Quick answer: An AWS Well-Architected review is a structured evaluation of a workload against the AWS Well-Architected Framework's six pillars of operational excellence, security, reliability, performance efficiency, cost optimization and sustainability. It identifies high- and medium-risk issues and produces a prioritized improvement plan. For a small business workload, a review typically takes 1-2 weeks including remediation planning.
Key takeaways
- A review is scoped to one workload at a time, such as a customer app or donor database, not the whole account.
- The AWS Well-Architected Tool in the console records answers, risks and improvement plans at no extra charge.
- Security and reliability findings usually deserve priority, followed by quick cost wins.
- The value is in remediation. Schedule fixes and re-review after major changes or annually.
The AWS Well-Architected Framework is AWS's own description of what good looks like for workloads in the cloud. A review applies that framework to one of your systems and tells you, in priority order, where the risks are. For small businesses and nonprofits it is one of the most efficient ways to find security gaps, single points of failure and wasted spend in a short engagement. This guide is part of our AWS consulting series.
What is the AWS Well-Architected Framework?
The Well-Architected Framework is a set of design principles and questions organized into six pillars. It is vendor-published guidance based on patterns AWS has seen across many customers, and it is updated regularly.
| Pillar | Core question | Small business focus |
|---|---|---|
| Operational excellence | Can you run, monitor and improve the workload? | Runbooks, monitoring, infrastructure as code, deployment safety |
| Security | Are data, systems and identities protected? | MFA, least privilege, encryption, logging, incident response |
| Reliability | Does it recover from failure and meet demand? | Backups, multi-AZ, tested restores, quotas |
| Performance efficiency | Are resources used efficiently as demand changes? | Right instance types, managed services, caching |
| Cost optimization | Are you avoiding unnecessary cost? | Right-sizing, commitments, tagging, cleanup |
| Sustainability | Are you minimizing environmental impact? | Efficient resources, removing idle capacity |
AWS also publishes lenses that add workload-specific questions, such as the Serverless Applications Lens and lenses for SaaS and generative AI workloads.
What happens during a Well-Architected review?
A review is a facilitated conversation with the people who build and run the workload, supported by evidence from the account. It is not an audit or a pass/fail test.
- Scoping: choose one workload and define its business requirements, such as recovery time objective (RTO) and recovery point objective (RPO).
- Evidence gathering: review architecture diagrams, IAM configuration, Security Hub and Trusted Advisor findings, CloudWatch alarms, backup settings and cost reports.
- Pillar walkthrough: answer each question in the AWS Well-Architected Tool, marking which best practices are implemented.
- Risk identification: the tool flags high-risk issues (HRIs) and medium-risk issues (MRIs) based on unanswered best practices.
- Improvement plan: prioritize findings, assign owners and dates, and save a milestone for future comparison.
What issues do reviews commonly find in small AWS environments?
Small environments tend to share a familiar set of risks, mostly in security and reliability. None are exotic, and most are inexpensive to fix.
Security
- Root user used for daily work or without MFA.
- IAM users with long-lived access keys instead of single sign-on and roles.
- Security groups allowing SSH or RDP from anywhere.
- CloudTrail not enabled in all regions or logs stored in the same account they monitor.
- S3 buckets without Block Public Access at the account level.
Reliability
- Single EC2 instance or single-AZ database for a business-critical system.
- Backups configured but never test-restored.
- No alarms for failed health checks or full disks.
- Service quotas not reviewed before growth.
Operational excellence
- Infrastructure built by hand in the console with no code.
- No runbooks, so recovery depends on one person.
- Deployments done manually without rollback.
Cost optimization
- Oversized instances and idle resources.
- No tagging or budgets.
- Steady workloads running entirely on on-demand pricing.
How do you prioritize Well-Architected findings?
