Your On Call Engineer Never Sleeps: How AWS DevOps Agent Is Rewriting the Rules of Incident Response
A comprehensive guide to AWS DevOps Agent, the autonomous AI operations teammate that investigates incidents, identifies root causes, and prevents outages across AWS, multi cloud, and on premises environments.
Introduction
Picture this: it is 2:47 AM on a Friday night. Your payment service just started throwing 500 errors. PagerDuty is screaming. You groggily open your laptop, start correlating CloudWatch metrics with recent deployments, check if someone pushed a bad config change, and begin the slow process of figuring out what broke and why. Two hours later, you find it was a database connection pool exhaustion triggered by an upstream traffic spike nobody anticipated.
Now imagine a world where, by the time you wake up, the root cause has already been identified, a mitigation plan is ready for your review, and the system has recommendations to prevent this from happening again.
That world exists today. It is called AWS DevOps Agent.
Announced at AWS re:Invent 2025 by AWS CEO Matt Garman as one of the first "frontier agents," AWS DevOps Agent became generally available on March 31, 2026. It represents a fundamental shift in how operations teams handle incidents, from reactive firefighting to autonomous, intelligent investigation and prevention.
In this article, we will break down what AWS DevOps Agent is, why it matters, how it fits into daily operations workflows, and what it looks like in practice for large enterprise organizations managing complex, distributed systems at scale.
Release Timeline at a Glance
| Date | Milestone |
|---|---|
| December 2, 2025 | Public preview announced at AWS re:Invent 2025 by CEO Matt Garman |
| December 4, 2025 | Datadog MCP Server integration announced for preview |
| January 15, 2026 | "From AI agent prototype to product" blog shares engineering lessons |
| March 31, 2026 | General availability launched; pay as you go pricing begins April 10 |
| April 2026 | CloudFormation, CDK, and Terraform setup guides published; VPC private connectivity launched |
| May 2026 | Multi agent reasoning deep dive published; end to end agentic SRE guide released |
| June 17, 2026 | Release management capability announced (public preview, US East only) |
| June 2026 | Kiro IDE power, LaunchDarkly integration, EKS diagnostics, Salesforce MCP, PagerDuty native integration all launched |
What Is AWS DevOps Agent?
AWS DevOps Agent is an autonomous, always available AI operations teammate that investigates incidents, identifies root causes, provides mitigation plans, and proactively prevents future outages. It works across AWS, multicloud (including Azure), and on premises environments.
Think of it as an experienced Site Reliability Engineer who never takes a day off, never gets fatigued during a multi hour incident, and never falls victim to confirmation bias when diagnosing complex failures.
Core Identity
AWS classifies DevOps Agent as a frontier agent, a new class of AI systems that are:
- Autonomous: They work independently without constant human oversight
- Scalable: They handle concurrent tasks across many services simultaneously
- Persistent: They run continuously, learning and improving over time
Unlike traditional AI assistants that respond to prompts, frontier agents take initiative. When an alarm fires, DevOps Agent does not wait for someone to ask it what happened. It immediately begins investigating.
The Agent Space Concept
Everything in AWS DevOps Agent revolves around Agent Spaces, logical containers scoped to a team, service, or application. Each Agent Space maintains its own:
- Application topology graph (a living map of your architecture)
- Investigation history
- Learned skills and patterns
- Integration configurations
- Custom SRE agents
This isolation means your payment team's Agent Space is separate from your authentication team's space. Each builds its own operational context over time.
Why Use AWS DevOps Agent?
The Problem It Solves
Operations teams in modern organizations face a compounding challenge. Systems are more distributed than ever. A single user request might traverse dozens of microservices, managed databases, serverless functions, and third party APIs. When something breaks, the blast radius is wide and the signal to noise ratio is terrible.
