Access and entitlements Quotas and limits Unsupported resource types

AWS Well-Architected Agent Quotas and limits

Access and entitlements

AWS WA Agent access and entitlements depend on your AWS Support plan tier.

Support tier entitlements
Support tier	Access	Max profiles	Max applications per profile
Developer	No	—	—
Business	No	—	—
Business+	Yes	2	7
Enterprise On-Ramp	Yes	10	30
Enterprise Support	Yes	10	30
Unified Operations	Yes	10	30

Quotas and limits

Resource	Default limit	Notes
Accounts per profile	100	Maximum AWS accounts that a single profile can analyze.
Goals per profile	10	Maximum active business goals per profile.
Profile hosting Regions	3	Profiles can be hosted in US East (N. Virginia), US East (Ohio), or US West (Oregon).
Scannable Regions	All commercial	AWS WA Agent can scan resources in any commercial AWS Region, regardless of where the profile is hosted.
Recommendations per generation run	30	Maximum recommendations produced per scheduled or manual generation run. There is no limit on total stored recommendations. Future runs can add new recommendations.
Architecture reviews per day	5	Maximum architecture review generations per day, per profile. Reviews can be run consecutively without cooldown while quota remains.
Scheduled recommendation generation cooldown	24 hours	Minimum time between scheduled recommendation generation runs for the same profile.
Maximum .zip file upload size	25 MB	Maximum compressed size of an uploaded .zip file for architecture reviews.
Maximum Amazon S3 folder size	100 MB	Maximum total size of an Amazon S3 folder referenced for architecture reviews.
Maximum individual file size (Amazon S3 folder)	1 MB	Maximum size of each individual file in an Amazon S3 folder referenced for architecture reviews.

Unsupported resource types

AWS WA Agent does not analyze the CloudFormation resource types in the following table. If your application uses these resource types, AWS WA Agent does not retrieve their configuration data and does not include them in resource-level recommendations.

For more information about specifying the services and resource types your application uses, see Updating application context.

