Which pillars does CloudArq actually cover?

All six: Security, Cost Optimization, Reliability, Performance Efficiency, Operational Excellence, and Sustainability. This is a whole-framework review, not a security-only scan. The checks below are grouped under real pillar control areas — SEC, COST, REL, PERF, OPS and SUS — so a finding always tells you which pillar it belongs to.

Does CloudArq change my AWS to fix the findings?

No. CloudArq connects through a read-only IAM role with an ExternalId and reads configuration and metadata only — it never stores your credentials, application data, database contents, or S3 objects, and it never auto-fixes anything. Each finding ships with exact remediation steps (a CLI command or Terraform block) that you review and apply yourself. Detection plus the fix, never a hidden change to your account.

How does CloudArq decide which checks map to which pillar?

Each scanner check is mapped to a Well-Architected pillar control area in a backend mapping table that is the single source of truth. The count on this page is the number of distinct checks that carry a Well-Architected mapping — it is pinned by a drift-guard test, so the figure can never silently disagree with the backend. Cost-optimization waste alone (COST-3) spans around twenty distinct checks, which is why Cost is one of the deeper pillars here.

Which CloudArq tier includes the Well-Architected mapping?

The underlying resource checks run from the free Starter tier upward. The Well-Architected framework grouping is part of the Max tier’s full 8-framework set; the Pro tier maps four frameworks (CIS, SOC 2, ISO 27001, GDPR). Max also unlocks the AI Workload lens and AI-assisted remediation. See the pricing page for the exact tier breakdown.

Does passing these checks make me “Well-Architected certified”?

There is no such thing as a Well-Architected certification, and CloudArq does not issue or imply one. A scanner shows posture against the framework’s guidance; it does not certify or guarantee an outcome. CloudArq the business holds zero certifications of its own. What you get is an honest, current map of where your account aligns with the six pillars and exactly what to change.

frameworkwaf

scopeaws

pillarsall 6

framework review · aws · well-architected

An automated AWS Well-Architected review — across all six pillars

CloudArq reads your live AWS configuration through a read-only role and reports where it drifts from Well-Architected guidance — not just Security, but Cost, Reliability, Performance, Operational Excellence and Sustainability too. Every finding is tagged to its pillar control area and ships with the exact fix. An automated review that makes the official AWS workshop faster, not a replacement for it.

Updated 2026-07-20 · ~11 minute read

checks mapped to the pillars

Well-Architected pillars

control areas below

agents installed

See CloudArq run the review View pricing

audience

Who this is for

Teams running production workloads on AWS who want a fast, honest read on how their account stacks up against the Well-Architected Framework — before an official review workshop, before a funding round’s technical due diligence, or just as a standing health check. If you already run the AWS Well-Architected Tool with your account team, use this to gather the configuration evidence the questions ask for. If you’ve never done a review, start here to see where the obvious gaps are across all six pillars.

definition

What the Well-Architected Framework is (one paragraph)

The AWS Well-Architected Framework is AWS’s set of design principles and best practices for building on AWS, organised into six pillars: Security, Cost Optimization, Reliability, Performance Efficiency, Operational Excellence, and Sustainability. An official Well-Architected Framework Review (WAFR) is a question-driven workshop you run in the AWS Well-Architected Tool. CloudArq automates the evidence side of that: it inspects your live configuration and reports, pillar by pillar, where real resources diverge from the framework’s guidance.

the six pillars

What each pillar asks of your AWS account

A whole-framework review touches all six — not the security pillar alone. Here is the one-line goal of each, with the control areas CloudArq maps checks to detailed below.

SEC01

Security

Protect data, systems and identities across their lifecycle.

COST02

Cost Optimization

Run only what you need, at the right price, with no silent waste.

REL03

Reliability

Recover from failure and meet your availability commitments.

PERF04

Performance Efficiency

Use the most efficient compute and storage for the job.

OPS05

Operational Excellence

Run and evolve workloads through automation and observability.

SUS06

Sustainability

Minimise the footprint of the cloud you actually consume.

control areas · checks

Pillar by pillar, mapped to real checks

Each control area lists the scanner checks that evidence it. These are the real check IDs CloudArq runs — every finding carries remediation steps, and the whole audit is read-only.

Security (SEC)

Least privilege, encryption at rest and in transit, and a clean identity baseline.

3 control areas

SEC-1Securely operate your workload — checks for missing root MFA (no_mfa_root) and maps the IAM blast radius a compromised Bedrock agent could reach (agentic_blast_radius).
SEC-2Protect data in transit — flags CloudFront distributions serving plain HTTP (cloudfront_no_https) and S3 buckets that do not enforce TLS (s3_no_ssl_enforcement).
SEC-3Protect data at rest — finds unencrypted EBS volumes (unencrypted_ebs), MemoryDB without a customer-managed key (memory_no_cmk) and token vaults with no CMK (token_vault_no_cmk).

Cost Optimization (COST)

Right-sizing, the right pricing model, and eliminating idle spend — the deepest pillar here.

3 control areas

COST-1Right-size resources — checks for oversized EC2 instances on low CPU/mem (oversized_ec2) and RDS instances holding idle connections (rds_idle_connections).
COST-2Select the right pricing model — flags Bedrock provisioned-throughput billed hourly with no commitment (bedrock_provisioned_throughput_burn) and steady on-demand usage with no Savings Plan (no_savings_plan).
COST-3Eliminate waste — unused EC2 (unused_ec2), unattached EBS (unused_ebs) and idle RDS (idle_rds) are the visible tip; this control area alone spans around twenty distinct waste checks.

Reliability (REL)

Automatic recovery and tested backups — the difference between an incident and an outage.

