AWS Builder Center

Builder Center

From Agentic Operations to Autonomous Incident Response

From Agentic Operations to Autonomous Incident Response

Using AWS DevOps Agent to Operationalize AIOps Across Your Organization. How enterprise SREs, Security Engineers, DBAs, and Operations teams can move from framework to fully managed tooling with AWS DevOps Agent.

Series: Operating at Hyperscale (7 articles)

  1. 1
    An Operational Maturity Model for Operating at Hyperscale on AWS
  2. …
  3. 3
    From Agentic Operations to Autonomous Incident Response This article
  4. 4
    Using Kiro to Implement the AWS Well-Architected Agentic AI Lens

Sunaina Karve

My earlier post, Agentic Operations: A Practical AIOps Framework for Keeping Generative-AI Workloads Reliable on AWS , described a four-pillar framework for shifting from reactive incident response to proactive, agent-assisted operations.
This article answers the natural next question: what does it look like when that framework is productized?
The answer is AWS DevOps Agent, a frontier agent that operationalizes every pillar of the Agentic Operations framework as a fully managed service. But more than that, it extends the model to specific operational personas. SREs, Security Engineers, DBAs, and Platform Operations teams each face different failure surfaces, and the agent adapts to each.

What Is AWS DevOps Agent?

AWS DevOps Agent is a frontier agent, not a chatbot layered over a large language model. It is built on topology intelligence, a three-tier skills hierarchy, and continuous learning. It operates as your always-available operations teammate that resolves and proactively prevents incidents across AWS, multicloud, and on-prem environments. 
AWS DevOps Agent high-level architecture
Figure 1 — AWS DevOps Agent high-level architecture

Production Operations

  • Automated incident investigation - Begins investigating immediately when an alert comes in, correlating telemetry, code, and deployment data to identify root cause.
  • Actionable mitigation plans - Provides specific actions to resolve incidents. Also provides agent-ready instructions for Kiro to implement fixes.
  • Proactive incident prevention - Analyzes patterns across historical incidents to deliver targeted improvements.
  • Automated incident coordination - Routes findings through Slack, ServiceNow, and PagerDuty.
  • On-demand SRE task handling - Handles SRE tasks through natural language using deep topology knowledge.
  • AWS Support integration - Create support cases directly from an investigation with full context. 

Release Management (Preview)

  • Release readiness review - Reviews code changes for policy compliance, dependency impacts, and access controls.
  • Autonomous release testing - Generates and runs change-specific test plans in customer-provisioned environments. 

The Critical Safety Guarantee

AWS DevOps Agent produces mitigation plans but does NOT make changes to your environment. Any remediation requires human action. The agent investigates and recommends; humans approve and execute.

Mapping the Agentic Operations Pillars to DevOps Agent

Here is how each AIOps pillar maps directly to AWS DevOps Agent capabilities:
Direct mapping from Agentic Operations pillars to DevOps Agent capabilities
Figure 2 — Direct mapping from Agentic Operations pillars to DevOps Agent capabilities

Pillar 1: Workload-Aware Observability → Topology Intelligence

In AIOps framework, I described per-model throttle rate, TTFT, and context-window utilization as leading indicators. DevOps Agent operationalizes this through Agent Spaces that map your full application topology and ingest telemetry from CloudWatch, Datadog, Dynatrace, New Relic, Splunk, and Grafana simultaneously. 

Pillar 2: Agent-Assisted Diagnosis → Automated Investigation

The frameworks said "every diagnostic step a human performs more than twice is a candidate for automation." DevOps Agent runs the entire diagnostic tree autonomously, generating hypotheses, querying data sources, and narrowing to root cause without human prompting. 

Pillar 3: Preemptive Capacity & Resilience → Proactive Prevention

The framework emphasized portfolio-wide impact assessment. DevOps Agent delivers weekly prevention evaluations across four categories: observability, infrastructure, governance, and code optimization. 

Pillar 4: Knowledge Capture → Continuous Learning

Reliability compounds only if lessons leave the individual incident. DevOps Agent learns from every investigation, builds reusable skills, and generates agent-ready instructions that Kiro can implement directly.

Use Case 1: SRE - The 3 AM DynamoDB Throttling Incident

Let's revisit the composite scenario where a platform hits a 40–50% throttling rate. Here is the equivalent with DevOps Agent in the loop:
SRE investigation flow: alarm to mitigation in ~4 minutes
Figure 3 — SRE investigation flow: alarm to mitigation in ~4 minutes 

What DevOps Agent Does (Autonomously)

  1. Detects the CloudWatch alarm via configured SNS topic or PagerDuty.
  2. Generates hypotheses: Lambda cold start? API Gateway issue? DynamoDB throttling?
  3. Queries CloudWatch metrics - identifies DynamoDB WriteThrottleEvents spiking.
  4. Correlates timeline with a recent code deployment via GitHub integration.
  5. Identifies the specific commit introducing a hot partition key pattern.
  6. Posts complete RCA to Slack: switch to on-demand capacity or rollback. 

Prevention Recommendation

Add a CloudWatch alarm on ConsumedWriteCapacityUnits and switch to on-demand capacity for unpredictable traffic. 

Use Case 2: Security Engineer - Anomalous IAM Activity

Security investigation: detect, correlate, trace, assess, mitigate, prevent
Figure 4 — Security investigation: detect, correlate, trace, assess, mitigate, prevent

Scenario

CloudTrail detects unusual cross-account AssumeRole calls from an unexpected source IP. 

