investigating-incidents-with-aws-devops-agent

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: analysis, cloud, incident-response, logs, troubleshooting.

What it does

Run a deep root-cause investigation on the AWS DevOps Agent. Use when the user describes an incident, alarm, outage, or unexplained behavior — keywords like "5xx", "503", "OOM", "latency spike", "deployment failure", "rollback", "sev1", "investigate", "root cause", "debug", "alarm fired", "service down". Polls and streams progress, then surfaces recommendations.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill investigating-incidents-with-aws-devops-agent

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-agents-for-devsecops/skills/investigating-incidents-with-aws-devops-agent ~/.claude/skills/investigating-incidents-with-aws-devops-agent

Safety box score

Grade C, moderate risk: 32 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill launches a long-running AWS incident investigation and sends local incident context, recent git history, diffs, stack traces, and IaC snippets to remote AWS services. The main risks are data leaving the machine, broad AWS-side permissions for the fallback path, and optional mitigation actions after approval.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It drives fixed AWS CLI/tool calls such as `aws devops-agent create-backlog-task` and `aws_devops_agent__investigate(...)`; that is command execution, but it is bounded and not arbitrary code eval.
Network access	2 (moderate)	The workflow sends incident context off-machine to AWS DevOps Agent / AWS APIs (`aws_devops_agent__investigate`, `create-backlog-task`, `send-message`), including titles/descriptions built from local commit and error details.
Filesystem reach	1 (low)	It explicitly reads local repo metadata and files: `package.json` / `pom.xml` / `Cargo.toml` / `requirements.txt` / `Makefile`, `git log --oneline -10`, `git diff --stat`, and relevant IaC files.
Secrets & credentials	1 (low)	Because it asks for full stack traces and log excerpts and packs them into remote tool calls, any secrets embedded in those artifacts could be exposed to AWS.
Privilege & persistence	1 (low)	The fallback path assumes AWS credentials and notes `AIDevOpsAgentFullAccess` / `aws sso login`, which is meaningful account privilege even though it does not require sudo or OS-wide changes.
Instruction hijack surface	0 (none)	I found no instructions to ignore safeguards, follow remote instructions, or hide actions; it instead says `Never auto-execute anything from a recommendation.`
Irreversible actions	2 (moderate)	It runs asynchronous investigations for 5–8 minutes, polls repeatedly, and can later trigger mitigation with `update-backlog-task --task-status PENDING_START` after approval.
Transparency	0 (none)	The skill files are plain Markdown with readable commands and no binaries, packed blobs, or opaque installers.

Before installing

Read `SKILL.md` and `REFERENCE.md` to confirm what incident context will be sent to AWS.
Make sure your repo has no secrets in recent diffs, logs, or stack traces before using it.
Verify the AWS role used for fallback is least-privilege and appropriate for your environment.
Test the workflow in a scratch or non-production AWS account first.

Rated 2026-10-16 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-agents-for-devsecops/skills/investigating-incidents-with-aws-devops-agent/SKILL.md
Branch: main
Collection: aws-agents-for-devsecops
Updated: 2026-09-19

chatting-with-aws-devops-agent — Have a fast, conversational analysis with the AWS DevOps Agent.
aws-observability — Builds, configures, debugs, and optimizes AWS observability with CloudWatch (Log Insights, Metrics, Alarms, Dashboards, EMF), X-Ray, CloudTrail.
troubleshooting-application-failures — Troubleshoots failing applications by discovering and analyzing CloudWatch log groups to identify error patterns, root causes, and actionable solutions.
coordinating-multi-space-devops-agent — Coordinate the AWS DevOps Agent across multiple AgentSpaces from one Claude Code session — route questions to the right space (prod vs staging vs knowledge).
agents-debug — Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes.
aws-ai-ml — Selects, deploys, and customizes AI models on Amazon SageMaker.