Well-Architected posture for multi-account AWS
StationChief scores your whole AWS organisation against the Well-Architected Framework from free APIs, and hands you a ranked list with the fix identified on every item.
Unweighted mean across five pillars. Sustainability is out of scope rather than extrapolated. Coverage is shown on every row — a score without its denominator hides a shallow pillar.
Operational Excellence scores 59 over 42% coverage — and says so. A number without its denominator isn’t a score.
Why StationChief
4 ungated AWS sources and 117 rules of our own reach 627 of the 638 Trusted Advisor checks. No support plan, no per-account upgrade, no agent to install.
Every finding names its remediation. The ranked list stays filled and re-orders daily as findings arrive and age — so the top of it is correct without anyone maintaining it.
The category sells a score and calls the arithmetic behind it a trade secret. Ours is documented — how each source becomes a pillar number, what is excluded from the denominator, and why. You can reproduce it, and dispute it.
How it works
Nobody promoted these items. The list ordered itself, and closes itself.
A single CloudFormation template creates a read-only audit role in every member account by service-managed StackSet with auto-deployment, and in the management account directly. The role name is fixed, so every account’s role ARN is derived — nothing is registered per account, and an account created later is covered on placement and scanned on the next run.
We read 4 ungated AWS sources — Security Hub, Service Quotas, Compute Optimizer, and Cost Optimization Hub — and run 117 rules of our own against the control plane. Together that reaches 627 of the 638 Trusted Advisor checks with no support plan involved. Schedules live in Postgres and are reconciled on every worker boot, so a cache flush cannot silently stop your scans.
Findings become recommendations, and recommendations become a ranked list that stays at least ten items deep. Severity, dollars and age all feed the ordering, and an organisation-level profile decides which wins when savings and risk disagree. A daily pass re-ranks as findings arrive and age, so the top of the list is current without anyone maintaining it.
Every item names its remediation. Work it by hand, or let agents you run yourself work it — completion is an API call, so an agent closes its own items and the queue reflects what actually happened rather than who remembered to tick a box.
CUR 2.0 normalised into Parquet across every account. Daily rollups serve the dashboards; Athena answers the questions a dashboard can’t. Current-month figures are labelled provisional, because the Cost and Usage Report restates — and a number that quietly moves under you is worse than no number.
Backfilled from onboarding
Account × service
Unit economics
It’s the policy most tools request, and it grants s3:GetObject
and friends — your actual data. The StationChief audit role is
SecurityAudit plus ViewOnlyAccess, with an explicit
Deny on data-plane reads. We have no business reading your files, and we ask for no
permission to. The template that creates the role is published, and it is verbatim what
the StackSet delivers.
One CloudFormation stack, a read-only role, and your first scan runs on the spot.
No demo required. No sales call. The pricing is on the pricing page.