Free tools Windows power users keep installed
One-click scans. No signup required.
AWS Well-Architected Agent (WA Agent) uses customer-managed IAM roles and a two-hop cross-account role chain. An administrator creates an agent profile, gives the service an execution role in the profile account, and lets that role assume a narrowly trusted access role in each workload account. The profile creator needs IAM permissions to create and attach roles, pass the execution role, and call wellarchitected:CreateAgentProfile. Each workload account normally uses the AWS-managed WellArchitectedAgentResourceScanning policy, although a carefully maintained customer-managed policy can replace it.
The important boundary is that WA Agent does not use a service-linked role. Least privilege therefore depends on three separate controls: the profile creator’s setup permissions, the execution role’s limited ability to call sts:AssumeRole, and each workload account’s trust policy and read-only scanning permissions. Service control policies (SCPs) must permit both the Well-Architected API namespace and the resource-scanning actions, or the setup can appear successful while discovery returns no resources.
As an Amazon Associate I earn from qualifying purchases.
What IAM permissions does Well-Architected Agent require?
WA Agent has different permission requirements for the people who configure it and the people who consume its recommendations. Treat those as separate personas rather than assigning one broad administrator policy to everyone.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Actor | Typical responsibilities | Representative permissions |
|---|---|---|
| Profile administrator or creator | Create and delete profiles, define scope and goals, configure monitored accounts, establish the role chain, and provide application context. | iam:CreateRole, iam:AttachRolePolicy, iam:PassRole, and wellarchitected:CreateAgentProfile during onboarding; profile-management permissions such as wellarchitected:DeleteAgentProfile when retiring a profile. |
| Regular user | Read generated advice, update recommendation lifecycle state, and submit feedback without changing the underlying cross-account access design. | Examples include wellarchitected:ListAgentRecommendations and wellarchitected:GetAgentRecommendation, plus the specific update or feedback actions your workflow requires. |
The onboarding permissions are not the permissions WA Agent uses to inspect your infrastructure. The service reaches infrastructure through the execution role and its pass-role and assume-role path. A team can delegate profile creation to a small platform group, then give application teams only recommendation and feedback permissions.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
How the two-hop role chain works
The chain separates the account that owns the profile from the accounts that contain workloads:
- Profile account: An execution IAM role is created in the account that owns the WA Agent profile.
- Service assumption: The
wellarchitected.amazonaws.comservice principal is allowed to assume that execution role. - Target selection: The execution role’s permissions policy grants
sts:AssumeRoleonly on the access-role ARNs selected for analysis. - Workload account: In each monitored account, an access role trusts the exact execution-role ARN and grants read-only resource metadata and configuration access.
- Inspection: WA Agent uses the execution role, then the appropriate access role, to inspect the selected account and produce recommendations.
This design means the execution role is not itself a read-only inventory role. It is a broker that can assume specific target roles. Conversely, a workload access role should not trust the whole profile account or an account root principal; it should trust only the one execution role that was configured for the profile.
External-ID protection
AWS uses the profile ARN as an external ID in the assumption chain. This binds the role use to the configured profile and helps prevent a confused-deputy scenario in which the execution role is used outside that profile. Preserve the external-ID condition supplied by the WA Agent setup flow and do not replace it with a looser trust statement.
Why the exact execution-role ARN matters
Console-created execution roles commonly have the service-role/ path. A manually created role may not. The ARN is therefore not safely predictable from the role name alone. Copy the exact ARN from the profile details page when writing every workload account’s trust policy. A path mismatch produces an access-denied result even when the visible role name looks correct.
Prerequisites, account limits, and timing
- Support plan: The profile-owning account and every monitored account need Business+ or higher support: Business+, Enterprise On-Ramp, Enterprise Support, or Unified Operations. Developer and standard Business support tiers do not provide WA Agent access.
- Monitored-account limit: AWS documents a maximum of 100 monitored accounts for a profile.
- Application context: At least one application context must be associated with the profile for scheduled recommendations to run.
- Initial wait: After setup is complete, scheduled recommendations typically become available within 48 hours. This is an expected service schedule, not an IAM propagation guarantee.
- Operational separation: AWS recommends a dedicated account without production workloads for the profile and execution-role administration.
Check support eligibility and organization controls before creating roles. Otherwise, an administrator can spend time debugging IAM when the account is simply outside the supported tier or an organization guardrail is denying the service.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Step-by-step setup for least privilege
1. Select the profile account and workload scope
Choose one account to own the profile and execution role. List the workload accounts that genuinely need analysis, keeping the initial scope small enough to validate. Record the exact account IDs and the common access-role name you intend to use. The console onboarding flow expects the same access-role name in every selected account; AWS’s suggested name is AccessRoleForWellArchitectedAgent.