Traditional incident response looks like this:
- Alert fires at odd hours
- On call engineer wakes up, spends 15 to 30 minutes getting oriented
- Starts pulling metrics from CloudWatch, logs from Splunk, traces from Datadog
- Forms a hypothesis (often influenced by whatever they check first)
- Chases that hypothesis for 30 to 60 minutes
- Either finds the root cause or pivots to a new theory
- Writes a mitigation plan, implements it, validates the fix
- Total time: 1 to 4 hours for a moderate incident
AWS DevOps Agent compresses this entire cycle. Early adopters report:
- Up to 75% reduction in Mean Time to Resolution (MTTR)
- 80% faster investigations
- 94% root cause accuracy
- 3 to 5x faster incident resolution overall
Beyond Speed: The Confirmation Bias Problem
One of the most underappreciated aspects of AWS DevOps Agent is how it addresses confirmation bias in incident investigation. When a human engineer gets paged, they form a theory early, find one piece of supporting evidence, and stop looking. The actual root cause goes undiscovered longer than necessary.
AWS DevOps Agent is architecturally designed to combat this. It generates multiple competing hypotheses simultaneously and actively seeks counter evidence for each one before converging on a root cause. It only labels something as the root cause when the evidence conclusively supports it and nothing contradicts it.
How It Works: The Technical Architecture
Multi Agent Reasoning
Under the hood, AWS DevOps Agent uses a multi agent architecture that decomposes incident operations into specialized capabilities:
- Topology Graph (Foundation Layer): A continuously updated map of your applications, their component services, resources, runtime communication patterns, and deployment lineage. Built through CloudFormation/CDK stack analysis, AWS Resource Explorer, CloudWatch Application Signals, and CI/CD pipeline integration.
- Triage Agent: Optimized for speed. Correlates incoming signals, identifies duplicate tickets, assesses severity, and links related alarms that originate from the same event.
- Investigation Agent: The core reasoning engine. Performs deep, multi phase root cause analysis with parallel hypothesis generation and counter evidence validation.
- Mitigation Agent: Generates immediate remediation actions based on the identified root cause, including step by step procedures, validation checks, and rollback plans.
- Prevention Agent: Analyzes patterns across historical incidents to deliver actionable recommendations that prevent future outages.
The Investigation Lifecycle in Action
Let us walk through a concrete example. Your e-commerce checkout service starts showing latency spikes during peak traffic.
Context Acquisition: The agent parses the incoming alarm, identifies affected resources, walks the topology graph outward to map the blast radius, and pulls recent deployment activity.
Evidence Collection: It gathers time series metrics with healthy baselines, queries logs across CloudWatch, Splunk, and Datadog, collects distributed traces, and captures configuration state.
Hypothesis Generation: Three competing theories emerge:
- A config change was pushed 20 minutes before onset
- The payment gateway is returning slow responses
- The database connection pool is nearing capacity
Validation: The agent checks all three simultaneously:
- Config change only affected logging verbosity. Eliminated.
- Payment gateway slowness started after checkout latency began. It is a symptom, not the cause. Eliminated.
- Connection pool at 94% capacity correlates with the exact onset time. Nothing contradicts it. Root cause identified.
Mitigation Plan: Detailed remediation steps with rollback procedures, delivered to the on call team for review and execution.
