AWS Well-Architected security review: the free tool, and the gap after it
Sabri Eddir · Founder, Secure Layer · 7+ years at AWS Security · Last reviewed 13 July 2026
An AWS Well-Architected security review checks your architecture against AWS's own security best practices. AWS gives you a free tool for that review. It trusts whatever you type into it. Nothing checks your answer against what you actually built.
What AWS's free tool actually does
The security pillar is one of six pillars in the AWS Well-Architected Framework. It asks how you protect data, manage identity, detect problems, and secure your network. AWS publishes detailed guidance on the topic, including a dedicated Security Pillar page (docs.aws.amazon.com/wellarchitected/latest/security-pillar/welcome.html).
AWS also publishes a free tool for the review itself, inside the AWS Management Console. Sign in and describe your workload. Then answer each question yourself, one at a time. There is no charge beyond your normal AWS bill (aws.amazon.com/well-architected-tool/faqs/).
You answer each question yourself, and the tool records what you type. It does not independently verify your answer against your CloudFormation or your console settings. If you answer yes, my S3 buckets are encrypted, the tool records that answer and moves on. Nobody checks it against the bucket.
The gap the free tool leaves open
Answering the Well-Architected questionnaire well assumes you already know your own answers. Most engineers who own the AWS account do not know every property with certainty. There are hundreds of configuration choices across a real architecture. Nothing in AWS's free tool checks a claim against the template or the console for you.
Some teams close that gap by paying for a consulting engagement. A security firm walks the same questionnaire with you. It checks your answers against your actual setup. That work is real, and often good. It also costs real money and calendar time. The review is a snapshot from the day the consultant looked. It is not a check you can rerun after every change.
What Secure Layer checks that the free tool does not
Secure Layer checks your Well-Architected security answers against the architecture you actually built. Import your CloudFormation template, or draw the architecture on a canvas yourself. A guided questionnaire, organized along the Well-Architected pillars, asks the same kind of question AWS's own tool asks.
Your answers produce a maturity score. It is computed on the server, not estimated in your browser. It is versioned with your architecture. Every time you change the design, the score can change with it.
The real difference is what happens after you answer. Secure Layer checks your answer against the diagram itself. Say yes, my S3 bucket is encrypted, while the diagram shows a bucket with encryption switched off. The product flags that contradiction before a customer or an insurer finds it for you.
You are not filling out a form on faith. You are filling out a form that gets checked against what you actually built.
What gets checked automatically, and what doesn't
Three layers here, and each checks a different amount.
The property rules, the ones that run automatically on your CloudFormation, cover the security pillar: identity, network exposure, encryption, logging, and similar.
The contradiction check, the one that flags an answer that doesn't match your diagram, runs on the security and reliability pillars today. Claim something in either one while the diagram disagrees, and you will see it.
Cost optimization, performance efficiency, operational excellence, and sustainability use the same guided questionnaire and roll into the same maturity score. Nothing checks those answers against your diagram yet, the same as AWS's own tool.
Questions about the Well-Architected security review
- Which Well-Architected pillars does Secure Layer score?
- All six get a maturity score from the questionnaire. Two of them, security and reliability, also get an automatic check against your diagram. The other four use the same questions AWS's own tool asks, without that extra check yet.
- Is Secure Layer the same as AWS's Well-Architected Tool?
- No. AWS's tool is free and lives in the console. It reads only what you type into it. Secure Layer imports your CloudFormation template, or your drawn architecture. It checks your answers against it. AWS's tool trusts your answer. Secure Layer verifies it.
- Does Secure Layer replace a paid Well-Architected consulting review?
- Not entirely. It checks a lot of the same ground a consultant checks by hand. It tests whether your answers hold up against your actual architecture. It does not replace a conversation about your specific business risk. It also does not produce a signed report some due-diligence processes still require.
- Does Secure Layer need access to my AWS account?
- No. Secure Layer never holds your AWS credentials. Only the template reaches us. Import a CloudFormation template, or draw the architecture yourself. There is no IAM role to create, and no live connection to your account.
- What if I don't have a CloudFormation template yet?
- Draw the architecture on the canvas instead. You get the same rule checks and the same questionnaire either way. It does not matter whether you imported a template or built the diagram by hand.