View a markdown version of this page

Investigate with the Amazon DevOps Agent - Amazon CloudWatch
Connect an agent space
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Investigate with the Amazon DevOps Agent

CloudWatch Omni uses Amazon DevOps Agent as the native agent for root cause analysis and incident investigation. You must link CloudWatch Omni to a DevOps Agent space before you can start an investigation.

Amazon DevOps Agent is an autonomous site reliability engineering (SRE) agent that supports release management and production operations across Amazon, multi-cloud, and on-premises environments. For more information, see the DevOps Agent documentation.

Important

Trust boundary and data access

Amazon DevOps Agent and CloudWatch Omni operate under different trust boundaries. DevOps Agent investigates with the IAM role on its agent space. You configure this role in the Amazon DevOps Agent console. DevOps Agent does not use your space's operator role, the CloudWatch Omni managed policies, or your members' grants. DevOps Agent reads CloudWatch Logs log groups and other sources directly, not through the CloudWatch Dataset. CloudWatch Omni then displays the results.

Data scopes apply only to data read from the CloudWatch Dataset. They do not filter Amazon DevOps Agent investigation results or any other data that comes from outside the Dataset.

Any member whose grant includes the Amazon DevOps Agent read actions can see every investigation for a connected agent space. This includes investigations that other members started. The read actions are aidevops:GetBacklogTask, aidevops:ListBacklogTasks, and aidevops:ListJournalRecords. The Viewer, Editor, and Space Admin permission levels all include these actions. Connecting an agent space is the access control for this integration. Connect only an agent space whose IAM role reaches data that every member of the space can already see.

Only a Space Admin can connect, change, or remove the DevOps Agent integration. For more information about permission levels, see Control access to your space.

Connect an agent space

Deploy DevOps Agent

  • A DevOps Agent space must exist in the account you are accessing CloudWatch Omni from. To create one, see Creating an agent space in the Amazon DevOps Agent User Guide.

Note

Sign-in must match. If your Omni domain uses IAM Identity Center, configure your DevOps Agent space to use IAM Identity Center as well.

Connect Omni to DevOps Agent

Before you connect, a space administrator must attach the AIDevOpsAgentFullAccess managed policy to your space's operator role. See Set up Omni.

  1. In CloudWatch Omni, navigate to Settings → Integrations → Amazon DevOps Agent. Choose Select Space.

  2. Choose the Region your agent space is in. Select your agent space. Choose Connect.

Start an investigation

  • From the Omni agent. Describe the symptom in a thread and ask for an investigation. Omni automatically delegates questions related to root cause analysis to DevOps Agent.

  • With the /investigation command. In a thread, enter /investigation new <description of issue>.

  • From an alert. A firing alert offers an Investigate action. Investigations are manual: an alert never starts one automatically when it fires.