Automate remediation post AWS DevOps Agent investigation

Organizations running production workloads on AWS prioritize reducing the time between incident detection, investigation, and remediation. AWS DevOps Agent, an AI-powered agent that autonomously triages incidents using correlated metrics, logs, and application topology, addresses this priority by providing root cause analysis and recommended actions.

However, organizations typically keep these agents in observe-and-report mode, where the agent diagnoses issues but doesn't modify production resources directly, to retain control and prevent unintended changes. This post demonstrates how to use AWS Lambda Durable Functions, Amazon EventBridge, and Amazon Bedrock to create an automated remediation workflow that completes the issue resolution step, complementing AWS DevOps Agent.

The workflow transforms investigation summaries into pre-validated fixes ready for single approval action, reducing mean time to resolution and freeing on-call engineers from repetitive diagnostic work. The solution architecture consists of steps where AWS DevOps Agent emits an event containing investigation findings, Amazon EventBridge triggers a Lambda function with this information, and the Lambda function packages the summary to invoke a durable function.

The durable function sends the context to Amazon Bedrock, which analyzes the findings and lists applicable remediation tools from an approved allowlist. The durable function then runs the remediation tools autonomously for read-only actions or waits for human approval before applying infrastructure changes. By checkpointing progress and suspending execution until approval, the system ensures safe and auditable automated actions while minimizing the time between detection and remediation.