AWS DevOps Agents

A collection of production-ready AI agents for cloud operations — built on AWS Bedrock with proper security guardrails. Each agent is self-contained, scoped to a specific operations domain, and follows the same safe-by-default architecture.

Not toy demos. Every agent has: least-privilege IAM, an audit trail (DynamoDB), a kill switch (SSM Parameter), Bedrock Guardrails (content filtering + topic blocking), and read-only defaults. Write actions require explicit human approval.

The Agent Roster

Agent	Domain	What it does
devops	Infrastructure Ops	Check deployments, query logs, describe resources
cost	FinOps	Analyze spend, detect anomalies, recommend savings
security	Security Ops	Triage Security Hub findings, analyze GuardDuty alerts
incident	SRE / Incident Response	Triage CloudWatch alarms, gather context, draft runbook
iac-review	IaC Safety	Review Terraform plans, flag risky changes before apply

Shared Architecture

All agents follow the same pattern:

User → API Gateway → Orchestrator Lambda → Bedrock Agent (Claude 3)
                                                 ↓
                                          Tool Lambdas (domain-specific)
                                                 ↓
                                          DynamoDB audit + CloudTrail

Shared modules (in shared/) provide reusable Terraform for:

• audit-table/ — DynamoDB table for agent action logging
• guardrails/ — base Bedrock Guardrail configuration
• iam-base/ — common IAM patterns (read-only tool role, agent role)

Security model (applies to ALL agents)

Layer	Control
IAM	Read-only by default; write via a separate approval-gated role
Bedrock Guardrails	Block prompt injection, off-topic, and bypass attempts
Approval gate	Destructive actions pause for human confirmation
Audit log	Every invocation + tool call → DynamoDB + CloudTrail
Kill switch	SSM parameter → instantly disable any agent

When to use / when NOT to

✅ Good use cases

• Triage and diagnosis (read, analyze, suggest — the agent thinks, the human acts)
• Off-hours first response (agent gathers context; on-call engineer approves with one click)
• Onboarding (new team members ask natural-language questions about the infra)
• Routine sweeps (scheduled "is anything unhealthy / overspending / exposed?")

❌ When NOT to

• Without guardrails deployed (an ungated agent is an unaudited root user)
• As a replacement for understanding (you must be able to verify its answers)
• In automated tight loops (each Bedrock call costs ~$0.003–0.01; loops get expensive)
• For compliance sign-off (the agent assists; a human signs)

Quick start

The devops agent has full Terraform ready to deploy. The remaining agents (cost, security, incident, iac-review) include their Lambda code and documentation; Terraform for those is planned.

cd agents/devops/terraform
terraform init
terraform plan -var="region=us-east-1"
terraform apply

Cost estimate (per agent, low-traffic)

Resource	~Monthly
Bedrock (Claude 3 Haiku, ~100 calls/day)	$3–5
Lambda	~$0 (free tier)
DynamoDB	~$0 (free tier)
API Gateway	~$0 (free tier)
Total	~$4–6/agent

Repo structure

aws-devops-agent/
├── README.md               ← this file
├── shared/                 ← reusable Terraform modules
│   ├── audit-table/
│   ├── guardrails/
│   └── iam-base/
├── agents/
│   ├── devops/             ← infrastructure operations
│   ├── cost/               ← FinOps / cost analysis
│   ├── security/           ← Security Hub / GuardDuty triage
│   ├── incident/           ← alarm triage + context
│   └── iac-review/         ← Terraform plan review
└── docs/
    ├── ARCHITECTURE.md
    ├── SECURITY.md
    └── WHEN-TO-USE.md

Related

• AWS Security Done Right
• When AI Agents Get Production Access (DevOps.com)
• AWS Bedrock Agents docs

License

MIT

---

---

Built by

Durrell Gemuh - Founder @ NextGen Playground | DevOps & Cloud Infrastructure Engineer | AWS Community Builder

---

⭐ Star this repo if you found it useful - it helps others discover it!