Well-Architected Review

Step 1: Define the workload scope

Ask the user to describe the workload:

What workload would you like me to review? Please share:

• Workload name and brief description
• Code packages/directories to analyze (IaC, application code, CI/CD configs)
• Business criticality (critical, high, standard, low)
• Current pain points (optional — anything you already know is problematic)

If the user has already provided architecture details or you are in a codebase with IaC, skip the prompt and proceed with discovery.

IMPORTANT: When no code or IaC is available to analyze (e.g., the user describes their architecture verbally), proceed with the review based on the information provided. Produce the full report using explicit statements in the architecture description as evidence. Treat omitted details as unknown, not as evidence that a control is absent. Mark unverifiable implementation details Cannot Determine, state what evidence would resolve them, and do NOT ask for code if the user has already given you enough context to perform a meaningful review.

Determine if a specialized WA Lens applies:

• SaaS, Serverless, Data Analytics, Machine Learning, IoT, Containers, Games, Financial Services, Healthcare