Architecture Diagram
The following diagram illustrates how AWS DevOps Agent fits into a typical enterprise operations workflow:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
┌─────────────────────────────────────────────────────────────────────────────┐
│ AWS DEVOPS AGENT ARCHITECTURE │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
│ │ CloudWatch │ │ PagerDuty │ │ ServiceNow │ ALERT SOURCES │
│ │ Alarms │ │ Incidents │ │ Tickets │ │
│ └──────┬───────┘ └──────┬───────┘ └──────┬───────┘ │
│ │ │ │ │
│ └───────────────────┼───────────────────┘ │
│ ▼ │
│ ┌──────────────────────────────────┐ │
│ │ AGENT SPACE │ │
│ │ ┌────────────────────────┐ │ │
│ │ │ Topology Graph │ │ │
│ │ │ (Live Architecture │ │ │
│ │ │ Map + Dependencies) │ │ │
│ │ └────────────────────────┘ │ │
│ │ │ │
│ │ ┌────────┐ ┌────────────┐ │ │
│ │ │ Triage │ │Investigation│ │ │
│ │ │ Agent │ │ Agent │ │ MULTI AGENT │
│ │ └────────┘ └────────────┘ │ REASONING │
│ │ ┌────────┐ ┌────────────┐ │ │
│ │ │Mitigat.│ │ Prevention │ │ │
│ │ │ Agent │ │ Agent │ │ │
│ │ └────────┘ └────────────┘ │ │
│ └──────────────────────────────────┘ │
│ │ │
│ ┌───────────────────┼───────────────────┐ │
│ ▼ ▼ ▼ │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────────┐ │
│ │ Observability│ │ Source Code │ │ Infrastructure │ DATA SOURCES │
│ │ CloudWatch │ │ GitHub │ │ CloudFormation │ │
│ │ Datadog │ │ GitLab │ │ CDK / Terraform │ │
│ │ Splunk │ │ Azure DevOps│ │ Resource Explorer│ │
│ │ Dynatrace │ │ │ │ │ │
│ └──────────────┘ └──────────────┘ └──────────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────────────────────────┐ │
│ │ DELIVERY CHANNELS │ │
│ │ Slack | Teams | ServiceNow │ │
│ │ Kiro IDE | MCP Servers │ │
│ └──────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────────┘On Premises and Multi Cloud Connectivity
AWS DevOps Agent is not limited to AWS workloads. This is a critical distinction for enterprises that operate hybrid or multi cloud environments.
On Premises Connectivity: Through MCP servers deployed on private networks, the agent connects to self managed monitoring tools (Grafana, Splunk) without exposing them to the public internet. Private connections allow the agent to query on premises observability data securely. If your Grafana instance runs in a private data center behind a VPN, the agent can still access it through a private MCP connection.
Multi Cloud Support: AWS DevOps Agent supports Azure DevOps as a source control and CI/CD integration, meaning teams running workloads on Azure can still benefit from incident investigation and release management. The agent's Splunk and Datadog integrations pull telemetry regardless of where the underlying workloads run, whether that is AWS, Azure, GCP, or on premises hardware.
Hybrid Architecture Patterns: For enterprises running SAP workloads on premises with disaster recovery in AWS, or processing data locally and replicating to the cloud, the agent investigates incidents that span both environments. It correlates a CloudWatch alarm with an on premises Splunk log entry to identify cross boundary failures that single cloud tools would miss.
This multi environment capability makes AWS DevOps Agent particularly valuable for large enterprises in the middle of cloud migration journeys, where some workloads have moved to AWS but others remain on premises or in other clouds for regulatory, latency, or cost reasons.
Safety by Design
A critical design choice: AWS DevOps Agent does not execute remediation actions autonomously. It generates detailed mitigation plans, but execution remains with human operators. This is intentional. In production incident response, the most dangerous moment is not when you are investigating; it is when you are applying a fix under pressure. The agent separates recommendation from execution so a human always validates before proceeding.
Getting Started
Getting AWS DevOps Agent running takes about 20 minutes for a basic setup. You need an AWS account, AWS CLI v2, IAM permissions to create roles, and a supported Region (US East N. Virginia, US West Oregon, Europe Frankfurt, Europe Ireland, Asia Pacific Sydney, or Asia Pacific Tokyo).
The agent requires two IAM roles: an Agent Space Role for resource access and topology discovery, and an Operator App Role for the web interface. Setup can be done via the AWS Console, CLI, CloudFormation, or Terraform. The CloudFormation and Terraform templates automate everything in a single deployment.
Once provisioned, the agent immediately begins building your topology graph by discovering resources across all associated accounts. Within minutes, it maps your applications, services, and their runtime dependencies.
