Well-Architected in ten minutes

Lesson 1 of 5 in The Generative AI Lens: AWS Well-Architected for GenAI.

Most of this domain has taught you controls one at a time. This module teaches you the instrument AWS built for asking a harder question: is this generative AI workload, taken as a whole, well built? That instrument is the Well-Architected review, and since November 2025 it has a dialect that speaks GenAI fluently.

Start with the framework itself, because the lens makes no sense without it. The AWS Well-Architected Framework is AWS’s codified review discipline for cloud workloads, organised into six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. Each pillar breaks into a set of questions ('How do you manage access to your endpoints?'), and each question into best practices — concrete, checkable statements of what a well-run workload does. A review walks the questions and records, best practice by best practice, what you actually do.

The output is not a grade. Every best practice you don’t follow becomes a risk item, flagged at one of two levels: High-risk issues (HRIs) — the gaps most likely to hurt the business — and Medium-risk issues (MRIs). The review’s deliverable is a prioritised improvement plan: which HRIs to close first, and how. There is no pass mark, no certificate, no auditor’s signature. That is deliberate.

The framework is generic by design — the same six pillars interrogate a payroll system and a chatbot. So AWS added lenses: overlays of extra questions and best practices for a specific workload type. There are official lenses for serverless, SaaS, machine learning, and more; and there are custom lenses — lens definitions packaged as JSON that you import into the AWS Well-Architected Tool (the free console service that records workloads, answers, risks, and milestones).

The Generative AI Lens — published 19 November 2025 — ships through that second route: you download it from AWS’s public Well-Architected custom-lenses GitHub repository and import it into the WA Tool as a custom lens. From then on, reviewing a GenAI workload means answering the base framework’s questions plus the lens’s GenAI-specific ones, in the same tool, producing one combined risk list. A lens never replaces the framework; it sharpens it for one kind of workload.

The review lifecycle

  1. Define the workload

    Name the system, its owner, and its boundaries in the WA Tool. A workload is the unit of review — one application, not the whole company.

  2. Apply the GenAI lens

    Import the custom lens from the public GitHub repository once per account, then attach it to the workload alongside the base framework.

  3. Answer the questions together

    Builders, security, and operations in one room. For each question, tick the best practices you genuinely follow — evidence beats optimism.

  4. Tool surfaces HRIs and MRIs

    Every unticked best practice becomes a risk item at the severity the lens authors assigned it.

  5. Any high-risk issues?
  6. Build the improvement plan

    HRIs first. Assign owners and dates — an unowned finding is a finding you will meet again next review.

  7. Save a milestone

    A snapshot of answers and risks at a point in time. Milestones are how you prove improvement between reviews.

  8. Re-review on trigger or cadence

    Major changes — a new model, new customization, a new data source — or a scheduled cadence, commonly six to twelve months.

Key terms: AWS Well-Architected Framework, custom lens, high risk issue, improvement plan

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.