AWS DevOps Agent – Exploration & Operating Model

1. Problem Statement

In large AWS environments, incident investigation is often slow and error-prone due to:

• Disconnected visibility across logs, metrics, and infrastructure monitoring
• Manual correlation across multiple AWS services (EKS, EC2, IAM, applications)
• Heavy reliance on individual engineer experience
• Delayed root cause identification, increasing MTTR
• Operational risk caused by premature or blind automation of AWS resource operations without sufficient analysis

The objective of this exploration was to evaluate AWS DevOps Agent as an AI-assisted investigation tool, understand its practical capabilities, and define a safe operating model for real-world usage.

2. Solution Overview (What AWS DevOps Agent Is)

AWS DevOps Agent is an AI-powered, human-controlled investigation service designed to assist engineers during incident response.

It helps engineers to:

• Initiate investigations using natural-language prompts
• Analyze and correlate:

1. Logs
2. Metrics
3. Resource configuration
4. Service topology

• Identify probable root causes of incidents
• Receive clear, structured recommendations for next steps

Important clarification:

AWS DevOps Agent is a decision-support system, not an automation or remediation engine.
It explains what happened and why, but does not take action on resources.

3. Architecture (As Explored)

High-Level Investigation Flow

Architectural Characteristics

• Investigation is explicitly human-initiated
• DevOps Agent performs analysis only, not execution
• No autonomous actions are performed
• All investigation steps are auditable and reviewable
• Designed to be enterprise-safe and compliant

4. Limitations Identified

The following limitations were identified during exploration and are intentional design choices:

• Investigations cannot be auto-triggered directly from Amazon CloudWatch alarms and
• DevOps Agent does not execute remediation or runbooks
• No automatic failover or restart actions
• No native incident lifecycle management (severity, open/close)
• Service is currently in Preview, with limited public APIs

These constraints ensure:

• Human accountability
• Controlled decision-making
• Reduced risk of unsafe automation

5. Use Cases Performed During Exploration

EKS Control Plane Authorization Issues

• Investigated Unauthorized and Forbidden access patterns
• DevOps Agent correlated control plane logs and metrics
• Identified IAM / kubernetes RBAC-related causes
• Provided structured recommendations

Application & Service Error Investigations

• Investigated AWS Lambda errors and CPU-related anomalies
• Compared multiple investigations using the Incident Response Dashboard
• Reviewed investigation timelines and outcomes

Manual, On-Demand Investigations

• All investigations were initiated manually from the DevOps Agent UI
• Investigation history was reviewed for learning and audit purposes

6. Key Insight from Exploration

AWS DevOps Agent is best positioned as an AI-assisted investigation and decision-support tool, not as an autonomous remediation system.

Its strength lies in answering:

• Why did this happen?
• What is impacted?
• What should be done next?

Final execution decisions remain with engineers.

7. Final Assessment Summary

8. Executive Summary 

AWS DevOps Agent enhances incident investigation through AI-assisted analysis while preserving full human control over operational decisions.