The Weekly Challenged :: CloudFix Buddy: An AWS Troubleshooting Agent
CloudFix Buddy is a friendly troubleshooting agent for students, developers, and junior cloud engineers. You describe the problem or paste the error. It answers with one clear check at a time, explains why that check matters, and waits for you to report back before moving on.
What it does and who it's for
If you're new to AWS, an error like
AccessDenied or an SSH timeout can send you through ten browser tabs and a wall of documentation. Each page lists a dozen possible causes, and you can't tell which one to check first.CloudFix Buddy is a friendly troubleshooting agent for students, developers, and junior cloud engineers. You describe the problem or paste the error. It answers with one clear check at a time, explains why that check matters, and waits for you to report back before moving on.
It only reads what you type. It never connects to your AWS account, and it never asks for keys or passwords. It also says "likely" instead of "confirmed", because it can't see your account.
The home page
How I built it
The whole thing is serverless, so it costs almost nothing when nobody is using it.
The System Archilecture
| AWS service | What it does here |
|---|---|
| Amazon CloudFront + private S3 | Hosts the React app over HTTPS. The bucket is private; only CloudFront can read it. |
| Amazon API Gateway (HTTP API) | Public entry point with POST /chat and GET /health. Adds CORS and throttling. |
| AWS Lambda (Python 3.12) | Validates the request, runs the agent loop, and returns a friendly reply or error. |
| Amazon Bedrock (Converse API) | The model [TODO: model name/ID] in [TODO: Region]. It writes the replies and decides when to call a tool. |
| Amazon CloudWatch Logs | Lambda logs with 7-day retention. |
| AWS IAM | A least-privilege role: write its own logs and invoke Bedrock. Nothing else. |
| Terraform | Everything above is code, split into modules: iam, lambda, api_gateway, frontend_hosting. |
The flow: the browser sends the conversation to API Gateway, which invokes Lambda. Lambda calls Bedrock with a system prompt and one tool definition. If the model asks for the tool, Lambda runs it, sends the result back, and repeats for at most three rounds. The reply goes back to the browser.
Key decisions
- A deterministic tool, not just a chatbot. For S3
AccessDenied, the model calls a read-only tool that ranks the likely causes in a fixed order: identity policy, explicit deny, cross-account access, KMS. The model explains the result in plain English, but the ordering comes from code I can test. I wrote 15 unit tests for the tools, the input validation, and the agent loop (the loop tests use a mocked Bedrock client). - Safety in code, not only in the prompt. Tools run from an allow-list, inputs have size limits, throttling is on, and the Lambda cannot do anything except log and call Bedrock.
- No VPC. The Lambda only talks to Bedrock, so a VPC would add NAT cost and complexity for no benefit.
- A sample mode. If no API URL is set, the UI runs on scripted sample steps, so I could build and test the interface before the backend existed.
Challenges I overcame
[TODO: Write 2-3 real problems you hit and how you solved them. Use only what actually happened to you. Examples of the kind of thing that fits: getting Bedrock model access, choosing a model or inference profile that supports tool use, CORS between CloudFront and API Gateway, or Terraform errors.]
The delightful detail: "One Fix at a Time"
Most troubleshooting help gives you everything at once. CloudFix Buddy gives you one check, one reason, and three buttons: I checked this, Show me how, and I still see the error. Pressing a button sends that reply to the agent, which then gives the next check.
I chose this because the hardest part of a cloud error for a beginner is knowing where to start. Giving them one small, safe action removes that.
The Live Chat
Proof it works
- Try it: Live Demo Link
- Code: https://github.com/nimeshayasith/cloudfix_buddy_agent
- Demo video:
The Lambda Proof
Honest limits
- The S3
AccessDeniedflow is the one with a purpose-built diagnostic tool. Other topics (EC2, Lambda, Docker) get answers from the model alone, without a tool, so they're less structured. - Everything is guidance from what you type. The agent can't verify anything in your account, which is why it says "likely".
- The front page includes a scripted preview, labelled as a sample.
What's next
More diagnostic tools (EC2 SSH timeouts first), saving sessions, and moving Terraform state to a remote backend.
About me
I'm Nimesha, a Computer Engineering student at the University of Ruhuna in Sri Lanka and a software and DevOps intern. I enjoy AWS, Terraform, and containers.
Built for the AWS Builder Center "Build an Agent" weekend challenge.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article