Key Features and Capabilities
1. Autonomous Incident Response
- Automatically launches investigations from alerts via PagerDuty, ServiceNow, CloudWatch Alarms, or third party tools
- Correlates related alarms to reduce noise and identify when multiple alerts share a single root cause
- Provides root cause analysis with detailed evidence chains
- Generates mitigation plans with validation checks and rollback procedures
- Works through Slack and ServiceNow as a collaborative team member
2. Release Management (Preview, June 2026)
The newest addition extends capabilities to pre deployment:
- Release Readiness Review: Evaluates every code change against production requirements, dependency safety, and standards you define in natural language
- Autonomous Release Testing: Generates and runs change specific test plans for web and API based applications
- Cross Repository Dependency Mapping: Surfaces breaking changes before merge
- Infrastructure Change Verification: Uses deterministic mathematical verification to ensure IAM permissions do not drift outside best practices
3. Proactive Site Reliability
- Analyzes patterns across historical incidents to deliver targeted recommendations
- Covers four key areas: observability enhancement, infrastructure optimization, deployment pipeline improvement, and application resilience
- Recommendations include agent ready specifications that can be handed off to coding agents (like Kiro) for implementation
4. On Demand SRE Tasks
- Conversational AI interface for querying your application architecture and system health
- Natural language questions about resources, metrics, alarm status, deployment history, and incident patterns
- Create, save, and share custom charts and operational reports
- Schedule custom SRE agents for recurring tasks (daily health reports, configuration audits, anomaly detection)
5. Production Intelligence
- Application Mapping: Automatically discovers applications, services, and their relationships into a dynamic topology
- Extensible Agent Skills: Modular instruction sets that encode your runbooks, architectural standards, and operational practices
- Learned Skills: The agent learns from your organization's investigation patterns and becomes more effective over time
6. Kiro IDE Integration
The Kiro power for AWS DevOps Agent brings production intelligence directly into the development environment. Developers can check production health, investigate issues, and receive release readiness feedback without leaving their IDE.
Integration Ecosystem
AWS DevOps Agent connects with an extensive ecosystem of tools:
Observability: Amazon CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana (including self managed, Grafana Cloud, and Amazon Managed Grafana)
Source Control & CI/CD: GitHub (Actions), GitLab (CI/CD), Azure DevOps
Incident Management: PagerDuty, ServiceNow
Collaboration: Slack, Microsoft Teams
Feature Management: LaunchDarkly
Extensibility: Model Context Protocol (MCP) servers for custom integrations, Agent to Agent (A2A) protocol for connecting sub agents built with Amazon Bedrock or third party frameworks
Infrastructure as Code: Setup via AWS CloudFormation, AWS CDK, or Terraform
The MCP Advantage
The Model Context Protocol support is particularly powerful for enterprises with custom internal tools. You can connect AWS DevOps Agent to private Grafana or Splunk instances via private connections, custom monitoring systems, internal runbooks, Kubernetes cluster diagnostics (EKS node issue diagnosis), and Salesforce for customer impact correlation.
Pricing and Cost Model
AWS DevOps Agent uses a straightforward, consumption based pricing model:
$0.0083 per agent second ($0.498 per agent minute)
No upfront commitments. You only pay for the time the agent is actively working. When idle, there is no charge.
AWS Support Credits
| Support Plan | Credit Rate |
|---|---|
| Unified Operations | 100% of AWS Support charge |
| Enterprise Support | 75% of AWS Support charge |
| Business Support+ | 30% of AWS Support charge |
Free Tier and Trial
- Included in the AWS Free Tier for new customers
- 2 month free trial (up to 10 agent spaces, 20 hours of investigations, 15 hours of evaluations, 20 hours of on demand SRE tasks per month)
Cost Examples
- Small team (10 investigations/month, 8 min each): ~$40/month
- Active team (80 investigations + 100 SRE tasks/month): ~$344/month
- Enterprise (500 incidents + 40 evaluations + 30 custom agents/month): ~$2,366/month
Available in six AWS Regions: US East (N. Virginia), US West (Oregon), Europe (Frankfurt), Europe (Ireland), Asia Pacific (Sydney), and Asia Pacific (Tokyo). Release management preview is currently US East only.