Resource types not supported by AWS WA Agent
Service	Unsupported resource types
`AWS::ACMPCA`	`AWS::ACMPCA::Certificate` `AWS::ACMPCA::CertificateAuthorityActivation` `AWS::ACMPCA::Permission`
`AWS::AmplifyUIBuilder`	`AWS::AmplifyUIBuilder::Component` `AWS::AmplifyUIBuilder::Form` `AWS::AmplifyUIBuilder::Theme`
`AWS::ApiGateway`	`AWS::ApiGateway::Account` `AWS::ApiGateway::Method`
`AWS::ApiGatewayV2`	`AWS::ApiGatewayV2::IntegrationResponse` `AWS::ApiGatewayV2::RouteResponse`
`AWS::AppConfig`	`AWS::AppConfig::Deployment` `AWS::AppConfig::HostedConfigurationVersion`
`AWS::ApplicationAutoScaling`	`AWS::ApplicationAutoScaling::ScalableTarget` `AWS::ApplicationAutoScaling::ScalingPolicy`
`AWS::AppStream`	`AWS::AppStream::AppBlock` `AWS::AppStream::Application` `AWS::AppStream::ApplicationEntitlementAssociation` `AWS::AppStream::ApplicationFleetAssociation` `AWS::AppStream::Entitlement`
`AWS::AppSync`	`AWS::AppSync::DomainNameApiAssociation`
`AWS::AppTest`	`AWS::AppTest::TestCase`
`AWS::AuditManager`	`AWS::AuditManager::Assessment`
`AWS::Bedrock`	`AWS::Bedrock::GuardrailVersion`
`AWS::BillingConductor`	`AWS::BillingConductor::BillingGroup` `AWS::BillingConductor::CustomLineItem` `AWS::BillingConductor::PricingPlan` `AWS::BillingConductor::PricingRule`
`AWS::Cassandra`	`AWS::Cassandra::Keyspace` `AWS::Cassandra::Type`
`AWS::CE`	`AWS::CE::AnomalyMonitor` `AWS::CE::AnomalySubscription`
`AWS::CertificateManager`	`AWS::CertificateManager::Account`
`AWS::CloudFormation`	`AWS::CloudFormation::ModuleVersion` `AWS::CloudFormation::Publisher` `AWS::CloudFormation::ResourceDefaultVersion` `AWS::CloudFormation::ResourceVersion`
`AWS::CloudFront`	`AWS::CloudFront::MonitoringSubscription`
`AWS::CloudTrail`	`AWS::CloudTrail::ResourcePolicy`
`AWS::Cognito`	`AWS::Cognito::LogDeliveryConfiguration` `AWS::Cognito::ManagedLoginBranding` `AWS::Cognito::UserPoolDomain` `AWS::Cognito::UserPoolRiskConfigurationAttachment` `AWS::Cognito::UserPoolUICustomizationAttachment` `AWS::Cognito::UserPoolUserToGroupAttachment`
`AWS::Config`	`AWS::Config::OrganizationConformancePack`
`AWS::Connect`	`AWS::Connect::ContactFlowVersion` `AWS::Connect::DataTableAttribute` `AWS::Connect::DataTableRecord` `AWS::Connect::InstanceStorageConfig` `AWS::Connect::UserHierarchyStructure` `AWS::Connect::ViewVersion`
`AWS::ControlTower`	`AWS::ControlTower::EnabledBaseline` `AWS::ControlTower::EnabledControl`
`AWS::DataZone`	`AWS::DataZone::DataSource` `AWS::DataZone::DomainUnit` `AWS::DataZone::Environment` `AWS::DataZone::EnvironmentActions` `AWS::DataZone::FormType` `AWS::DataZone::Owner` `AWS::DataZone::PolicyGrant` `AWS::DataZone::ProjectMembership` `AWS::DataZone::ProjectProfile`
`AWS::Deadline`	`AWS::Deadline::QueueEnvironment`
`AWS::Detective`	`AWS::Detective::OrganizationAdmin`
`AWS::DeviceFarm`	`AWS::DeviceFarm::DevicePool` `AWS::DeviceFarm::InstanceProfile` `AWS::DeviceFarm::NetworkProfile` `AWS::DeviceFarm::Project` `AWS::DeviceFarm::TestGridProject` `AWS::DeviceFarm::VPCEConfiguration`
`AWS::EC2`	`AWS::EC2::EnclaveCertificateIamRoleAssociation` `AWS::EC2::GatewayRouteTableAssociation` `AWS::EC2::VPCBlockPublicAccessOptions`
`AWS::ECS`	`AWS::ECS::ExpressGatewayService` `AWS::ECS::PrimaryTaskSet` `AWS::ECS::TaskSet`