2. Delegate profile creation narrowly
The administrator or delegated onboarding identity needs the documented setup permissions: iam:CreateRole, iam:AttachRolePolicy, iam:PassRole, and wellarchitected:CreateAgentProfile. Add only the profile-management and role-management actions required by your chosen workflow. If roles are created in a separate infrastructure pipeline, the person who creates the profile may not need unrestricted role creation, but must still be able to pass the exact execution role to the service.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsConstrain role operations by resource, naming convention, or IAM conditions where your deployment process supports them. Do not give every Well-Architected user iam:PassRole; that permission can allow a user to make a service act with another role’s authority.
3. Create the execution role in the profile account
Use the WA Agent console flow when possible so the service principal, external-ID behavior, and profile association are represented correctly. The role’s trust policy must allow wellarchitected.amazonaws.com. Its permissions policy should grant sts:AssumeRole only for the access-role ARNs in the approved workload list.
Do not use a wildcard resource for sts:AssumeRole when the account set is known. Every time an account is added, add that account’s access-role ARN deliberately; when an account is removed, remove its ARN from the execution-role policy as part of the same change.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
4. Create an access role in every workload account
In each selected workload account, create the same common role name used by the onboarding flow. Its trust policy must name the exact execution-role ARN from the profile details page, not the profile account root, an organization principal, or a broad role pattern.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Attach WellArchitectedAgentResourceScanning as the starting permissions policy. AWS describes this policy as read-only access to resource metadata and configuration needed for analysis. If your security program requires a customer-managed policy, replace it with an explicit allow-list containing only the scanning actions your organization has approved. Test that replacement against the workloads and services you expect WA Agent to inspect.
5. Add the accounts and context to the profile
In the profile configuration, define the intended goals and scope, select the workload accounts, and supply at least one application context. Use the exact common access-role name. If the console requests the execution role, paste the ARN shown in profile details rather than reconstructing it from the role name.
6. Validate generation and record the result
After saving the profile, check the generation record and account status. A successful profile creation proves that the Well-Architected API call and basic role association worked; it does not prove that every scanning action is allowed. Review generation errors, then inspect CloudTrail events for denied AssumeRole, Well-Architected, or scanning-policy API calls.
Managed scanning policy or custom policy?
WellArchitectedAgentResourceScanning is the AWS-recommended starting point because AWS maintains its action set as WA Agent capabilities evolve. A custom policy can provide tighter control, but your organization becomes responsible for discovering new required actions, testing them, and updating SCPs and role policies together.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
| Decision factor | AWS-managed scanning policy | Customer-managed custom policy |
|---|---|---|
| Action breadth | Uses the action set AWS publishes for resource scanning; exact breadth can change as capabilities are added. | Only the actions you explicitly allow are available, so unsupported services may produce incomplete findings. |
| Read-only scope | Designed for read-only metadata and configuration discovery. | You must preserve read-only behavior and verify every action in review. |
| Account and resource scope | Account selection is controlled by the role chain and profile scope. | You can narrow resources or conditions further where the APIs support resource-level controls. |
| Maintenance | Lower maintenance; AWS updates the managed policy. | Higher maintenance; monitor service changes and revise the allow-list. |
| SCP compatibility | Organization guardrails must allow the policy’s current actions. | You must allow the smaller custom action set, while also updating it whenever the policy changes. |
| Auditability | Simple to deploy and compare with AWS documentation. | Easier to prove a narrowly bounded allow-list, provided it is tested and documented. |
Choose the managed policy when reliable coverage and low maintenance are more important than an individually curated action list. Choose a custom policy only when you can maintain a tested list, accept that coverage may be narrower, and have a process for reviewing CloudTrail denials after AWS adds capabilities.
SCP requirements and common failure patterns
SCPs apply at every organization level between the monitored account and the organization root. An allow statement at the account level cannot override an explicit deny or a missing permission imposed by a parent policy. For WA Agent, the effective organization policy must permit both the wellarchitected:* namespace actions needed by the profile and the actions represented by WellArchitectedAgentResourceScanning (or your approved custom scanning policy).
| Observed symptom | Likely organization-control cause | What to check |
|---|---|---|
| Profile creation or profile use is denied | An SCP blocks a required Well-Architected API action. | Trace the request through each parent SCP and permit the required wellarchitected actions for the profile account and authorized principals. |
| Profile exists but discovery is empty | An SCP blocks one or more read-only scanning actions. | Compare CloudTrail denials with the actions in the managed or custom scanning policy, then update the relevant organization-level policy. |
| Only some services appear | The custom policy or an SCP allows only part of the scanning action set. | Identify denied service APIs and decide whether to add them or document the intentional coverage boundary. |
| One account fails while others work | The account has a different SCP path, support tier, role trust policy, or policy attachment. | Compare effective policies and trust relationships account by account; do not broaden every account to fix one outlier. |
Use CloudTrail to distinguish an SCP denial from a role-trust error. An SCP problem usually appears as an explicit organization-policy denial for an otherwise valid API request; a trust or ARN problem appears when the service cannot assume the target role.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Least-privilege hardening checklist
- Start from the documented baseline. Deploy the required onboarding permissions, execution-role trust, target-role trust, and scanning policy before narrowing anything. This gives you a known-good reference.
