# AWS DevOps Agent Tools for Incident Investigation and Root Cause Analysis

> Investigate incidents and find root causes with AWS DevOps Agent tools. Analyze CloudWatch logs alarms and resource graphs automatically using AI powered analysis. Get faster issue resolution.

- Repository: [Amazon Web Services/agent-toolkit-for-aws](https://github.com/aws/agent-toolkit-for-aws)
- Tags: tutorial
- Published: 2026-07-02

---

**The AWS DevOps Agent provides AI-powered incident investigation capabilities through the Agent Toolkit for AWS, using MCP server-based skills to automatically analyze CloudWatch logs, alarm histories, and resource graphs to identify root causes.**

The `aws/agent-toolkit-for-aws` repository delivers a comprehensive framework for AI coding agents to interact with AWS services. At its core, the **AWS DevOps Agent** enables automated incident investigation and root cause analysis through specialized skills and plugins that interface with AWS APIs via a secure MCP server.

## Architecture of the AWS DevOps Agent

### MCP Server and Plugin Layer

The architecture centers on the **MCP Server**, a managed endpoint that authenticates agents, proxies AWS API calls, and executes sandboxed Python scripts. According to the source code in [`README.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/README.md), this server provides the secure bridge between AI agents and AWS services. The **aws-agents-for-devsecops** plugin, defined in [`plugins/aws-agents-for-devsecops/README.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-agents-for-devsecops/README.md), bundles MCP configuration with curated skills for DevOps workflows.

### Skills and Trigger-Based Invocation

Skills are Markdown-driven instructions stored under `plugins/aws-agents-for-devsecops/skills/`. The primary skill for incident work is [`investigating-incidents-with-aws-devops-agent/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/investigating-incidents-with-aws-devops-agent/SKILL.md). When an agent detects trigger phrases like "investigate" or "root cause," it automatically invokes the `investigate` tool. This tool creates investigations, lists tasks, retrieves logs, and surfaces possible root causes without requiring embedded AWS SDK calls in the agent.

### Investigation Workflow

The investigation workflow follows four steps:

1. User invokes a command such as `/aws-agents-for-devsecops:investigate`
2. The plugin loads the investigation skill and calls the MCP `investigate` API
3. The MCP server authenticates via SigV4 or Bearer token and queries AWS DevOps Agent services
4. Results including CloudWatch logs and alarm histories stream back to the agent

## Using AWS DevOps Agent Tools for Root Cause Analysis

### Install the DevSecOps Plugin

To begin using AWS DevOps Agent tools for incident investigation and root cause analysis, install the `aws-agents-for-devsecops` plugin:

```text
/plugin marketplace add aws/agent-toolkit-for-aws
/plugin install aws-agents-for-devsecops
/reload-plugins

```

### Configure Authentication

Run the setup command to configure credentials:

```text
/aws-agents-for-devsecops:setup

```

This skill guides you through selecting SigV4 or Bearer-token authentication and writes a [`.mcp.json`](https://github.com/aws/agent-toolkit-for-aws/blob/main/.mcp.json) configuration file as documented in [`plugins/aws-agents-for-devsecops/README.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-agents-for-devsecops/README.md).

### Start an Investigation

Initiate a new investigation using the `investigate` command:

```text
/aws-agents-for-devsecops:investigate

```

This auto-invokes the `investigate` tool on the MCP server, creating a new investigation that returns summaries of recent alarms, error logs, and related CloudWatch metrics.

### Query Logs and Drill Down

To query specific logs and perform root cause analysis:

```text
/aws-agents-for-devsecops:investigate

# Then request:

list my AWS DevOps agent spaces

```

The agent calls `list_agent_spaces` to enumerate configured spaces, then uses `list_services` to drill down to specific services like Lambda or EC2.

### Post-Incident Release Readiness

After resolving an incident, verify release readiness:

```text
/aws-agents-for-devsecops:release-readiness

```

This runs the release-readiness skill, creating a review job that gathers test results and produces a readiness verdict.

## Key Configuration Files and Rules

The [`rules/aws-agent-rules.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/rules/aws-agent-rules.md) file provides recommended IAM condition keys, CloudWatch metrics, and audit-logging policies specifically for agent actions during incident investigations. The core plugin at [`plugins/aws-core/README.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/README.md) supplies the MCP configuration used by all DevOps and Security agent skills.

## Summary

- **AWS DevOps Agent tools** provide automated incident investigation through the `aws-agents-for-devsecops` plugin in the Agent Toolkit for AWS
- The **MCP server** architecture handles authentication and AWS API proxying, allowing language-agnostic incident analysis
- **Skills** like `investigating-incidents-with-aws-devops-agent` auto-trigger on phrases like "investigate" or "root cause" and execute the `investigate` tool
- Key commands include `/aws-agents-for-devsecops:investigate` for starting analysis and `list_agent_spaces` for drilling into service logs
- Configuration files in `plugins/aws-agents-for-devsecops/` and [`rules/aws-agent-rules.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/rules/aws-agent-rules.md) define best practices for secure incident handling

## Frequently Asked Questions

### What is the AWS DevOps Agent?

The AWS DevOps Agent is a component of the Agent Toolkit for AWS that provides AI agents with the ability to investigate incidents and analyze root causes. It operates through the MCP server to securely interact with AWS services like CloudWatch and AWS DevOps Agent spaces without requiring direct SDK integration in the agent code.

### How does the investigate command work?

The `investigate` command triggers a skill defined in [`plugins/aws-agents-for-devsecops/skills/investigating-incidents-with-aws-devops-agent/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-agents-for-devsecops/skills/investigating-incidents-with-aws-devops-agent/SKILL.md). This skill calls the MCP server's `investigate` tool, which authenticates with AWS credentials and retrieves alarm histories, logs, and resource graphs to identify potential root causes.

### What authentication methods does the AWS DevOps Agent support?

According to the setup skill in [`plugins/aws-agents-for-devsecops/README.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-agents-for-devsecops/README.md), the AWS DevOps Agent supports both **SigV4** signature authentication and **Bearer tokens**. The `/aws-agents-for-devsecops:setup` command walks users through selecting the appropriate method and generates a [`.mcp.json`](https://github.com/aws/agent-toolkit-for-aws/blob/main/.mcp.json) configuration file.

### Can I use AWS DevOps Agent tools with any AI coding agent?

Yes, the tools are designed to be **language-agnostic** and work with any AI coding agent that supports the MCP protocol, including Claude Code, Codex, and Cursor. The MCP server handles all AWS API interactions, so agents only need to invoke the appropriate slash commands like `/aws-agents-for-devsecops:investigate`.