Now liveThe Skillselion MCP - thousands of ranked skills, loaded into your agent mid-task. No install.Get it →
aws-samples avatar

Wa Review

  • 365 installs
  • 234 repo stars
  • Updated August 4, 2026
  • aws-samples/sample-well-architected-skills-and-steering

WA Review is a Claude skill that runs a full cross-pillar AWS Well-Architected Framework review of a workload's code and IaC to produce evidence-backed findings and prioritized remediation.

About

This skill performs a full AWS Well-Architected Framework review by analyzing code, IaC and configurations to produce evidence-backed findings with risk assessment and prioritized remediation. A solutions architect or developer uses it for a comprehensive all-pillars assessment rather than a single-pillar deep-dive. It bundles reference material including an agentic-AI lens covering security, reliability, performance, operations and cost questions for AI workloads.

  • Runs a full cross-pillar AWS Well-Architected review from code, IaC and configs
  • Produces evidence-backed findings with risk assessment and prioritized remediation
  • Includes an agentic-AI lens (AGENTSEC, AGENTREL, AGENTPERF, AGENTOPS, AGENTCOST)

Wa Review by the numbers

  • 365 all-time installs (skills.sh)
  • Ranked #399 of 1,039 Cloud & Infrastructure skills by installs in the Skillselion catalog
  • Data as of Aug 5, 2026 (Skillselion catalog sync)
At a glance

wa-review capabilities & compatibility

Capabilities
security assessment · reliability improvement plan · performance efficiency · operational excellence · sustainability optimization
Works with
aws
Use cases
security audit · devops
Pricing
Free
From the docs

What wa-review says it does

Perform a full AWS Well-Architected Framework review by analyzing code, IaC, and configurations to produce evidence-backed findings with risk assessment and prioritized remediation.
metadata.json
comprehensive architecture review
metadata.json
npx skills add https://github.com/aws-samples/sample-well-architected-skills-and-steering --skill wa-review

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

Listed on Skillselion
Installs365
repo stars234
Last updatedAugust 4, 2026
Repositoryaws-samples/sample-well-architected-skills-and-steering

What it does

Run a comprehensive cross-pillar AWS Well-Architected review of a workload from its code and IaC.

Who is it for?

a comprehensive all-pillars Well-Architected review of an AWS workload

Skip if: single-pillar deep-dive when a specific pillar skill exists, learning WA concepts or generating visual artifacts, creating architecture decision records, migration readiness assessment

When should I use this skill?

you want a comprehensive cross-pillar Well-Architected review

What you get

A full cross-pillar WA review with evidence-backed findings, risk assessment and prioritized remediation.

  • cross-pillar evidence-backed findings
  • risk assessment
  • prioritized remediation plan

By the numbers

  • bundles an agentic-ai lens with 7 AGENTSEC, 8 AGENTREL and 7 AGENTPERF reference files
  • version 2.1.0