- Inspect actual API activity. Use CloudTrail to see which Well-Architected, STS, and scanning calls occur during profile creation and recommendation generation.
- Replace broad grants where practical. Convert broad customer-managed permissions into action and resource scopes that match the profile account and selected workload accounts.
- Constrain role assumption. Restrict the execution role’s
sts:AssumeRoleresources to the intended access-role ARNs. Avoid account-wide or organization-wide wildcards. - Lock each target trust policy. Trust only the exact execution-role ARN and retain the external-ID protection used by the profile chain.
- Keep scanning read-only. A custom policy should not include write, delete, or administrative actions merely because a service API exposes them.
- Apply conditions where supported. Use account, resource, source, or external-ID conditions when the relevant IAM action supports them and they do not break the documented role chain.
- Use SCPs as guardrails. Permit the required namespaces while continuing to deny unrelated administrative APIs at the organization level.
- Validate with IAM Access Analyzer. Use policy validation and access-activity findings to identify unused grants and refine the customer-managed policies.
- Review last-accessed data. Remove permissions that remain unused after a representative generation cycle, while accounting for the service’s scheduled and newly introduced capabilities.
- Monitor continuously. Alert on unexpected role assumptions, changes to trust policies, new monitored accounts, and policy edits in CloudTrail.
- Remove stale scope. Delete access-role trust and permissions for accounts that no longer require analysis, and remove their ARNs from the execution role.
How to revoke access safely
To stop analysis in one workload account, remove the execution role from that account’s access-role trust policy or delete the access role after confirming that no other approved process uses it. To disable the profile’s ability to reach an account while retaining the role for a controlled transition, remove that account’s ARN from the execution role’s sts:AssumeRole resources and remove the account from the profile scope.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →For an urgent incident, revoke active sessions in addition to changing the policies. Policy edits prevent new authorization decisions, but already issued role sessions can remain active until their session duration ends unless you explicitly revoke them. Record the change, inspect CloudTrail for sessions that existed before revocation, and verify that generation records show the expected permission denials.
Troubleshooting by symptom
“I cannot create the profile.”
Confirm that the calling identity has wellarchitected:CreateAgentProfile, iam:CreateRole, iam:AttachRolePolicy, and iam:PassRole as required by the chosen onboarding path. Then check SCPs in the profile account. An explicit deny or a missing organization-level allowance for the Well-Architected namespace can block creation even when the identity policy looks correct.
“The profile was created, but no resources are found.”
Check the access role in every workload account, its attachment of WellArchitectedAgentResourceScanning or the approved custom policy, and the exact execution-role ARN in its trust policy. Next, inspect SCPs for denied scanning actions. A profile can be valid while discovery remains empty when resource APIs are blocked.
“Generation records show an access-denied error.”
Use the denied event in CloudTrail to classify the failure: sts:AssumeRole indicates a trust or execution-policy issue; a service API denial indicates the scanning policy or an SCP; a Well-Architected API denial indicates profile permissions or organization controls. Correct the narrowest failing layer and rerun the affected generation.
“One account cannot be added.”
Compare that account’s support tier, SCP path, role name, trust policy, policy attachment, and account ID with a working account. The onboarding flow requires the common access-role name in every selected account, but the trust statement still has to contain the profile’s exact execution-role ARN.
“Recommendations have not appeared yet.”
Verify that an application context exists and that the role chain can scan at least one intended account. Scheduled recommendations typically become available within 48 hours after setup; persistent absence after that window should be investigated through generation records and CloudTrail rather than by immediately broadening permissions.
Implementation decision
For most organizations, the safest rollout is to use the AWS-managed scanning policy, a dedicated profile account, one execution role, and one identically named access role per monitored account. Narrow the execution role to specific target-role ARNs, trust only that execution role, preserve the profile-ARN external ID, and let CloudTrail and IAM Access Analyzer guide subsequent reductions. Move to a custom scanning policy only when the organization can own its action allow-list, SCP updates, testing, and ongoing coverage review.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