What DevOps Agent Does

  1. Correlates IAM activity with recent infrastructure changes via CloudTrail.
  2. Identifies a Terraform commit that widened a security group to 0.0.0.0/0.
  3. Maps blast radius: exposed resources, affected services, impacted accounts.
  4. Produces rollback plan and offers to create AWS Support case. 

Prevention

  • Add CloudTrail anomaly detection alarm for unusual role assumptions.
  • Add CI/CD gate flagging security group changes opening 0.0.0.0/0. 

Use Case 3: DBA - RDS Performance Degradation 

DBA investigation: RDS alarm to missing index identification
Figure 5 — DBA investigation: RDS alarm to missing index identification 

Scenario

After a maintenance window, RDS CPU spikes to 95%. Application latency triples. 

What DevOps Agent Does

  1. Analyzes Performance Insights - IO:DataFileRead dominating top-wait events.
  2. Identifies slow queries via CloudWatch Logs Insights.
  3. Traces deployment: schema migration commit failed to create an index.
  4. Recommends: CREATE INDEX + adjust provisioned IOPS. 

Prevention

  • Performance Insights alarms on top-wait events.
  • Enforce migration review gates requiring EXPLAIN plan analysis before merge. 

Use Case 4: Platform/Ops — Regional AZ Impairment

How to "get ahead of a regional event before customers feel it is the single highest-leverage operational move." 
Parallel investigation pattern for AZ impairment
Figure 6 — Parallel investigation pattern for AZ impairment 

What DevOps Agent Does

  1. Detects correlated alarms and identifies the impaired AZ as common factor.
  2. Launches parallel investigations across every affected service simultaneously.
  3. Identifies single-AZ dependencies vs. multi-AZ auto-recovering services.
  4. Produces consolidated impact report with per-service mitigation.
  5. Posts to Slack and updates ServiceNow. 

Prevention

  • Enforce multi-AZ deployment patterns for all production services.
  • Add AZ-aware health checks to detect impairment before full failure. 

Use Case 5: Release Engineering - Catching Regressions Before Production

Release Engineering use case (preview): Pre-production quality gate with autonomous testing
Figure 7 — Release Engineering use case (preview): Pre-production quality gate with autonomous testing.

Scenario (Preview)

A PR updates a shared dependency. DevOps Agent’s release readiness review triggers automatically. 

What DevOps Agent Does

  1. Checks policy compliance: flags expanded IAM permissions.
  2. Maps cross-repository dependencies: identifies breaking downstream API change.
  3. Generates change-specific test plan targeting risk areas.
  4. Runs autonomous tests in staging, catches a UX regression the static suite missed.
  5. Posts findings back to the PR with remediation guidance. 

The Six Differentiators (The 6 Cs)

What makes DevOps Agent more than a DIY LLM wrapper:
DIY LLM WrapperAWS DevOps Agent
ContextLimited to what you pasteFull topology via Agent Spaces
ControlAd-hoc access, no auditIAM-scoped read-only, human-in-the-loop
ConvenienceManual integration per incidentOne-click integrations + MCP/webhooks
CollaborationCopy-paste into SlackAutonomous posting to Slack/tickets
LearningStarts from zero every timeLearns from every investigation
CostEngineer time + API costsPay-per-investigation

Integrating with Your Existing Stack

Built-In

  • Telemetry: CloudWatch, CloudTrail, X-Ray, Datadog, Dynatrace, New Relic, Splunk, Grafana
  • Code & CI/CD: GitHub, GitLab, Azure DevOps
  • Ticketing: PagerDuty, ServiceNow
  • Collaboration: Slack
  • Infrastructure: Multi-account AWS, EKS, Azure (hybrid) 

Extensibility

  • MCP Servers - Custom data sources via Model Context Protocol (read-only tools).
  • Webhooks - Any monitoring tool can trigger investigations via HTTPS.
  • EventBridge - Route lifecycle events to EventBridge targets.
Integration ecosystem: DevOps Agent connects to telemetry, code, ticketing, chat, events, infrastructure, and custom data sources via built-in integrations and MCP.
Figure 8 — Integration ecosystem: DevOps Agent connects to telemetry, code, ticketing, chat, events, infrastructure, and custom data sources via built-in integrations and MCP.

Getting Started

  1. Create an Agent Space and connect your AWS accounts.
  2. Connect telemetry (CloudWatch is automatic; add Datadog/Dynatrace/etc.).
  3. Connect ticketing/alerting (PagerDuty or ServiceNow).
  4. Connect Slack for collaboration.
  5. Trigger your first investigation.
  6. Review your first prevention evaluation.

Why This Matters for AIOps Practitioners

AIOps for generative AI is infrastructure resilience for a large and growing slice of the digital economy. DevOps Agent is the clearest productization of that insight.
The shift from "automate one diagnostic" to "plug in a frontier agent that automates all diagnostics" is the operational equivalent of moving from hand-rolled infrastructure to managed services. Every investigation makes the agent smarter. Every prevention recommendation makes the next incident less likely.
If you’re operating Bedrock, foundation-model workloads, or complex distributed systems on AWS, I’d genuinely like to hear what’s working for you. 
Written for the AWS Builder Community. Views are my own.
# devops# ai-agents# agentic-ai# ai-assisted# generative-ai

Series: Operating at Hyperscale (7 articles)

  1. 1
    An Operational Maturity Model for Operating at Hyperscale on AWS
  2. …
  3. 3
    From Agentic Operations to Autonomous Incident Response This article
  4. 4
    Using Kiro to Implement the AWS Well-Architected Agentic AI Lens
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article