Agent skill · data analytics · github
aws-well-architected-review
Perform an AWS Well-Architected Framework review of the current workload IaC and architecture, generating findings and GitHub issues for improvements.
Why this skill is useful
Provides domain-specific knowledge and structured review processes for AWS Well-Architected Framework that the AI wouldn't reliably generate on its own.
What it needs
Requires aws-cli installed locally. Requires github account access. About 4k tokens when loaded. Last updated 2026-08-07. 37,534 stars on the source repository.
What this skill does
AWS Well-Architected Review This workflow performs a structured AWS Well-Architected Framework (WAF) review against your workload's IaC files and deployed infrastructure. It identifies risks across all 6 WAF pillars and creates GitHub issues to track remediation. Prerequisites AWS CLI configured and authenticated IaC files present in the repository (Terraform, CloudFormation, CDK, or SAM) GitHub MCP server configured and authenticated Workflow Steps Step 1: Load Well-Architected Framework Reference Fetch current AWS WAF best practices: https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html Pillar-specific lenses relevant to the workload type (Serverless, SaaS, etc.) Step 2: Discover IaC & Architecture Scan the repository for IaC files: Terraform: /.tf CloudFormation/SAM: /.yaml, /.json (CFn templates) CDK: lib//.ts, bin//.ts, cdk.json Identify key AWS services in use (compute, data, networking, security, observability) and generate a Mermaid architecture diagram. Step 3: Pillar-by-Pillar Review Pillar 1: Operational Excellence [ ] All infrastructure defined as IaC (no manual console changes) [ ] Consistent tagging strategy applied across all resources [ ] CloudWatch alarms defined for key metrics [ ] Automated deployment pipeline present (no manual deployments) [ ] CloudTrail enabled for audit logging [ ] Runbooks or operational documentation present Pillar 2: Security [ ] IAM roles use least-privilege policies (no actions without justification) [ ] No hardcoded credentials in IaC or code [ ] Secrets managed via Secrets Manager or SSM Parameter Store [ ] S3 buckets have public access blocked and server-side encryption enabled [ ] Sensitive resources placed in private subnets [ ] Security groups restrict inbound to minimum required ports/CIDRs [ ] KMS encryption enabled for sensitive data stores (RDS, EBS, S3, SQS, DynamoDB) [ ] SSL/TLS enforced on all endpoints (enforceSSL: true) [ ] GuardDuty enabled (aws guardduty list-detectors) [ ] AWS WAF con …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills github/aws-well-architected-review