Limitations Summary
Key boundaries to understand: the agent investigates and recommends but does not execute fixes (deliberate safety choice). Default concurrency is 3 investigations per agent space. Custom agents handle one invocation at a time. Release management is preview only as of June 2026. No GovCloud or China Region support. The agent does not replace your monitoring stack, does not manage infrastructure provisioning, and does not handle security incidents (use AWS Security Agent for that).
Real World Use Cases
Autonomous Incident Resolution at Scale
Western Governors University (WGU), serving over 191,000 students, deployed AWS DevOps Agent with their Dynatrace integration. During a production investigation, total resolution time dropped from an estimated two hours to 28 minutes, a 77% improvement in MTTR. The agent pinpointed the root cause in a Lambda function configuration.
Bandwidth Constrained Teams
Zenchef, a restaurant technology platform, experienced a customer facing issue during a company hackathon when most engineers were unavailable. The team pasted the issue into AWS DevOps Agent. It traced the root cause to an IAM misconfiguration on the EC2 instance hosting GitHub. Full investigation: 20 to 30 minutes versus 1 to 2 hours manually.
Multi Cloud Operations
T Mobile, operating infrastructure across multiple clouds and on premises environments with centralized Splunk logging, uses DevOps Agent's ability to integrate with Splunk and analyze logs across diverse environments for root cause analysis.
How It Compares
The AI powered incident response space is evolving rapidly. Here is a summary of how AWS DevOps Agent compares to alternatives.
vs PagerDuty SRE Agent: PagerDuty excels at alert routing and on call orchestration. AWS DevOps Agent provides deeper autonomous investigation with multi hypothesis reasoning and adds release management. They work together well: PagerDuty for routing/escalation, DevOps Agent for deep investigation.
vs Datadog Bits AI SRE: Bits AI is tightly integrated within the Datadog platform. AWS DevOps Agent correlates signals across multiple observability platforms simultaneously. They complement each other via the Datadog MCP Server.
vs BigPanda AIOps: BigPanda excels at event correlation and noise reduction. AWS DevOps Agent goes deeper with root cause analysis and mitigation plans. BigPanda can serve as an aggregation layer feeding into DevOps Agent for investigation.
The key differentiator for AWS DevOps Agent is its breadth of scope: it spans release management, incident investigation, and proactive prevention in a single autonomous agent, while integrating with every major observability and incident management platform.
Enterprise Context: What This Means for Large Scale Operations
For large enterprise organizations running multi site operations with distributed teams, the implications are substantial:
- Scaling without scaling headcount: The topology graph captures architectural knowledge that would otherwise live only in individual engineers' heads
- Institutional knowledge preservation: Learned skills and investigation history create persistent operational memory that survives team changes
- Multi APM consolidation: Correlating telemetry across CloudWatch, Datadog, Dynatrace, Splunk, New Relic, and Grafana in a single investigation
- Custom skills for organizational standards: Different teams can have different investigation protocols encoded in their Agent Spaces
- Cross account and cross Region operations: Centralized operations teams can monitor workloads spread across dozens of AWS accounts
Best Practices for Deployment
- Start with a quick win: Re investigate a recent resolved incident to demonstrate value without risk
- Scope Agent Spaces thoughtfully: Align with team or service boundaries that match on call rotations
- Connect your full observability stack: Investigation quality is proportional to telemetry access
- Invest in skills early: Encode tribal knowledge so the agent follows your protocols
- Measure and iterate: Track MTTR improvements, investigation time savings, and root cause accuracy
- Use Infrastructure as Code: Set up via CloudFormation, CDK, or Terraform for reproducibility
The Bigger Picture
The release management preview (June 2026) signals a clear direction: AWS DevOps Agent is expanding from post deployment operations into the full software delivery lifecycle. The combination of release readiness review, autonomous release testing, post deployment investigation, and proactive prevention creates a continuous feedback loop where every incident makes the next deployment safer.
