AWS Well-Architected Reviews are a standard part of cloud operations, but the output can be overwhelming. The tool flags dozens of issues across six pillars, yet not all carry equal weight. In practice, five categories of findings dominate every review we run — and fixing these delivers the highest ROI.
The six pillars — operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability — provide a framework. Most teams focus on security and reliability first. Cost optimization often surfaces last but has immediate financial impact.
The Five Recurring Issues
- IAM over-permissioning. Broad policies like AdministratorAccess on service roles create blast radius. Fix by applying least-privilege policies using Access Analyzer and IAM Access Advisor. Most teams reduce permissions by 70% without breaking workloads.
- No multi-AZ deployments. Single-AZ RDS or EC2 instances fail during AZ outages. Enable Multi-AZ for databases and spread Auto Scaling groups across zones. Recovery time drops from hours to minutes.
- Missing encryption at rest. S3 buckets, EBS volumes, and RDS instances often lack KMS encryption. Enable default encryption and rotate keys annually. Compliance gaps close immediately.
- No cost allocation tags. Without tags, FinOps visibility disappears. Implement a mandatory tagging strategy covering environment, owner, project, and cost center. This enables accurate chargeback and anomaly detection.
- Backup and DR gaps. Many workloads lack automated backups or cross-region replication. Define RPO/RTO targets and implement AWS Backup plans with cross-region copy. Test restores quarterly.
Prioritization Framework
Rank findings by blast radius and business impact. Security and reliability issues that affect production come first. Cost findings that save >$5k/month follow. Low-impact items like missing tags on dev resources can wait.
Common excuses — "it works in production," "we'll fix it later," "the review tool is too strict" — rarely hold up. Actual fixes are usually one Terraform change or one CLI command away.
Internal links to related guidance: see our AWS Savings Plans complete guide and AWS tagging strategy for FinOps.
Remediation Steps
For IAM: run aws iam generate-service-last-accessed-details and attach scoped policies. For encryption: update KMS key policies and enable bucket defaults. For cost allocation: enforce tagging via SCPs and AWS Config rules.
Most organizations close the top five findings in under two weeks once prioritized. The review becomes a living document rather than a one-time report.
FAQ
How often should we run Well-Architected Reviews?
Quarterly for production workloads. Monthly for high-change environments. The tool itself can be automated via the Well-Architected Tool API and Lambda.
Does the review cover cost optimization automatically?
Yes, but the cost pillar requires workload-specific lenses. Use the FinOps lens for deeper savings analysis.
What if findings conflict with existing architecture?
Treat them as signals, not mandates. Document exceptions with compensating controls. Most "conflicts" are actually technical debt that can be addressed incrementally.
How do we measure remediation success?
Track the Well-Architected score before and after, plus business metrics: MTTR, monthly cloud spend, and audit findings.
Can small teams handle this without a dedicated SRE?
Yes. Start with the top five issues above. Use managed services like AWS Backup and Config to reduce operational load. Fractional cloud expertise accelerates the process.
Have a project that needs this? Talk to Rutagon or call 907-841-8407.
Related reading: Kubernetes node right-sizing, cloud cost anomaly detection.