Healthcare agentic platform — Amazon Bedrock AgentCore shared services and use-case onboarding

Well-Architected review Healthcare agentic platform — Amazon Bedrock AgentCore shared services and use-case onboarding · 2026-10-02 · mode full

Coverage audit

• AWS Well-Architected Framework — 6 pillars, 57 questions, 307 best practices, from the live documentation index, snapshot 2026-10-01 (0 days old).
• Generative AI Lens — 29 questions, 51 best practices, snapshot 2026-10-01.
• Assessed 307 framework BPs and 51 lens BPs: 14 + 12 with diagram evidence, 291 + 39 cannot be determined.
• Evidence sources: architecture diagram (services, boundaries, relationships); cost estimate from the AWS Price List.
• Corpus read from a committed snapshot of the live documentation index (not re-fetched during this review). Re-read it with `archify-aws wa corpus --refresh`. Statuses reflect what the diagram and spec show. Process, configuration and runtime evidence are not observable here, so those BPs are 'Cannot Determine' rather than guessed.

Executive summary

This Well-Architected Framework and Generative AI Lens review of Healthcare agentic platform — Amazon Bedrock AgentCore shared services and use-case onboarding (standard criticality) assessed the architecture diagram only. 14 of 307 framework best practices and 12 of 51 lens best practices have diagram evidence; the rest are Cannot Determine because process, configuration and runtime evidence is not in the diagram. It found 0 critical, 1 high, 0 medium and 0 low risk. Estimated run cost is $1,749/month (indicative).

14 of 307 framework best practices have diagram evidence (5%); among those, 12 implemented, 2 partial, 0 not implemented. Provisional: scores cover evidenced practices only.

Strengths. Edge protection present; Data stores are not placed in public subnets; Identity service shown; Observability shown; Managed / serverless services dominate; Guardrails shown; Model telemetry destination shown; Distributed tracing.

Architecture overview

The reviewed architecture is the Diagram tab (25 components, architecture diagram). Hover a finding to highlight the components involved.

Pillar scorecard

Generative AI Lens scorecard

Score = 1 + 4 × (implemented + ½ partial) ÷ evidenced BPs; shown only when ≥ 3 BPs are evidenced. It reflects evidenced practices, not the whole pillar.

Framework questions

Generative AI Lens questions

Framework best-practice ledger 307 best practices — nothing truncated

Generative AI Lens best-practice ledger 51 best practices — nothing truncated

Findings

High risk (1)

To confirm not drawn, so not counted as gaps

• No AWS KMS shown for data at rest SEC08-BP01 — Manage encryption keys in AWS KMS (customer managed keys where you need key policy, rotation or audit control) and enforce encryption at rest on every data store.
• No detection or audit services shown SEC04-BP01, SEC04-BP02 — Enable CloudTrail (organization trail), GuardDuty and Security Hub, and send logs and findings to a central, access-restricted account.
• No infrastructure-as-code or CI/CD shown OPS05-BP04, OPS05-BP10, REL08-BP05, SEC11-BP06 — Define infrastructure as code and deploy through a pipeline with small, reversible changes and automated rollback.
• No CDN / edge acceleration shown for end users PERF04-BP02, PERF04-BP06 — Serve content close to users with Amazon CloudFront or AWS Global Accelerator to reduce latency.
• No cost visibility shown COST01-BP03, COST01-BP06, COST03-BP05 — Set AWS Budgets with alert thresholds, enable Cost Anomaly Detection and cost allocation tags so spend maps to this workload.
• Single-Region model inference GENREL05-BP01 — Plan for throttling and quota limits (retries, queues, provisioned throughput) and consider cross-Region inference profiles or a fallback model.
• Model cost controls GENCOST01-BP01 — Select the smallest model that meets quality targets; use prompt caching and batch inference where possible; track cost per request.
• Agents and excessive agency GENSEC05-BP01 — Limit agent tool permissions (least privilege, deterministic policy at the tool boundary) and add human approval for high-impact actions.
• Model and hosting efficiency GENSUS03-BP01 — Prefer right-sized or distilled models and serverless inference; avoid always-on endpoints for spiky traffic.

Cross-pillar trade-offs

• Guardrails on model traffic Security ↔ Cost optimization ↔ Performance efficiency
  Guardrails cost $125.00/month (9% of AI spend) and add a synchronous screening step to each model call. Resolution: Apply the strictest policies where harm is highest (final responses, PII) and measure per-policy value before enabling every policy on every call.
• Continuous agent evaluation Operational excellence ↔ Cost optimization
  Evaluations cost $24.00/month at the assumed sampling volume. Resolution: Sample a fraction of production traffic and run the full golden set before each release.

Eisenhower prioritization

Prioritized remediation plan

Next steps

1. F-001 Model inference dominates cost — Right-size the model per task: evaluate a smaller model on your golden set, route easy checks to it, and use batch inference or prompt caching for repeated context. (ML platform team)
2. Re-run the review after changes, and when the architecture or documentation changes.

Impact × Likelihood matrix from the AWS Well-Architected review skill (Severe+High = Critical; Severe+Medium/Low or Moderate+High = High; Moderate+Medium/Low or Minor+High = Medium; otherwise Low).