Agentic DevOps at AWS

What It Covers

Neha Goswami, AWS Agentic DevOps lead with 22 years at Amazon, explains how AWS DevOps Agent automates incident response from alarm to root cause analysis, achieving 85–95% accuracy in internal deployments, while discussing determinism, MCP integrations, and the evolving role of SRE engineers.

Key Questions Answered

• •Incident Response Automation: AWS DevOps Agent begins investigating before the on-call engineer is paged. When an alarm breaches a threshold and auto-cuts a ticket, the agent simultaneously starts root cause analysis using a pre-built system topology map. Engineers wake up to a completed hypothesis, ranked mitigation steps, and a full audit trail rather than a blank incident screen.
• •Customization Drives Accuracy: Internal Amazon teams using DevOps Agent start at an 85% baseline accuracy but reach the high nineties by adding team-specific runbooks and configurations. The lift is low — not heavyweight integration work — but the payoff is significant. Organizations scaling DevOps Agent should centralize common MCP tool integrations rather than leaving each team to configure them independently.
• •Determinism via Permission Boundaries: In a probabilistic agentic system, AWS enforces determinism through strict, read-only permission defaults. Expanding agent permissions requires deliberate, intentional user action. AWS also applies automated reasoning — a mathematical modeling technique that compares system state before and after a change — to detect unintended policy drift without relying solely on LLM inference.
• •Triage Agent Deduplication: A companion triage agent consolidates duplicate alarm tickets before the DevOps Agent investigates. If five tickets fire for the same root cause, the triage agent collapses them into one, preventing redundant agent task runs. Since pricing is based on active agent task hours, deduplication directly reduces operational costs alongside reducing engineer alert fatigue.
• •SRE Role Shift, Not Elimination: As agents handle routine incident pattern matching, SRE engineers will increasingly engage only on cases where agents produce incomplete or failed analyses. AWS internally still requires engineers with SRE experience to build these products. Mid-career DevOps engineers should adopt agentic tools immediately for daily workflows and deliberately move toward higher-complexity problem domains the agents cannot yet resolve.