`AWS::ElasticLoadBalancingV2`	`AWS::ElasticLoadBalancingV2::ListenerRule`
`AWS::EMR`	`AWS::EMR::Step`
`AWS::EventSchemas`	`AWS::EventSchemas::RegistryPolicy`
`AWS::Evidently`	`AWS::Evidently::Experiment` `AWS::Evidently::Feature` `AWS::Evidently::Launch` `AWS::Evidently::Project` `AWS::Evidently::Segment`
`AWS::FMS`	`AWS::FMS::NotificationChannel` `AWS::FMS::Policy` `AWS::FMS::ResourceSet`
`AWS::GlobalAccelerator`	`AWS::GlobalAccelerator::EndpointGroup`
`AWS::Glue`	`AWS::Glue::IdentityCenterConfiguration` `AWS::Glue::SchemaVersionMetadata`
`AWS::IAM`	`AWS::IAM::GroupPolicy` `AWS::IAM::RolePolicy` `AWS::IAM::ServiceLinkedRole` `AWS::IAM::UserPolicy`
`AWS::IdentityStore`	`AWS::IdentityStore::GroupMembership`
`AWS::Inspector`	`AWS::Inspector::AssessmentTarget` `AWS::Inspector::AssessmentTemplate` `AWS::Inspector::ResourceGroup`
`AWS::InspectorV2`	`AWS::InspectorV2::CisScanConfiguration`
`AWS::IoT`	`AWS::IoT::ThingType`
`AWS::IoTAnalytics`	`AWS::IoTAnalytics::Channel` `AWS::IoTAnalytics::Dataset` `AWS::IoTAnalytics::Datastore` `AWS::IoTAnalytics::Pipeline`
`AWS::IoTEvents`	`AWS::IoTEvents::AlarmModel` `AWS::IoTEvents::DetectorModel` `AWS::IoTEvents::Input`
`AWS::IoTFleetWise`	`AWS::IoTFleetWise::Campaign` `AWS::IoTFleetWise::DecoderManifest` `AWS::IoTFleetWise::Fleet` `AWS::IoTFleetWise::ModelManifest` `AWS::IoTFleetWise::SignalCatalog` `AWS::IoTFleetWise::StateTemplate` `AWS::IoTFleetWise::Vehicle`
`AWS::IoTSiteWise`	`AWS::IoTSiteWise::Dashboard`
`AWS::Kinesis`	`AWS::Kinesis::ResourcePolicy`
`AWS::LakeFormation`	`AWS::LakeFormation::PrincipalPermissions` `AWS::LakeFormation::TagAssociation`
`AWS::Lambda`	`AWS::Lambda::LayerVersion` `AWS::Lambda::LayerVersionPermission`
`AWS::LicenseManager`	`AWS::LicenseManager::Grant` `AWS::LicenseManager::License`
`AWS::Logs`	`AWS::Logs::AccountPolicy`
`AWS::LookoutVision`	`AWS::LookoutVision::Project`
`AWS::Macie`	`AWS::Macie::AllowList` `AWS::Macie::CustomDataIdentifier` `AWS::Macie::FindingsFilter`
`AWS::MediaConnect`	`AWS::MediaConnect::BridgeOutput` `AWS::MediaConnect::BridgeSource`
`AWS::MediaLive`	`AWS::MediaLive::ChannelPlacementGroup` `AWS::MediaLive::Cluster` `AWS::MediaLive::Network` `AWS::MediaLive::SdiSource`
`AWS::MediaPackageV2`	`AWS::MediaPackageV2::ChannelPolicy` `AWS::MediaPackageV2::OriginEndpoint` `AWS::MediaPackageV2::OriginEndpointPolicy`
`AWS::MediaTailor`	`AWS::MediaTailor::ChannelPolicy`
`AWS::NetworkFirewall`	`AWS::NetworkFirewall::LoggingConfiguration`
`AWS::Notifications`	`AWS::Notifications::ManagedNotificationAccountContactAssociation` `AWS::Notifications::ManagedNotificationAdditionalChannelAssociation`
`AWS::ObservabilityAdmin`	`AWS::ObservabilityAdmin::OrganizationCentralizationRule` `AWS::ObservabilityAdmin::OrganizationTelemetryRule` `AWS::ObservabilityAdmin::TelemetryRule`
`AWS::ODB`	`AWS::ODB::CloudAutonomousVmCluster` `AWS::ODB::CloudExadataInfrastructure` `AWS::ODB::CloudVmCluster` `AWS::ODB::OdbNetwork` `AWS::ODB::OdbPeeringConnection`
`AWS::OpenSearchServerless`	`AWS::OpenSearchServerless::AccessPolicy` `AWS::OpenSearchServerless::LifecyclePolicy` `AWS::OpenSearchServerless::SecurityConfig` `AWS::OpenSearchServerless::SecurityPolicy`
`AWS::OpenSearchService`	`AWS::OpenSearchService::Domain`
