AWS Builder Center

Builder Center

Setting Up AWS DevOps Agent from Scratch — Agent Spaces, IAM Roles & Account Association | PART 2

Setting Up AWS DevOps Agent from Scratch — Agent Spaces, IAM Roles & Account Association | PART 2

In this post, we’re going hands-on. By the end of Part 2, you’ll have: A fully configured Agent Space The right IAM roles in place Access to the DevOps Agent Web App A working environment ready to connect your application and investigate real incidents

Series: Setting Up AWS DevOps Agent from Scratch (7 articles)

  1. 1
    What is AWS DevOps Agent? A Beginner’s Guide to Autonomous Incident Response — PART 1
  2. 2
    Setting Up AWS DevOps Agent from Scratch — Agent Spaces, IAM Roles & Account Association | PART 2 This article
  3. 3
    Connecting Your First App + CloudWatch — resource mapping, topology graph, and monitoring integration (Part 3)

Fawaz c p

Let’s get started.

What You’ll Need Before You Start

Before opening the console, make sure you have:
  • An AWS account in one of the supported regions: us-east-1, us-west-2, eu-central-1, eu-west-1, ap-southeast-2, or ap-northeast-1
  • IAM permissions to create IAM roles (you’ll need this for the auto-create option — more on that below)
  • Signed in as an administrator or a user with aidevops:* and iam:CreateRole permissions
  • A web browser — the DevOps Agent Web App runs outside of the AWS Management Console
Note: AWS DevOps Agent offers a 2-month free trial for new users, so if you haven’t used it yet, you can follow along at no cost.

Step 1 — Navigate to the AWS DevOps Agent Console

Sign in to the AWS Management Console and make sure you’re in a supported region (I’ll be using us-east-1 throughout this series).
In the search bar at the top, type “DevOps Agent” and click the result.
Press enter or click to view image in full size
You’ll land on the AWS DevOps Agent console at:
1
https://console.aws.amazon.com/aidevops
If this is your first time here, the console shows a clean landing page with a “Create Agent Space” button (or “Begin Setup” — both take you to the same place).
Press enter or click to view image in full size

Step 2 — Create Your First Agent Space

Click Create Agent Space. You’ll see the creation form with four main sections. Let’s walk through each one.

Section 1: Agent Space Details

This is where you name your Agent Space.
  • Name — Give it a meaningful name. I’m using production-agent-space for this series, but use something that reflects your environment (e.g., my-app-prod, team-payments-agent)
  • Description (optional) — A short note about the purpose. For example: “Agent Space for monitoring the production workload”
  • Agent response language (optional) — The language the agent uses when generating investigation output, findings, and AWS Support cases. Defaults to the language of your input. You can pin it to a specific language here.
Press enter or click to view image in full size

Section 2: Give This Agent Space AWS Resource Access

This is the most important part of the setup — granting the agent permission to discover and investigate AWS resources in your account.
AWS DevOps Agent needs an IAM role to read your resources during investigations. You have three options:

Option 1: Auto-create a new AWS DevOps Agent role (Recommended)

The simplest path. AWS automatically creates a role with the right permissions for the agent.
You must have iam:CreateRole permission to use this option.
Select “Auto-create a new AWS DevOps Agent role”. You can leave the generated role name as-is or rename it.

Option 2: Assign an existing role

If your team has already pre-created an IAM role for DevOps Agent, select this option and pick it from the dropdown.

Option 3: Create a new role using a policy template

Use this when you need to limit what the agent can access — the console gives you the trust policy and inline policy to create the role manually in IAM.
For this walkthrough, go with Option 1. It’s the fastest way to get started, and you can always tighten permissions later.
Press enter or click to view image in full size

Section 3: Enable the Agent Space Web App

The DevOps Agent Web App is the interface your operations team will use every day — for incident investigations, topology browsing, and reviewing prevention recommendations. It runs outside the AWS Management Console at its own unique URL.
To enable it, you also need an IAM role for web app access. Same three options as above.
Select “Auto-create a new AWS DevOps Agent role” here as well.
Press enter or click to view image in full size
A note on authentication: By default, the web app uses IAM authentication (admin access mode) — good for 30-minute sessions during initial setup. For production team access, you’d configure IAM Identity Center to give each person their own login with 8-hour sessions. We’ll cover that at the end of this post.

Section 4: Tags (Optional)

Expand the Tags section to add any AWS resource tags (e.g., Environment: production, Team: platform). You can add up to 50 tags. Skip this for now if you're just getting started.

Complete the Creation

Once all sections are filled in, click Create.
 