For organizations shipping code daily across hundreds of services, having an autonomous agent that validates every change, runs targeted tests, investigates failures immediately, and prevents recurrence is becoming table stakes.
Frequently Asked Questions
Q: Does AWS DevOps Agent use my content to train models?
No. Your data stays yours. The agent does not use your content, telemetry, code, or investigation data to train foundation models.
No. Your data stays yours. The agent does not use your content, telemetry, code, or investigation data to train foundation models.
Q: Does it work across multicloud and on premises environments?
Yes. It connects to Azure through Microsoft Entra ID, and to on premises environments via built in observability integrations or private MCP servers.
Yes. It connects to Azure through Microsoft Entra ID, and to on premises environments via built in observability integrations or private MCP servers.
Q: Can the agent run remediation steps automatically?
No. It generates mitigation plans with step by step procedures, but a human always reviews and executes. This is a deliberate safety design choice.
No. It generates mitigation plans with step by step procedures, but a human always reviews and executes. This is a deliberate safety design choice.
Q: How does the agent connect to private/on premises systems?
Via private MCP servers deployed in your VPCs, communicating with the agent without exposing internal systems to the public internet.
Via private MCP servers deployed in your VPCs, communicating with the agent without exposing internal systems to the public internet.
Q: Can I build custom agents on top of AWS DevOps Agent?
Yes. Custom agents let you encode recurring SRE tasks that run on a schedule or in response to events, each with its own system prompt, skill set, and memory store.
Yes. Custom agents let you encode recurring SRE tasks that run on a schedule or in response to events, each with its own system prompt, skill set, and memory store.
Conclusion
AWS DevOps Agent is not an incremental improvement to existing monitoring tools. It represents a category shift: from tools that show you dashboards and send you alerts, to an autonomous agent that investigates, reasons, and recommends. It takes the best practices of elite SRE teams (multi hypothesis investigation, counter evidence validation, blast radius assessment, proactive prevention) and makes them available to every team, 24 hours a day, 7 days a week.
For engineering organizations managing complex distributed systems, the question is not whether autonomous incident response will become standard practice. The question is how quickly you start building the operational muscle memory (topology graphs, custom skills, integration depth) that makes the agent most effective for your specific environment.
The best time to start was yesterday. The second best time is today.
References
- AWS DevOps Agent Overview
- AWS DevOps Agent Features
- AWS DevOps Agent Pricing
- AWS DevOps Agent FAQs
- Announcing General Availability of AWS DevOps Agent
- How AWS DevOps Agent uses multi-agent reasoning to find root causes
- AWS DevOps Agent adds release management capabilities
- Building an end-to-end agentic SRE using AWS DevOps Agent
- Production-Ready Autonomous Incident Resolution with AWS DevOps Agent and Datadog MCP Server
- Supercharge your cloud operations with the Kiro power for AWS DevOps Agent
- Feature Flag Orchestration with AWS DevOps Agent and LaunchDarkly
- AWS DevOps Agent User Guide
- AWS DevOps Agent Customers
- Accelerate Incident Resolution with PagerDuty and AWS DevOps Agent
- Securely Connect AWS DevOps Agent to Private Services in Your VPCs
Published: June 2026
About the Authors
Sekh Mohammad Warish is a Senior Technical Account Manager at AWS, supporting customers across SAP, GenAI, and cloud modernization. With 120+ IT certifications including 12 AWS certifications, he helps customers adopt emerging technologies and build production-ready solutions on AWS.
Nitish Tipparaju is an Enterprise Support Manager at AWS, leading technical account teams that drive GenAI adoption and operational excellence for customers. He co-leads GenAI upskilling programs and brings hands-on experience helping organizations build their first AI agents on AWS.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article