This chapter covers the core features and capabilities of AWS Well-Architected Templates.
This product provides a comprehensive, deploy-ready infrastructure template set that embodies AWS Well-Architected best practices across every pillar. Instead of reading the 300+ page framework document and translating recommendations into IaC yourself, start with these battle-tested templates and customize them for your workload.
Each template is extensively commented with references to the specific Well-Architected pillar, design principle, and best practice it implements, so your team understands the *why* behind every resource.
| Template | Pillar(s) | Description |
|---|---|---|
cloudformation/vpc-network.yaml | Reliability, Security | Multi-AZ VPC with public/private/isolated subnets, NAT gateways, flow logs, and network ACLs |
cloudformation/security-baseline.yaml | Security | IAM roles, KMS keys, Config rules, GuardDuty, Security Hub, and CloudTrail configuration |
cloudformation/high-availability-app.yaml | Reliability, Performance | Auto Scaling group, ALB, health checks, cross-AZ deployment, and automated recovery |
cloudformation/cost-optimized-compute.yaml | Cost Optimization | Spot/On-Demand mixed fleet, Savings Plans tagging, auto-scaling schedules, and right-sizing alerts |
cloudformation/performance-monitoring.yaml | Performance Efficiency, Ops Excellence | CloudWatch dashboards, custom metrics, alarms, and X-Ray tracing configuration |
cloudformation/operational-excellence.yaml | Operational Excellence | SSM documents, automated patching, runbook automation, and change management |
| File | Description |
|---|---|
cdk/well_architected_app.py | CDK app entry point composing all stacks |
cdk/networking_stack.py | VPC, subnets, and connectivity as CDK constructs |
cdk/security_stack.py | Security baseline as reusable CDK constructs |
| Document | Description |
|---|---|
docs/architecture.md | Reference architecture diagram and component breakdown |
docs/deployment-guide.md | Step-by-step deployment instructions for each template |
docs/security-considerations.md | Security hardening guide and compliance mapping |
docs/cost-optimization-guide.md | Cost analysis, optimization strategies, and estimator usage |
docs/runbook.md | Operational runbook for day-2 operations |
| File | Description |
|---|---|
scripts/pillar_assessment.py | Interactive Well-Architected review checklist scorer |
scripts/cost_estimator.py | Estimate monthly costs for a deployment configuration |
examples/params-production.json | Production-grade parameter set |
examples/params-development.json | Cost-reduced development parameter set |
examples/params-staging.json | Staging environment parameter set |
npm install -g aws-cdk)Follow this guide to get AWS Well-Architected Templates up and running in your environment.
# 1. Deploy the VPC foundation first
aws cloudformation deploy \
--template-file cloudformation/vpc-network.yaml \
--stack-name well-arch-vpc \
--parameter-overrides file://examples/params-production.json \
--capabilities CAPABILITY_IAM
# 2. Deploy security baseline (references the VPC stack)
aws cloudformation deploy \
--template-file cloudformation/security-baseline.yaml \
--stack-name well-arch-security \
--parameter-overrides NetworkStackName=well-arch-vpc \
--capabilities CAPABILITY_NAMED_IAM
# 3. Deploy the application tier
aws cloudformation deploy \
--template-file cloudformation/high-availability-app.yaml \
--stack-name well-arch-app \
--parameter-overrides NetworkStackName=well-arch-vpc \
--capabilities CAPABILITY_IAMcd cdk/
python -m venv .venv && source .venv/bin/activate
pip install aws-cdk-lib constructs
cdk synth # Review the generated CloudFormation
cdk deploy --allpython scripts/pillar_assessment.py
# Interactive CLI walks you through each pillar's checklist
# Outputs a score and recommendations reportThe templates create a three-tier architecture within a Well-Architected VPC:
Internet
│
├── CloudFront (optional CDN)
│
├── ALB (public subnets, 2+ AZs)
│ │
│ ├── App Tier (private subnets, Auto Scaling)
│ │ │
│ │ └── RDS (isolated subnets, Multi-AZ)
│ │
│ └── NAT Gateway (outbound internet)
│
├── CloudWatch (monitoring + alarms)
├── CloudTrail (API audit logging)
├── GuardDuty (threat detection)
└── Security Hub (compliance dashboard)| Environment | Estimated Monthly Cost | Notes |
|---|---|---|
| Development | $80–150 | Single NAT, t3.small instances, no Multi-AZ RDS |
| Staging | $200–400 | Single NAT, t3.medium instances, Multi-AZ RDS |
| Production | $500–1,500+ | Dual NAT, mixed instance fleet, full monitoring |
Use scripts/cost_estimator.py to calculate costs for your specific configuration. Costs depend heavily on instance types, data transfer, and whether you use reserved capacity.
Get the full AWS Well-Architected Templates and unlock everything.
Get the complete guide with every chapter unlocked, including code samples, diagrams, and best practices.
Access all interactive tools with complete data, all workload profiles, and the full scenario library.
Downloadable source code, configuration files, and working examples from every chapter.
Free updates for life. Every new chapter, tool, and improvement included.