Automate remediation post AWS DevOps Agent investigation
AWS DevOps Agent moves from 'watch and report' to 'propose and approve' — how one company turned investigation summaries into pre-validated fixes.
Why it matters
AWS is showing a practical pattern for agent deployment: keep the agent in read-only mode (diagnosis), use Bedrock and Lambda to synthesize fixes, and gate execution through human approval. This addresses a real production concern — agents that can only report are expensive; agents that can break things unilaterally are risky.
The key facts
9 to knowAWS DevOps Agent kept in observe-and-report mode by design
Pattern uses AWS Lambda Durable Functions, Amazon EventBridge, Amazon Bedrock
Fixes are pre-validated before on-call engineer approval
Single-action approval workflow for remediation
Published October 7, 2026 — AWS ML blog
AWS DevOps Agent diagnoses but does not remediate directly
Workflow generates pre-validated fixes requiring engineer approval to execute
Published Oct 7, 2026 on AWS ML blog
Addresses agent safety/governance concern: autonomous investigation without autonomous action
Go to the source
AWS Machine Learning Blogaws.amazon.com
Publisher excerpt: AWS DevOps Agent can diagnose production incidents but is kept in observe-and-report mode so it does not change resources directly. This post shows how to use AWS Lambda Durable Functions, Amazon EventBridge, and Amazon Bedrock to turn its investigation summaries into pre-validated fixes an on-call…