Rank by business impact and effort, and fix high-impact, low-effort issues immediately. A focused 30-60-90 day plan works well for small teams.
| Timeframe | Typical actions |
|---|---|
| First 30 days | Enforce MFA, remove root and static keys, close open admin ports, enable Block Public Access, turn on CloudTrail and GuardDuty organization-wide, test a restore |
| 30-60 days | Add CloudWatch alarms, enable AWS Backup policies, move databases to Multi-AZ where RTO requires it, set budgets and tags |
| 60-90 days | Codify infrastructure with Terraform or CloudFormation, automate deployments, right-size and apply Savings Plans |
Our AWS security best practices and AWS cost optimization guide go deeper on the two most common finding areas.
How do you prepare for a Well-Architected review?
Bring the right people and evidence, and be candid. The review is only as good as the answers.
Preparation checklist
- Identify the workload owner and a technical lead who knows how it is built and run.
- Gather a current architecture diagram, even a rough one.
- Document business requirements, including users, peak periods, RTO and RPO.
- Provide read-only access to relevant accounts, or export Security Hub, Trusted Advisor and Cost Explorer reports.
- List known pain points, recent incidents and planned changes.
- Note compliance obligations, such as HIPAA, PCI DSS or customer security requirements.
When is a Well-Architected review most valuable?
A review delivers the most value at decision points. It is especially useful:
- After a migration, to confirm the new environment meets best practices. See our AWS migration checklist.
- Before a customer security review or audit, to find gaps early.
- Before scaling, such as a product launch or fundraising campaign that will increase traffic.
- After an incident, to identify systemic causes.
- When costs jump without a clear reason.
For workloads you are building new, applying the framework during design is cheaper than reviewing afterward. Our cloud-native application architecture guide covers design principles that align with the framework.
Should you self-assess or use a facilitated review?
Self-assessment works for teams with solid AWS experience, while a facilitated review is usually faster and more candid for small teams. The questions are public, but judging risk accurately takes practice.
| Factor | Self-assessment | Facilitated review |
|---|---|---|
| Cost | Staff time only | Consulting fee |
| Objectivity | Teams tend to grade themselves generously | Independent view of risk |
| Depth | Limited to what the team already knows | Brings patterns seen across many environments |
| Speed | Often stalls between other priorities | Time-boxed, with a written plan at the end |
A practical middle ground is to self-assess first, then bring in a facilitator to validate high-risk answers and build the remediation plan.
How Desai InfoTech runs Well-Architected reviews
Desai InfoTech facilitates Well-Architected reviews for small businesses and nonprofits using the AWS Well-Architected Tool, then delivers a plain-language remediation plan your team or ours can execute. To schedule one, contact us or request a free cloud assessment.
How to run an AWS Well-Architected review: step-by-step summary
Scope the workload
Choose one workload, identify its owners, architecture, business requirements and recovery objectives.
Gather evidence
Collect architecture diagrams, account configuration, Security Hub findings, cost data and runbooks.
Answer the pillar questions
Work through each pillar's questions in the Well-Architected Tool with the team, recording which best practices are in place.
Prioritize risks
Rank high- and medium-risk issues by business impact and effort.
Plan and remediate
Build an improvement plan with owners and dates, fix the highest risks first, and save a milestone.
Frequently asked questions
Is an AWS Well-Architected review free?
The AWS Well-Architected Tool in the AWS console is available at no additional charge, so you can run a self-assessment. Many teams engage an AWS partner to facilitate the review because it requires experience to interpret the questions and judge risk. AWS has at times offered partner programs that support reviews, so ask about current options.
How long does a Well-Architected review take?
For a single small business workload, the review conversations typically take one to three working sessions, with evidence gathering and a written remediation plan adding a few days. End to end, most reviews finish in 1-2 weeks. Remediation time depends on the findings and can range from days for quick fixes to weeks for architectural changes.
What are the six pillars of the AWS Well-Architected Framework?
The six pillars are operational excellence, security, reliability, performance efficiency, cost optimization and sustainability. Each pillar has design principles and questions that describe best practices. AWS also publishes lenses that add questions for specific workload types, such as serverless applications, SaaS and generative AI.
How often should we do a Well-Architected review?
Review each important workload at least annually and after significant changes, such as a migration, a major new feature, a security incident or a large traffic increase. Saving milestones in the Well-Architected Tool lets you track how risk changes over time and show progress to leadership, customers or auditors.
Part of the AWS Consulting hub.