Files

evals/evals.jsonJSONGitHub ↗
{
  "skill_name": "wa-review",
  "evals": [
    {
      "id": 1,
      "prompt": "I have a serverless e-commerce app on AWS using API Gateway, Lambda, DynamoDB, S3, and CloudFront. It handles about 10k orders per day. Can you do a Well-Architected review?",
      "expected_output": "A systematic 307-BP-level Well-Architected review with per-question assessment table (all 57 questions), BP ID citations, pillar scorecard, risk matrix, Eisenhower prioritization, and serverless-specific findings.",
      "assertions": [
        "The output includes a per-question assessment table covering all 57 WA questions (OPS 1-11, SEC 1-11, REL 1-13, PERF 1-5, COST 1-11, SUS 1-6) with Status and Risk Level columns",
        "Findings cite specific Best Practice IDs (format like SEC03-BP02, REL06-BP01, COST05-BP03) demonstrating BP-level evaluation",
        "The output includes a pillar scorecard with numerical scores (1-5) per pillar",
        "Risk assessment uses Impact x Likelihood matrix producing Critical/High/Medium/Low classifications",
        "The output includes an Eisenhower-matrix prioritized remediation plan with four quadrants (Do First, Plan, Delegate, Defer)",
        "Findings include serverless-specific issues referencing Lambda cold starts, DynamoDB capacity modes, API Gateway throttling, or CloudFront caching"
      ],
      "process_assertions": [
        "Response covers all 57 questions (not just 5-10 high-level themes)",
        "Findings are backed by specific BP IDs, not just pillar-level comments",
        "A prioritized remediation plan using Eisenhower matrix is included",
        "Architecture overview or discovery summary is presented before evaluation"
      ],
      "knowledge_assertions": [
        {
          "claim": "Lambda cold start optimization is addressed under PERF",
          "source": "AWS Well-Architected Performance Efficiency Pillar - PERF 1/PERF 3",
          "rationale": "Serverless workloads must address cold start latency as a performance concern"
        },
        {
          "claim": "DynamoDB on-demand vs provisioned capacity is evaluated under COST",
          "source": "AWS Well-Architected Cost Optimization Pillar - COST 7/COST 8",
          "rationale": "10k orders/day warrants evaluation of capacity mode and pricing model"
        }
      ]
    },
    {
      "id": 2,
      "prompt": "Review my architecture: we have a monolithic Java app on a single EC2 instance, MySQL on RDS single-AZ, no backups configured, SSH access with shared keys, no monitoring besides CloudWatch basic metrics. It's a customer-facing SaaS product.",
      "expected_output": "A review with 57-question table showing majority 'Not Implemented', BP-level citations for critical gaps, risk matrix showing multiple Critical/High findings, low pillar scores (1-2), and Eisenhower prioritization recognizing business criticality mismatch.",
      "assertions": [
        "Per-question assessment table covers all 57 questions with majority marked Not Implemented or Partially Implemented",
        "BP IDs cited for critical gaps: REL02 (network topology), REL11 (backups), SEC03 (permissions/shared keys), SEC08 (compute protection), OPS06 (observability)",
        "Risk assessment: single EC2 = Critical (Severe x High), no backups = High (Severe x Medium), shared SSH keys = Critical (Severe x High), single-AZ RDS = High (Severe x Medium)",
        "Pillar scorecard shows low scores (1-2) across most pillars",
        "Eisenhower Do First quadrant includes: enable backups, replace SSH keys with SSM/IAM",
        "Review recognizes business criticality mismatch — customer-facing SaaS with minimal reliability",
        "Recommendations are organized by Eisenhower quadrant (Do First, Plan, Delegate, Defer)"
      ]
    },
    {
      "id": 3,
      "prompt": "Can you do a quick WA review? We use ECS Fargate with ALB, Aurora PostgreSQL multi-AZ, ElastiCache Redis, CloudFront, WAF, GuardDuty, and deploy via CDK Pipelines with canary deployments. We have CloudWatch dashboards, X-Ray tracing, and automated scaling. Savings Plans are in place.",
      "expected_output": "A quick review covering all 57 questions at question level with high maturity scores, acknowledging strengths, no manufactured Critical findings, and suggesting only advanced improvements.",
      "assertions": [
        "Per-question assessment covers all 57 questions at question level (quick review mode)",
        "Pillar scorecard shows high maturity scores (3-5 range)",
        "Does NOT classify majority of findings as Critical — architecture is solid with multi-AZ, WAF, GuardDuty, canary deployments",
        "Prominently acknowledges existing strengths: canary deployments, multi-AZ Aurora, WAF, GuardDuty, X-Ray, automated scaling, Savings Plans",
        "Suggests advanced improvements: chaos engineering, multi-region DR, game days, sustainability, SLA-based alerting",
        "Includes Eisenhower-matrix or equivalent prioritized remediation plan"
      ]
    },
    {
      "id": 4,
      "prompt": "Review only the Security and Reliability pillars for my workload: API Gateway with Lambda authorizer, DynamoDB with encryption at rest, S3 buckets for user uploads, VPC with public and private subnets, and NAT Gateway. No WAF, no GuardDuty, single-AZ RDS for metadata, no DLQ on SQS.",
      "expected_output": "A pillar-scoped review evaluating ONLY Security (SEC 1-11) and Reliability (REL 1-13) with BP citations, without findings for other pillars.",
      "assertions": [
        "Review is scoped to ONLY Security and Reliability — does NOT produce findings for Cost, Performance, Sustainability, or Operational Excellence",
        "Per-question table covers the 24 scoped questions (SEC 1-11, REL 1-13) with Status and Risk Level",
        "BP IDs cited: SEC04 (detective controls/GuardDuty), SEC05 (network protection/WAF), REL10 (fault isolation/single-AZ RDS), and DLQ gap referenced as REL06 or REL07",
        "Risk assessment: no WAF = Medium, no GuardDuty = Medium, single-AZ RDS = High, no DLQ = High",
        "Eisenhower prioritization covers only the scoped findings",
        "Pillar scorecard shows only Security and Reliability scores (not all 6)"
      ]
    },
    {
      "id": 5,
      "prompt": "WA review for our GenAI application: we use Bedrock with Claude for inference, a RAG pipeline with OpenSearch Serverless for vector storage, Lambda for orchestration, S3 for document ingestion, and DynamoDB for conversation history. We have no guardrails, no content filtering, no model evaluation pipeline, and prompts are stored in plaintext in the code.",
      "expected_output": "A full review with core 57-question assessment PLUS Generative AI lens applied separately, citing both core BP IDs and GenAI lens references (GENSEC, GENOPS, etc.).",
      "assertions": [
        "Core framework: per-question table covers all 57 WA questions evaluated FIRST before lens",
        "Lens identification: explicitly identifies Generative AI lens applies and loads lens-specific questions",
        "BP citations from BOTH core (SEC01, SEC06, OPS04) AND GenAI lens (GENSEC01-06, GENOPS01-05)",
        "GenAI-specific findings: no guardrails = High, no content filtering = High, no model eval pipeline = Medium, prompts in plaintext = High",
        "Lens findings in SEPARATE section after core framework findings",
        "Eisenhower prioritization covers both core and lens findings",
        "Pillar scorecard for core 6 pillars included"
      ]
    }
  ]
}

Related skills

FAQ

When should I use wa-review instead of a single-pillar skill?

Use wa-review for a comprehensive all-pillars assessment; use security-assessment, reliability-improvement-plan or the other pillar skills for a single-pillar deep-dive.

Does wa-review cover AI agent workloads?

Yes, it bundles an agentic-AI lens with AGENTSEC, AGENTREL, AGENTPERF, AGENTOPS and AGENTCOST reference material.

Cloud & Infrastructureinframonitoringdeploy

This week in AI coding

Five minutes, every Monday - the tools, releases and tactics for developers.

unsubscribe anytime.