Compliance review assistant on Amazon Bedrock AgentCore

Well-Architected review Compliance review assistant on Amazon Bedrock AgentCore · 2026-10-02 · mode full

Coverage audit

• AWS Well-Architected Framework — 6 pillars, 57 questions, 307 best practices, from the live documentation index, snapshot 2026-10-01 (0 days old).
• Generative AI Lens — 29 questions, 51 best practices, snapshot 2026-10-01.
• Assessed 307 framework BPs and 51 lens BPs: 17 + 13 with diagram evidence, 288 + 38 cannot be determined.
• Evidence sources: architecture diagram (services, boundaries, relationships); cost estimate from the AWS Price List.
• Corpus read from a committed snapshot of the live documentation index (not re-fetched during this review). Re-read it with `archify-aws wa corpus --refresh`. Statuses reflect what the diagram and spec show. Process, configuration and runtime evidence are not observable here, so those BPs are 'Cannot Determine' rather than guessed.

Executive summary

This Well-Architected Framework and Generative AI Lens review of Compliance review assistant on Amazon Bedrock AgentCore (standard criticality) assessed the architecture diagram only. 17 of 307 framework best practices and 13 of 51 lens best practices have diagram evidence; the rest are Cannot Determine because process, configuration and runtime evidence is not in the diagram. It found 0 critical, 1 high, 0 medium and 0 low risk. Estimated run cost is $5,973/month (indicative).

17 of 307 framework best practices have diagram evidence (6%); among those, 15 implemented, 2 partial, 0 not implemented. Provisional: scores cover evidenced practices only.

Strengths. Edge protection present; Data stores are not placed in public subnets; Key management shown; Identity service shown; Detection / audit services shown; Observability shown; Managed / serverless services dominate; Guardrails shown.

Architecture overview

The reviewed architecture is the Diagram tab (28 components, architecture diagram). Hover a finding to highlight the components involved.

Pillar scorecard

Generative AI Lens scorecard

Score = 1 + 4 × (implemented + ½ partial) ÷ evidenced BPs; shown only when ≥ 3 BPs are evidenced. It reflects evidenced practices, not the whole pillar.

Framework questions

Generative AI Lens questions

Framework best-practice ledger 307 best practices — nothing truncated

Generative AI Lens best-practice ledger 51 best practices — nothing truncated

Findings

High risk (1)

To confirm not drawn, so not counted as gaps

• No backup or recovery capability shown REL09-BP01, REL09-BP03 — Back up data automatically with AWS Backup (cross-account/cross-Region vault where required) and test restores against your RPO/RTO.
• No infrastructure-as-code or CI/CD shown OPS05-BP04, OPS05-BP10, REL08-BP05, SEC11-BP06 — Define infrastructure as code and deploy through a pipeline with small, reversible changes and automated rollback.
• No CDN / edge acceleration shown for end users PERF04-BP02, PERF04-BP06 — Serve content close to users with Amazon CloudFront or AWS Global Accelerator to reduce latency.
• No cost visibility shown COST01-BP03, COST01-BP06, COST03-BP05 — Set AWS Budgets with alert thresholds, enable Cost Anomaly Detection and cost allocation tags so spend maps to this workload.
• Single-Region model inference GENREL05-BP01 — Plan for throttling and quota limits (retries, queues, provisioned throughput) and consider cross-Region inference profiles or a fallback model.
• Model cost controls GENCOST01-BP01 — Select the smallest model that meets quality targets; use prompt caching and batch inference where possible; track cost per request.
• Agents and excessive agency GENSEC05-BP01 — Limit agent tool permissions (least privilege, deterministic policy at the tool boundary) and add human approval for high-impact actions.
• Model and hosting efficiency GENSUS03-BP01 — Prefer right-sized or distilled models and serverless inference; avoid always-on endpoints for spiky traffic.

Cross-pillar trade-offs

• Guardrails on model traffic Security ↔ Cost optimization ↔ Performance efficiency
  Guardrails cost $525.00/month (10% of AI spend) and add a synchronous screening step to each model call. Resolution: Apply the strictest policies where harm is highest (final responses, PII) and measure per-policy value before enabling every policy on every call.
• Observability volume Operational excellence ↔ Cost optimization
  CloudWatch is $65.30/month in this estimate, mostly log ingestion; richer telemetry improves detection but ingestion is billed per GB. Resolution: Sample verbose traces, set retention per log group, and keep full-fidelity logs for security and audit sources only.
• Continuous agent evaluation Operational excellence ↔ Cost optimization
  Evaluations cost $9.60/month at the assumed sampling volume. Resolution: Sample a fraction of production traffic and run the full golden set before each release.

Eisenhower prioritization

Prioritized remediation plan

Next steps

1. F-001 Model inference dominates cost — Right-size the model per task: evaluate a smaller model on your golden set, route easy checks to it, and use batch inference or prompt caching for repeated context. (ML platform team)
2. Re-run the review after changes, and when the architecture or documentation changes.

Impact × Likelihood matrix from the AWS Well-Architected review skill (Severe+High = Critical; Severe+Medium/Low or Moderate+High = High; Moderate+Medium/Low or Minor+High = Medium; otherwise Low).