Free · Artetecha

The Well-Architected Checklist

Thirty questions across the six lenses I use in a full review. Tick honestly. Every “no” is a place a build can bite you — and a shortlist for where to start.

Delivery & operations

Every deploy comes from version control — never a manual upload.
A staging or preview environment mirrors production.
You can roll back a bad deploy in one step.
Infrastructure and config live in code, not in someone’s head.
Builds are reproducible: lockfiles, pinned versions.

Reliability & scale

You know your busiest-day traffic and have tested near it.
Caching is deliberate, not accidental.
One failing component doesn’t take everything down.
Backups exist — and you’ve actually restored one.
You’re alerted before users tell you something’s down.

Security & compliance

You know whether NIS2 and GDPR apply — directly or via a client.
Dependencies are patched on a schedule, not in a panic.
Secrets live in a vault or environment, never in the repo.
Access is least-privilege and revoked when people leave.
There’s an incident-response plan with notification timelines.

Cost & efficiency

You know your monthly hosting and cloud spend per project.
You’re not paying for idle, always-on resources you don’t need.
Scaling costs are predictable, not a surprise bill.
You review that spend at least quarterly, not only at renewal.

SDLC maturity

The critical paths have automated tests.
Code is reviewed before it merges.
Releases are small and frequent, not big and rare.
A new developer can get running in under a day.
There’s a branching and release process the whole team follows.

AI-readiness

Your data is clean and accessible enough to actually use.
You’ve found one workflow where automation has clear ROI.
You can measure whether an AI feature actually helped.
You know your GDPR and AI-Act constraints before you ship.
A human reviews anything an AI feature ships to users.
You’re clear on which data can and can’t go to third-party models.