AWS will:
  1. Create the Agent Space
  2. Create the IAM service role for resource access
  3. Create the IAM operator role for web app access
  4. Link everything together
This takes just a few seconds.
Press enter or click to view image in full size

Step 3 — Understand the Two Consoles

Before going further, it’s worth pausing on the dual-console architecture. (We covered this conceptually in Part 1, but now you can see it for real.) Here’s how the two consoles compare:
Console: AWS Management Console
URL: console.aws.amazon.com/aidevops
Who Uses It: Administrators
What For: Create Agent Spaces, configure integrations, manage IAM
────────────────────────────────────────
Console: DevOps Agent Web App
URL: Unique URL per Agent Space
Who Uses It: Operations teams
What For: Investigate incidents, browse topology, review recommendations
You set everything up in the AWS Management Console. Your team does their day-to-day work in the Web App.
Press enter or click to view image in full size

Step 4 — Access the DevOps Agent Web App

On the Agent Space details page, click the Operator access button.
This opens the DevOps Agent Web App in a new browser tab, already authenticated using your IAM credentials.
Press enter or click to view image in full size
Here’s a quick map of what you’ll see in the Web App:
  • Investigations — Active and past incident investigations
  • Topology — Visual map of your application resources and how they connect
  • Recommendations — Proactive suggestions to prevent future incidents
  • Chat — Natural language interface to ask the agent questions about your environment.
Right now, Topology will be empty — that’s expected. In Part 3, we’ll connect your first application and watch the agent start mapping your resources.
Press enter or click to view image in full size

What Just Happened Under the Hood?

When you created the Agent Space, AWS did more than just create a console resource. It:
  • Provisioned an AWSServiceRoleForAIDevOps service-linked role — tied to the aidevops.amazonaws.com service principal, giving the agent the baseline permissions it needs
  • Created a resource access role in your primary account — what the agent uses to discover EC2 instances, RDS databases, Lambda functions, and other resources
  • Created an operator role for the web app — scoped to allow authenticated users to interact with the agent
  • Set your current account as the primary account for this Agent Space
Your setup currently looks like this:
1
2
3
4
5
6
7
Agent Space (production-agent-space)
│
├── Primary Account: [your AWS account ID]
│ └── IAM Role: DevOpsAgent-ResourceAccess-xxxxx
│
└── Web App Access
└── IAM Role: DevOpsAgent-WebAppAdmin-xxxxx
In Part 3, we’ll add your application resources to the picture.

(Optional) Set Up IAM Identity Center for Your Team

Admin access works fine for solo setup, but if you’re configuring this for a team, you’ll want IAM Identity Center so each person logs in with their own credentials and gets an 8-hour session.
Here’s how to set it up:
  1. In your Agent Space, go to the Access tab
  2. Under Connect IAM Identity Center, verify your Identity Center instance is shown
  3. Select “Auto-create a new DevOps Agent role” and click Connect
  4. Go to User Access → Manage Users and Groups and add your team members
Once connected, users navigate to the Web App URL and are redirected to the IAM Identity Center login page. After authenticating (with MFA if configured), they’re dropped straight into the Web App.
You can also connect external identity providers like Okta, Microsoft Entra ID, or Ping Identity through IAM Identity Center — users and groups sync automatically.

What’s Next

You now have a working AWS DevOps Agent environment:
  • ✅ Agent Space created
  • ✅ IAM roles configured
  • ✅ Web App accessible
But the agent isn’t investigating anything yet — because we haven’t connected it to an application.
In Part 3, we’ll:
  • Deploy a simple test application on AWS
  • Connect Amazon CloudWatch to the Agent Space
  • Watch the agent build a topology graph of your resources
  • Explore the resource map in the Web App
That’s where AWS DevOps Agent starts to feel real — seeing it automatically map your actual infrastructure.
Follow along so you don’t miss it. And if you hit any issues during setup, drop a comment below — I’ll help you debug it.

Conclusion

That’s Part 2 done.
We went from zero to a fully configured Agent Space — named it, wired up the IAM roles, enabled the Web App, and took our first look at the operations interface.
The setup is deliberately simple. AWS made the auto-create role option the default for a reason — it gets you running in under 5 minutes, and you can customize permissions once you know what the agent actually needs access to.
Find the full article link: https://medium.com/@fawazcp/setting-up-aws-devops-agent-from-scratch-agent-spaces-iam-roles-account-association-part-2-fa3d2e05b3e0?sharedUserId=fawazcp
# agentic-ai# agents# devops

Series: Setting Up AWS DevOps Agent from Scratch (7 articles)

  1. 1
    What is AWS DevOps Agent? A Beginner’s Guide to Autonomous Incident Response — PART 1
  2. 2
    Setting Up AWS DevOps Agent from Scratch — Agent Spaces, IAM Roles & Account Association | PART 2 This article
  3. 3
    Connecting Your First App + CloudWatch — resource mapping, topology graph, and monitoring integration (Part 3)
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article