AWS Builder Center

Builder Center

Connecting Your First App + CloudWatch — resource mapping, topology graph, and monitoring integration (Part 3)

Connecting Your First App + CloudWatch — resource mapping, topology graph, and monitoring integration (Part 3)

In this part, we will: Launch a simple EC2-based application Create a CloudWatch alarm to act as a health signal for the agent Understand how the agent auto-discovers and maps resources Open the web app and explore the Topology graph Verify the agent’s understanding of our infrastructure via the Summary Report and chat

Series: Setting Up AWS DevOps Agent from Scratch (7 articles)

  1. 1
    What is AWS DevOps Agent? A Beginner’s Guide to Autonomous Incident Response — PART 1
  2. …
  3. 3
    Connecting Your First App + CloudWatch — resource mapping, topology graph, and monitoring integration (Part 3) This article
  4. 4
    Simulating and Investigating Your First Incident (Part 4)

Fawaz c p

Let’s get started.😎

Step 1: Launch an EC2-Based Application

For this walkthrough, we’ll use a simple EC2 instance running a web server as our demo application. If you already have an EC2-based workload in `us-east-1`, you can skip to Step 1.2.

1.1 — Launch the EC2 Instance

  1. Open the EC2 Console from the AWS Management Console.
    2. Click Launch Instance.
    3. Give it a name — for example, `devops-agent-demo-app`.
    4. Select Amazon Linux 2023 as the AMI.
    5. Choose t3.micro (free-tier eligible).
    6. Under Key pair, select an existing key pair or create a new one.
    7. Under Network settings, allow HTTP (port 80) and SSH (port 22) inbound traffic.
    8. Under Advanced details → User data, paste the following to auto-install a simple web server:
1
2
3
4
5
6
#!/bin/bash
yum update -y
yum install -y httpd
systemctl start httpd
systemctl enable httpd
echo "<h1>DevOps Agent Demo App</h1>" > /var/www/html/index.html
9. Click Launch Instance.
Press enter or click to view image in full size

1.2 — Tag the Instance

  1. Select your newly launched instance in the EC2 Console.
    2. Click the Tags tab → Manage tags.
    3. Add the following tags:
1
2
3
4
| Key | Value |
|---------------|---------------------|
| `Application` | `devops-agent-demo` |
| `Environment` | `dev` |
Press enter or click to view image in full size
Note: the DevOps Agent does not require specific tags to discover resources. It automatically discovers every resource in the associated AWS account. Tags are for your own organisation and make chat queries more intuitive.

Step 2: Connect CloudWatch as a Monitoring Signal

The DevOps Agent uses CloudWatch alarms as health signals. When an alarm enters the `ALARM` state, the agent can correlate it with the affected resources during an investigation. Setting up an alarm now means the agent is ready to act the moment something goes wrong.

2.1 — Create a CPU Utilisation Alarm

  1. Open the CloudWatch Console.
  2. Navigate to Alarms → All alarms → Create alarm
  3. Click Select metric → EC2 → Per-Instance Metrics.
  4. Find your instance and select CPUUtilization.
  5. Set the condition: Greater than 80% for 1 consecutive period of 5 minutes.
  6. Under Notification, you can skip SNS for now or configure an email endpoint.
  7. Name the alarm: `devops-agent-demo-cpu-alarm`.
  8. Click Create alarm.
Press enter or click to view image in full size
The agent will pick up this alarm automatically as part of its infrastructure mapping — no manual linking required.

Step 3: How Resource Discovery Actually Works

Before opening the web app, it’s worth understanding what the agent has already done since we associated the account in Part 2.
The AWS DevOps Agent continuously scans the associated AWS account and builds a topology map — a graph of how resources connect to each other. This happens automatically in the background from the moment account association is complete. You don’t need to manually register applications, configure resource groups, or tag resources in any specific way.
By the time we open the web app, the agent may have already mapped hundreds of relationships across your EC2 instances, VPCs, security groups, subnets, CloudWatch alarms, load balancers, and more.
You can check the mapping progress directly on the Agent Space detail page in the AWS console — it shows a count of relationships mapped so far, which grows as the agent completes investigations and gains more capabilities.
Press enter or click to view image in full size

Step 4: Open the DevOps Agent Web App

The web app is the operations interface where you interact with the agent, view topology, and manage investigations.

4.1 — Access via Operator Access

1. In the AWS Management Console, search for AWS DevOps Agent and open it.
2. Click Agent Spaces in the left nav → select your Agent Space.
3. Click the Web app tab.
4. Under Web app link, click Operator access ↗.
> This opens the web app using your current IAM session. Sessions last up to 8 hours.
5. On the login screen (“Your always-on operations partner”), click Log in via AWS Console.
 
You’ll land on the web app home screen with a chat interface and a left sidebar.
Press enter or click to view image in full size

Step 5: Explore the Topology Graph

The Topology view is where the agent visualises everything it has discovered and mapped about your infrastructure.

