Run an AWS data architecture review pass

At a glance

Learning objectives

• Map an AWS data platform into a single data flow before judging it
• Check IAM roles for least privilege
• Name the dominant cost drivers and single points of failure

What you need

• An architecture description or IaC
• Workload characteristics (volume, freshness, consumers)
• [object Object]

Steps

1. Map the described services to a data flow. (from agent-aws-architecture-reviewer )
2. Check IAM for least privilege. (from agent-aws-architecture-reviewer )
3. Estimate dominant cost drivers. (from agent-aws-architecture-reviewer )
4. Identify single points of failure. (from agent-aws-architecture-reviewer )
5. Collect the four outputs — architecture diagram (text), IAM findings, cost drivers, reliability risks. (from agent-aws-architecture-reviewer )
6. Hold the guardrails — the agent never creates resources and requires human approval for any IAM recommendation. (from agent-aws-architecture-reviewer )

Check yourself

• The review flags a Glue job running with an admin role and no bookmark, causing nightly full reprocessing — the agent's own worked example.
• Every IAM recommendation stops at human approval, and the agent created zero resources during the pass.

Worked example

mcpServers:
  aws-core:
    command: uvx
    args: [awslabs.core-mcp-server@latest]
    env:
      AWS_PROFILE: ${AWS_PROFILE}
      FASTMCP_LOG_LEVEL: ERROR

- Map the described services to a data flow.
- Check IAM for least privilege.
- Estimate dominant cost drivers.
- Identify single points of failure.

Outputs:
- Architecture diagram (text)
- IAM findings
- Cost drivers
- Reliability risks

Guardrails:
- Never creates resources
- Requires human approval for any IAM recommendation

Sourced from

• AWS Architecture Reviewer
• AWS MCP Servers (Labs)

Security scan

Last sweep 2026-10-24: 0 finding(s), 0 marked as examples.

Common gotchas

• The agent never creates resources — anything beyond findings needs a human.
• IAM recommendations always require human approval; never auto-apply them.
• Bind mcp-aws to a dedicated least-privilege AWS profile with short-lived SSO credentials — never attach an admin role.

Production considerations

• Score each pass against the 30-anti-pattern checklist so reviews are comparable over time.
• Keep the review read-only against the account; resource-creating tools require human confirmation.

Diagram

aws architecture review
   |
   |- map services --> one data flow
   |
   |- IAM --> least privilege --> human approval only
   |
   |- cost drivers --> dominant spend ranked
   |
   |- single points of failure --> reliability risks
   |
   --> findings: diagram + IAM + cost + reliability

Registry stats