkbox. The review does not start without it. The only lens is the Well-Architected Framework lens, `arn:aws:wellarchitected::aws:lens/wellarchitected`. Pillar values are `COST_OPTIMIZATION`, `SECURITY`, `RESILIENCE`, and `PERFORMANCE`.

The same day's [release notes](https://docs.aws.amazon.com/wellarchitected/latest/userguide/release-notes.html) name **CloudFormation and Terraform**. The [what's-new post](https://aws.amazon.com/about-aws/whats-new/2026/10/aws-well-architected-agent/) names Terraform, CDK, and CloudFormation. If the repo is CDK or Terraform, follow the architecture-review page. If the artifact is a raw CloudFormation template, the release notes name that format, and you should re-read the review page before you depend on it. Preview sentences moved between those three pages on the launch day.

Returned code matches the source language. A Terraform file comes back as Terraform.

On-demand generation accepts the `ARCHITECTURE` type only. `StartAgentRecommendationGeneration` is the API. The sample below is the documented shape, with AWS's placeholder account `111122223333`.

AWS CLI, `wellarchitected` namespace, preview API as published October 1, 2026. Replace the profile ARN, review name, and bucket.

```bash
aws wellarchitected start-agent-recommendation-generation \
  --profile-arn "arn:aws:wellarchitected:us-east-1:111122223333:agent-profile/my-profile" \
  --types ARCHITECTURE \
  --name "my-architecture-review" \
  --scope '{"pillars":["COST_OPTIMIZATION","SECURITY"]}' \
  --additional-context '{"s3Uri":"s3://your-bucket/your-template.yaml","lensArns":["arn:aws:wellarchitected::aws:lens/wellarchitected"]}'
```

Poll with `GetAgentRecommendationGeneration` or `ListAgentRecommendationGenerations`.

## What the scan skips

Scanning uses the service-linked role policy [`AWSWellArchitectedAgentResourceScanningServiceRolePolicy`](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSWellArchitectedAgentResourceScanningServiceRolePolicy.html). AWS describes it as read-only access to resource configuration, security settings, and operational data. You cannot attach that service-linked policy to an IAM user, group, or role.

The agent overview says the service ingests findings from Trusted Advisor, then adds personalization, goal ranking, and remediation. Leave Trusted Advisor enabled. The agent is a reader of those checks, plus a ranking layer.

The quotas page also lists CloudFormation resource types the agent does not read. A resource-level report omits them even when they are in the account. Types that change the meaning of a "clean" report:

- `AWS::OpenSearchService::Domain`
- `AWS::WAFv2::WebACL`
- `AWS::Lambda::LayerVersion`
- `AWS::IAM::RolePolicy` (and the user and group inline-policy types)
- `AWS::ControlTower::EnabledControl`
- `AWS::ElasticLoadBalancingV2::ListenerRule`

Read the full unsupported-types table before you close findings. A report with zero resource findings still skipped those types.

## Use the agent between reviews

Keep the annual or event-driven Tool review. Use the agent, when the support plan allows it, to refresh cost, security, resilience, and performance findings on the 7-day cycle between those reviews.

Generated SSM runbooks, CLI scripts, and IaC diffs are drafts. Put a name in `human_owner_before_ssm_apply` on the worksheet before anyone runs one. Application-level items stay in the beta pile until AWS takes that label off.

The [Well-Architected assessment](/tools/aws-well-architected-assessment/) is a self-check you can run before a profile exists. A [partner architecture review](/services/aws-architecture-review/) is the facilitated session, with a written plan, when you want a person in the room.

## What this post doesn't cover

- A customer run of the preview. We have not created a profile in a customer account, and this post does not report a savings, risk, or latency result.
- A price. The October 1, 2026 pages cited here publish a support-plan gate, not a service charge.
- The full API surface. One CLI shape is above. The rest is the Well-Architected API reference.
- Pillar teaching, CAF sequencing, HRI caps, and lens choice. Those are the three posts linked at the top.
- Remediation credits. The agent pages cited here do not describe them. The Tool review path is the one the buyer guide covers.
- GovCloud.

## What to do this week

1. Open AWS Support and write down the plan name. If it is Developer or Business, stop and use the Tool.
2. If it is Business+ or higher, pick one host Region: us-east-1, us-east-2, or us-west-2.
3. Fill [profile-scope-worksheet.csv](https://www.factualminds.com/examples/architecture-blog-2026/well-architected-agent/profile-scope-worksheet.csv). Stay at or under 100 accounts, 10 goals, and the tier's application cap.
4. Put the IaC zip in a bucket in that same host Region, at or under 25 MB.
5. Run one architecture review against the framework lens. Read it. Do not apply the first SSM document the same day.
6. Leave the next Tool review on the calendar. The buyer guide's readiness checklist is the prep for that session.

> **Reproduce this** — Open [agent-vs-tool-vs-review.md](https://www.factualminds.com/examples/architecture-blog-2026/well-architected-agent/agent-vs-tool-vs-review.md) and [profile-scope-worksheet.csv](https://www.factualminds.com/examples/architecture-blog-2026/well-architected-agent/profile-scope-worksheet.csv). Complete sections 1–3 of the checklist. Replace the template row in the CSV. Stop before any SSM apply.

**Related:** [Architecture review](/services/aws-architecture-review/) · [Well-Architected assessment](/tools/aws-well-architected-assessment/) · [Contact](/contact-us/)

## FAQ

### Who can use AWS Well-Architected Agent during the preview?
As of the October 1, 2026 quotas page, access starts at Business+. Enterprise On-Ramp, Enterprise Support, and Unified Operations also qualify. Developer and Business plans are listed as no access. Business+ may create 2 profiles with 7 applications each. The three higher tiers may create 10 profiles with 30 applications each.

### When should we not turn the agent on?
Skip it when the payer account is on Developer or Business support, when the workload decision depends on Operational Excellence or Sustainability, or when you need a milestone history for diligence. Those paths stay on the Well-Architected Tool and, when the calendar calls for it, a partner-led review. The agent pages published October 1, 2026 do not describe remediation credits.

### Does the agent replace a Well-Architected Review?
Keep the Tool review. The agent adds a 7-day recommendation cycle, capped at 30 recommendations per run, plus on-demand architecture reviews of IaC. The Tool still holds milestones, your answers, and lenses. A partner review is still the facilitated workshop. Use both from the Well-Architected console.

### What could go wrong if we apply a generated runbook?
AWS marks application-level recommendations as beta and tells you to review every recommendation before you act. Resource and application recommendations are produced on the schedule. They cannot be started on demand. An SSM runbook, CLI script, or IaC diff is a draft until a named owner has read it. Applying the first document on the day it appears skips that review.

### Which IaC can an architecture review read?
The October 1, 2026 architecture-review page says AWS CDK and Terraform projects, uploaded as a zip of 25 MB or smaller or an S3 folder of 100 MB or smaller with each file at most 1 MB. The same-day release notes also name CloudFormation templates. The S3 bucket must be in the same Region as the agent profile. Only the Well-Architected Framework lens is accepted.

### Does the agent cover all six pillars?
It analyzes four: cost optimization, security, resilience, and performance. Resilience is the agent's name for reliability concerns. Operational Excellence and Sustainability are outside that list. Architecture-review pillar values are COST_OPTIMIZATION, SECURITY, RESILIENCE, and PERFORMANCE.

---

*Source: https://www.factualminds.com/blog/aws-well-architected-agent-preview-guide/*