← Back to docs

AWS Well-Architected Quick Review Checklist

A practical, engineer-friendly checklist distilled from the AWS Well-Architected Framework's six pillars, use it to review any workload before it goes to production.

AWS Well-Architected Quick Review Checklist

The AWS Well-Architected Framework is excellent but long. This is the distilled, engineer-facing version I actually run through before signing off a workload, six pillars, the questions that matter most, and the AWS services that help.

1. Operational Excellence

  • Infrastructure is code (Terraform/CloudFormation), not console clicks.
  • Deployments are automated and repeatable (CI/CD), with safe rollback.
  • Runbooks exist for the top failure modes; on-call can act without tribal knowledge.
  • Changes are small, reversible, and observable.
  • Helpers: CloudFormation/CDK, CodePipeline, Systems Manager, CloudWatch dashboards.

2. Security

  • Least-privilege IAM: scoped actions + resources, conditions, no *:*.
  • No long-lived keys: roles, IRSA/task roles, and OIDC for CI.
  • Data encrypted at rest (KMS) and in transit (TLS everywhere).
  • Secrets in Secrets Manager / Parameter Store, never in code or env files.
  • CloudTrail on (org-wide, tamper-protected); GuardDuty + Security Hub enabled.
  • Network segmented; security groups scoped; public exposure minimised.
  • Helpers: IAM Access Analyzer, KMS, Secrets Manager, GuardDuty, Security Hub, WAF.

3. Reliability

  • Multi-AZ for anything that must stay up; DR plan with tested RTO/RPO.
  • Auto-scaling sized to real load; health checks and self-healing.
  • Backups automated and restore-tested (a backup you haven't restored isn't a backup).
  • Quotas/limits known; you won't hit a service limit under load.
  • Helpers: Auto Scaling, Route 53 health checks, AWS Backup, Multi-AZ RDS, Aurora.

4. Performance Efficiency

  • Right service for the job (serverless vs containers vs VMs, chosen, not defaulted).
  • Right-sized instances; Graviton considered for price/performance.
  • Caching where it counts (CloudFront, ElastiCache).
  • Async/event-driven for spiky or decoupled work (SQS, EventBridge).
  • Helpers: Compute Optimizer, CloudFront, ElastiCache, Lambda, SQS/EventBridge.

5. Cost Optimization

  • Everything tagged for cost attribution (team/env/project).
  • Right-sized; idle resources removed (unattached EBS, idle NAT/LBs).
  • Commitments (Savings Plans/RIs) for steady load; Spot for fault-tolerant work.
  • Budgets + Cost Anomaly Detection alerting before surprises.
  • Storage lifecycle policies (S3 tiers, gp3 over gp2).
  • Helpers: Cost Explorer, Budgets, Compute Optimizer, S3 Lifecycle, Savings Plans.

6. Sustainability

  • Scale to zero / down where possible (serverless, autoscaling).
  • Efficient instance types (Graviton) and regions.
  • Delete unused data and resources on a schedule.

How to use this

  1. Pick a workload.
  2. Walk the six pillars; mark each box honestly.
  3. The unchecked boxes are your prioritised backlog, fix the Security and Reliability gaps first.
  4. Re-review quarterly and after any major change.

This pairs with the guardrails in my aws-multi-account-organization and the IaC patterns in terraform-aws-reference-architecture. A review is only as good as the follow-through, turn the gaps into tickets and close them.

Reactions & comments