October 14, 2026

Automated Remediation Workflow with AWS DevOps Agent and Lambda Durable Functions

← AI for Your Work

WebCrimp analysis and practical explanation. AI-assisted; reviewed before publication.

Quick Summary

This educational analysis explores an automated remediation architecture that bridges the gap between AWS DevOps Agent's AI-driven root cause analysis and actual production resolution. By utilizing AWS Lambda Durable Functions, Amazon EventBridge, and Amazon Bedrock, organizations can safely automate incident response while keeping critical infrastructure changes under human supervision.

What Happened?

AWS DevOps Agent autonomously investigates production incidents and provides root cause analysis (RCA) but typically operates in an observe-and-report mode to prevent unintended changes. To automate the actual remediation step, a multi-step workflow is implemented. When an investigation completes, an EventBridge event triggers a Lambda function that initiates a Durable Function. This function runs an agentic loop with Amazon Bedrock to propose fixes using a curated allowlist of tools. Read-only diagnostics run autonomously, while mutating actions pause the workflow for human approval before applying the fix.

Why It Matters

Reducing Mean Time to Resolution (MTTR) is vital for maintaining production system reliability. Automating the tedious diagnostic-to-remediation bridge reduces on-call fatigue and accelerates issue resolution. Crucially, keeping mutating actions behind a human approval gate ensures that AI-driven automation does not introduce unauthorized or risky configuration changes into production environments.

Who Can Use It?

DevOps · Cloud · Software Development · AI/ML · Cybersecurity · Operations · Management

How Can I Use This?

If you work in DevOps, Cloud, Software Development, AI/ML, Cybersecurity, Operations, Management

  • DevOps and Cloud engineers can use this pattern to build safe, automated response systems. Specific actions include: (1) Configuring an Amazon EventBridge rule to capture AWS DevOps Agent investigation completion events. (2) Defining a curated allowlist of Lambda functions representing safe, scoping read and write actions. (3) Implementing a Durable Function orchestration loop that consults Amazon Bedrock to select tools and pauses execution for human review when mutating infrastructure configurations.

AI Tip

Enforce a strict tool allowlist for the Amazon Bedrock agent, mapping specific diagnostic actions to read-only permissions and infrastructure updates to separate, carefully reviewed mutating tools, ensuring the AI cannot execute arbitrary commands.

AI Trick

Use AWS Lambda Durable Functions checkpointing to pause the execution of the remediation workflow for hours or days while waiting for human approval, avoiding compute costs and resource locks during the waiting period, then resuming seamlessly upon callback.

Example Workflow

  1. 1. AWS DevOps Agent completes an investigation and emits an event to Amazon EventBridge. 2. EventBridge triggers the devops-agent-trigger Lambda function, which retrieves the investigation summary. 3. The trigger function invokes the devops-agent-remediation-durable function. 4. The durable function runs an agentic loop with Amazon Bedrock to analyze findings and select tools from the allowlist. 5. Read-only tools run autonomously, while mutating tools trigger a suspension and human approval callback. 6. Upon approval, the durable function applies the remediation and confirms completion. *Note: Suggested workflows need verification in a staging environment before production deployment.*

Copy This Prompt

To deploy the automated remediation stack for your environment, clone the GitHub repository and configure your AWS credentials using the AWS CLI with profile [AWS_PROFILE]. Navigate to the directory and run `cdk bootstrap` followed by `cdk deploy` to provision the EventBridge rules, Lambda functions, and IAM permissions. Once deployed, invoke the test `devops-agent-timeout` function to trigger an incident, start an investigation in the DevOps Agent console, and approve the pending remediation callback in the Lambda console by sending `{'approved': true}`.

Recommended Tools

  • AWS DevOps Agent
  • AWS Lambda Durable Functions
  • Amazon EventBridge
  • Amazon Bedrock
  • AWS CDK
  • AWS CLI

Check official documentation, availability and pricing before using these suggestions.

Difficulty

Advanced

Estimated Time Saved

Not measured; validate with your own workflow.

Source

AWS AI
Automate remediation post AWS DevOps Agent investigation
Original publication date: 2026-10-07T15:46:49+00:00