5.1 — Open Topology

  1. In the left sidebar of the web app, click Topology.
  2. The right panel loads a visual graph of your infrastructure resources and their relationships.
The graph shows nodes for resources (EC2 instances, security groups, subnets, VPCs, CloudWatch alarms, etc.) and edges for the connections between them. As the agent completes more investigations, the graph becomes richer and more detailed.
Note: If the Topology graph appears empty on first visit, it means the agent hasn’t yet completed an investigation that causes it to traverse and record relationships. Once we simulate an incident in Part 4, the topology will populate and grow with each investigation.
Press enter or click to view image in full size
Press enter or click to view image in full size
I have already created the AWS resources for the application. As you can see, the DevOps Agent has automatically mapped and associated those resources with the application under the Topology section.
Press enter or click to view image in full size
This topology graph provides a visual representation of all the resources associated with your services that are available within the AWS account. It helps you understand the relationships and dependencies between the various AWS services and components deployed for the application.

5.2 — What the Topology Tells You

The topology graph is not just a visualisation — the agent actively uses it during incident investigation. When an alarm fires, the agent traverses the graph to understand:
  • Which resources are directly affected
  • Which upstream or downstream resources may be impacted
  • What the traffic and dependency chain looks like end-to-end
This is why the agent can perform root cause analysis much faster than manual investigation — it already has the map.

Step 6: Verify the Agent Knows Your Application

6.1 — Check the Summary Report

The agent automatically generates an Agent Space Summary Report — a structured document describing everything it has discovered about your infrastructure.
  1. In the AWS console, go to your Agent Space → Summary report tab.
  2. The report shows:
  • Overview: A description of the AWS account’s cloud architecture
  • Environments: Detected environments (production, dev, CI/CD, etc.)
  • High-level Architecture: A table of application containers, their descriptions, and key components
  • Container Summaries: Detailed descriptions of each application group
Your newly launched EC2 instance may already appear here if it has been running for a few minutes. The report is refreshed periodically as the agent learns more.
Press enter or click to view image in full size
These are the services that were already created earlier, and they are currently displayed in the summary report. The newly created EC2 instance will also be reflected in the report once the resource inventory is refreshed and updated.

6.2 — Ask the Agent About Your Resources

The quickest way to confirm the agent has discovered your EC2 instance is to ask it directly.
  1. In the web app, click + New chat.
  2. Type:
1
What EC2 instances are running in my account?
The agent will query your account and return a list with instance IDs, types, regions, and states — including your new `devops-agent-demo-app` instance.
Press enter or click to view image in full size
1
2
3
4
You can also try:
- *"Give me a health summary of my infrastructure."*
- *"What CloudWatch alarms do you know about?"*
- *"Describe my application architecture."*
The agent responding accurately to these questions confirms it has successfully discovered and indexed your resources — including the EC2 instance and CloudWatch alarm we set up in this part.

What We Accomplished

In this part, we:
  • Launched an EC2 instance (`devops-agent-demo-app`) with a running web server
  • Tagged it with `Application` and `Environment` labels for organisation
  • Created a CloudWatch CPU alarm (`devops-agent-demo-cpu-alarm`) as a health signal for the agent
  • Understood that the agent auto-discovers all resources in the associated account — no manual registration required
  • Opened the DevOps Agent web app via Operator access
  • Explored the Topology graph — the agent’s visual map of infrastructure relationships
  • Verified the agent’s awareness of our infrastructure through the Summary Report and direct chat
Our application is connected, our monitoring signal is in place, and the agent already understands the resource topology. Everything is ready for the next step.

What’s Next — Part 4

In Part 4 — Simulating and Investigating Your First Incident, we’ll put the agent to work on a real incident:
  • Set up the Agent Space Webhook to enable autonomous, alarm-triggered investigations
  • Wire up CloudWatch → SNS → Lambda → DevOps Agent so investigations start automatically when alarms fire
  • Intentionally spike CPU on the EC2 instance to trigger the alarm
  • Watch the agent automatically start an investigation, trace the topology, identify root cause, and surface remediation steps — all without manual intervention
Find the full article link: https://medium.com/@fawazcp/connecting-your-first-app-cloudwatch-resource-mapping-topology-graph-and-monitoring-dbe26b5a26cd?sharedUserId=fawazcp
If you found this helpful, follow along for Part 4. Questions or issues? Drop them in the comments below.

Series: Setting Up AWS DevOps Agent from Scratch (7 articles)

  1. 1
    What is AWS DevOps Agent? A Beginner’s Guide to Autonomous Incident Response — PART 1
  2. …
  3. 3
    Connecting Your First App + CloudWatch — resource mapping, topology graph, and monitoring integration (Part 3) This article
  4. 4
    Simulating and Investigating Your First Incident (Part 4)
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article