`AWS::Organizations`	`AWS::Organizations::Account` `AWS::Organizations::OrganizationalUnit` `AWS::Organizations::Policy` `AWS::Organizations::ResourcePolicy`
`AWS::Panorama`	`AWS::Panorama::PackageVersion`
`AWS::PCAConnectorAD`	`AWS::PCAConnectorAD::TemplateGroupAccessControlEntry`
`AWS::QLDB`	`AWS::QLDB::Stream`
`AWS::QuickSight`	`AWS::QuickSight::Analysis` `AWS::QuickSight::Dashboard` `AWS::QuickSight::DataSet` `AWS::QuickSight::DataSource` `AWS::QuickSight::RefreshSchedule` `AWS::QuickSight::Template` `AWS::QuickSight::Theme` `AWS::QuickSight::Topic` `AWS::QuickSight::VPCConnection`
`AWS::Rbin`	`AWS::Rbin::Rule`
`AWS::RefactorSpaces`	`AWS::RefactorSpaces::Application` `AWS::RefactorSpaces::Route` `AWS::RefactorSpaces::Service`
`AWS::ResourceExplorer2`	`AWS::ResourceExplorer2::DefaultViewAssociation`
`AWS::RTBFabric`	`AWS::RTBFabric::InboundExternalLink` `AWS::RTBFabric::Link` `AWS::RTBFabric::OutboundExternalLink`
`AWS::S3`	`AWS::S3::AccessGrant` `AWS::S3::AccessGrantsLocation` `AWS::S3::MultiRegionAccessPointPolicy`
`AWS::S3ObjectLambda`	`AWS::S3ObjectLambda::AccessPointPolicy`
`AWS::S3Outposts`	`AWS::S3Outposts::AccessPoint` `AWS::S3Outposts::Bucket` `AWS::S3Outposts::BucketPolicy`
`AWS::S3Tables`	`AWS::S3Tables::Table` `AWS::S3Tables::TablePolicy`
`AWS::SageMaker`	`AWS::SageMaker::Device` `AWS::SageMaker::DeviceFleet`
`AWS::SecurityHub`	`AWS::SecurityHub::AggregatorV2` `AWS::SecurityHub::AutomationRule` `AWS::SecurityHub::AutomationRuleV2` `AWS::SecurityHub::ConfigurationPolicy` `AWS::SecurityHub::ConnectorV2` `AWS::SecurityHub::DelegatedAdmin` `AWS::SecurityHub::FindingAggregator` `AWS::SecurityHub::Insight` `AWS::SecurityHub::OrganizationConfiguration` `AWS::SecurityHub::PolicyAssociation` `AWS::SecurityHub::ProductSubscription` `AWS::SecurityHub::SecurityControl` `AWS::SecurityHub::Standard`
`AWS::SecurityLake`	`AWS::SecurityLake::AWSLogSource` `AWS::SecurityLake::Subscriber` `AWS::SecurityLake::SubscriberNotification`
`AWS::ServiceCatalog`	`AWS::ServiceCatalog::CloudFormationProvisionedProduct` `AWS::ServiceCatalog::PortfolioProductAssociation` `AWS::ServiceCatalog::ServiceActionAssociation` `AWS::ServiceCatalog::TagOption` `AWS::ServiceCatalog::TagOptionAssociation`
`AWS::SES`	`AWS::SES::VdmAttributes`
`AWS::Shield`	`AWS::Shield::DRTAccess` `AWS::Shield::ProactiveEngagement` `AWS::Shield::Protection` `AWS::Shield::ProtectionGroup`
`AWS::SimSpaceWeaver`	`AWS::SimSpaceWeaver::Simulation`
`AWS::SNS`	`AWS::SNS::TopicInlinePolicy`
`AWS::SQS`	`AWS::SQS::QueueInlinePolicy`
`AWS::SSMContacts`	`AWS::SSMContacts::Rotation`
`AWS::SSO`	`AWS::SSO::Application` `AWS::SSO::ApplicationAssignment` `AWS::SSO::Assignment` `AWS::SSO::InstanceAccessControlAttributeConfiguration` `AWS::SSO::PermissionSet`
`AWS::Timestream`	`AWS::Timestream::Database` `AWS::Timestream::ScheduledQuery` `AWS::Timestream::Table`
`AWS::VoiceID`	`AWS::VoiceID::Domain`
`AWS::VpcLattice`	`AWS::VpcLattice::AuthPolicy` `AWS::VpcLattice::ResourcePolicy` `AWS::VpcLattice::Rule`
`AWS::WAFv2`	`AWS::WAFv2::IPSet` `AWS::WAFv2::RegexPatternSet` `AWS::WAFv2::RuleGroup` `AWS::WAFv2::WebACL` `AWS::WAFv2::WebACLAssociation`
`AWS::Wisdom`	`AWS::Wisdom::AIAgentVersion` `AWS::Wisdom::AIGuardrailVersion` `AWS::Wisdom::AIPromptVersion`

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Goals and personalization

Related services