2 control areas

REL-1Automatically recover from failure — checks for EC2 instances with no auto-recovery action (ec2_no_recovery) and single-AZ RDS with no standby (single_az_rds).
REL-2Back up and restore — finds RDS with automated backups disabled (no_backups_rds) and DynamoDB tables without point-in-time recovery (dynamodb_no_pitr).

Performance Efficiency (PERF)

Modern instance families and storage classes matched to how the workload actually behaves.

2 control areas

PERF-1Use efficient compute — checks for previous-generation EC2 families (ec2_previous_gen) and Lambda functions penalised by cold starts (lambda_cold_starts).
PERF-2Use efficient storage — flags legacy gp2 EBS volumes (ebs_gp2_volumes) and S3 buckets that would benefit from Intelligent-Tiering (s3_intelligent_tiering).

Operational Excellence (OPS)

Manage change as code and see what your systems are doing before customers do.

2 control areas

OPS-1Manage operations via automation — checks for CloudFormation stacks that have drifted from their template (cloudformation_drift) and instances not managed by SSM (ssm_not_managed).
OPS-2Monitor operations — finds resources with no CloudWatch alarm (no_alarm) and accounts with no billing alarm (no_billing_alarm).

Sustainability (SUS)

Kill zombie resources and maximise utilisation — the pillar that overlaps most with cost.

2 control areas

SUS-1Minimise waste — checks for zombie resources left running (zombie_resources) and unattached Elastic IPs (unattached_eip).
SUS-2Maximise utilisation — flags Graviton-eligible workloads still on x86 (graviton_eligible) and S3 that would tier more efficiently (s3_intelligent_tiering).

product · output

How CloudArq groups the findings by pillar

review-findings · framework · well-architectedillustrative example

Critical1High2Medium2

SEC-3

EBS volume not encrypted at rest

vol-0example · eu-north-1

fix →

SEC-2

CloudFront distribution serving HTTP

dist E1EXAMPLE

fix →

REL-2

RDS automated backups disabled

db-example-orders

fix →

COST-3

Unattached EBS volume still billing

vol-0example2 · eu-west-1

fix →

SUS-1

Zombie resources left running

multiple · eu-north-1

fix →

Each finding ships with a copy-paste CLI / Terraform remediation step. CloudArq is read-only and never auto-fixes.

scope · honesty

What this does — and does not do

CloudArq runs an automated review aligned to the six Well-Architected pillars: 105 distinct checks are mapped to pillar control areas, and each finding is grouped by pillar with an exact remediation step. It is read-only — a read-only IAM role with an ExternalId, AES-256-GCM at rest, EU-hosted in Helsinki — and it never stores your credentials, application data, database contents or S3 objects, and never auto-fixes.

It is not an official AWS Well-Architected Framework Review (WAFR), it confers no AWS badge, and a scanner shows posture — it does not certify or guarantee that your workload is Well-Architected. The framework’s question-based workshop covers design decisions and organisational context that live configuration cannot see; run that with your AWS account team and use this review to bring the evidence. CloudArq the business holds zero certifications of its own.

faq

Frequently asked

01Is this an official AWS Well-Architected Framework Review (WAFR)?: No. An official WAFR is a workshop you run in the AWS Well-Architected Tool with your account team or an APN partner, answering the framework’s questions across each pillar. CloudArq runs an automated, read-only review ALIGNED to the same six pillars: it inspects your live AWS configuration and metadata and reports where your resources drift from Well-Architected guidance. It is not a substitute for the AWS workshop and it confers no AWS badge — think of it as the evidence layer that makes the workshop faster.
02Which pillars does CloudArq actually cover?: All six: Security, Cost Optimization, Reliability, Performance Efficiency, Operational Excellence, and Sustainability. This is a whole-framework review, not a security-only scan. The checks below are grouped under real pillar control areas — SEC, COST, REL, PERF, OPS and SUS — so a finding always tells you which pillar it belongs to.
03Does CloudArq change my AWS to fix the findings?: No. CloudArq connects through a read-only IAM role with an ExternalId and reads configuration and metadata only — it never stores your credentials, application data, database contents, or S3 objects, and it never auto-fixes anything. Each finding ships with exact remediation steps (a CLI command or Terraform block) that you review and apply yourself. Detection plus the fix, never a hidden change to your account.
04How does CloudArq decide which checks map to which pillar?: Each scanner check is mapped to a Well-Architected pillar control area in a backend mapping table that is the single source of truth. The count on this page is the number of distinct checks that carry a Well-Architected mapping — it is pinned by a drift-guard test, so the figure can never silently disagree with the backend. Cost-optimization waste alone (COST-3) spans around twenty distinct checks, which is why Cost is one of the deeper pillars here.
05Which CloudArq tier includes the Well-Architected mapping?: The underlying resource checks run from the free Starter tier upward. The Well-Architected framework grouping is part of the Max tier’s full 8-framework set; the Pro tier maps four frameworks (CIS, SOC 2, ISO 27001, GDPR). Max also unlocks the AI Workload lens and AI-assisted remediation. See the pricing page for the exact tier breakdown.
06Does passing these checks make me “Well-Architected certified”?: There is no such thing as a Well-Architected certification, and CloudArq does not issue or imply one. A scanner shows posture against the framework’s guidance; it does not certify or guarantee an outcome. CloudArq the business holds zero certifications of its own. What you get is an honest, current map of where your account aligns with the six pillars and exactly what to change.

Run the review on your account

Connect a read-only role and CloudArq maps 105 checks to the Well-Architected pillars, groups the findings pillar by pillar, and hands you the exact fix for each. Want to go deeper on one pillar? The AWS cost optimization guide breaks down the Cost pillar’s waste checks, and the security overview covers the Security pillar in detail.

See the demo View pricing