Faster Resolution with AWS DevOps Agent in the Support Center Console

Introduction

AWS DevOps Agent is an AI-powered, always-available agent that's built into the AWS Support Center Console to help customers resolve operational issues. AWS DevOps Agent troubleshoots intelligently and provides personalized recommendations. Launched at AWS re:Invent 2025 as part of the reimagined Support Center Console experience, AI-enhanced troubleshooting in the Support Center Console lets you describe issues in natural language and receive immediate, context-aware guidance, reducing the time it takes to resolve your issue.

Integrating AWS DevOps Agent as a new agent within the Support Center Console expands what AI-enhanced troubleshooting can do. The agent automatically investigates your running infrastructure so that you don't have to spend hours correlating Amazon CloudWatch metrics, AWS X-Ray traces, and AWS CloudTrail logs to isolate a root cause during incidents. The agent queries CloudWatch metrics and analyzes Amazon CloudWatch Logs. It traces requests through X-Ray and reviews CloudTrail API history. It inspects resource configurations in your AWS account to correlate signals and deliver root cause analysis in real time.

Through AI-enhanced troubleshooting in the Support Center Console, AWS DevOps Agent can investigate operational issues across AWS services from compute and containers to databases, networking, and beyond. This article walks you through how the AWS DevOps Agent integration works, what permissions you'll need, and how to get started.

Solution overview

The integration connects the following systems:

• The Support Center Console where you interact with the agent.

• The AI-enhanced troubleshooting orchestration layer that routes and manages the conversation.

• AWS DevOps Agent that performs autonomous investigation of your running infrastructure.

How routing works

When you describe an operational issue, a performance degradation, “5xx” errors, or deployment regressions, AI-enhanced troubleshooting recognizes it as an investigation candidate and routes the issue to AWS DevOps Agent. For general questions, billing, or configuration guidance, other specialized agents handle your request.

What AWS DevOps Agent needs to operate in your account

AWS DevOps Agent requires a DevOps Agent Space and the DevOpsAgentRole-AgentSpace IAM role with read-only access to observability services. When you enable AWS DevOps Agent from the Support Center Console, the activation creates the Agent Space and IAM role AI-enhanced troubleshooting then reuses the same Agent Space and IAM role for all subsequent investigations.

For a better understanding of the AWS DevOps Agent architecture, including topology intelligence, the three-tier skills hierarchy, continuous learning, and cross-account investigation, see Leverage Agentic AI for Autonomous Incident Response with AWS DevOps Agent.

Prerequisites

You'll need a qualifying support plan and permissions to access and use AWS DevOps Agent.

Qualifying Support plans

The qualifying Support plans are AWS Business Support+, Enterprise Support, and Unified Operations. The AI-enhanced troubleshooting experience in the AWS Support Center Console, including AWS DevOps Agent, is available in US East (N. Virginia), US East (Ohio), and Europe (Ireland) AWS Regions. For plan details, see Compare AWS Support plans.

IAM permissions

Attach the following AWS managed policies to your AWS Identity and Access Management (IAM) identity:

• AIDevOpsAgentFullAccess: Full access to AWS DevOps Agent management actions.

• AIDevOpsAgentAccessPolicy: Required to create the agent space.

• AIDevOpsOperatorAppAccessPolicy: Required to activate Operator App access.

Your identity also needs iam:PassRole permissions for the DevOpsAgentRole-AgentSpace and DevOpsAgentRole-WebappAdmin roles. For Amazon Elastic Kubernetes Service (Amazon EKS) investigations, add eks:DescribeAccessEntry, eks:CreateAccessEntry, and eks:AssociateAccessPolicy permissions. For more information, see Set up permissions to use AI-enhanced troubleshooting and AWS DevOps Agent IAM permissions. For Amazon EKS access entries, see Grant IAM users access to Kubernetes with EKS access entries.

Solution implementation

To use AWS DevOps Agent, complete the following steps:

1. Open the Support Center Console and then start a new Support interaction.

2. Describe an operational issue in natural language.

3. When prompted, approve the Agent Space setup, or select an existing one.

4. Watch the investigation stream in real time.

5. Review the summary.

Issue description

Open the Support Center Console and start a new Support interaction. Describe your operational problem in natural language:

Intelligent routing

The AI-enhanced troubleshooting orchestration layer analyzes your query. For operational problems that benefit from autonomous investigation, like infrastructure failures, performance degradation, resource misconfigurations, and post-deployment regressions, it routes to AWS DevOps Agent. Other agents within AI-enhanced troubleshooting continue to run in parallel so that you receive helpful recommendations.

Agent Space setup

AWS DevOps Agent requires an Agent Space in your account to conduct investigations. If you haven't already created an Agent Space, then running AWS DevOps Agent creates one for you . If you've already created an Agent Space, then AWS DevOps Agent uses the existing space. If you have multiple Agent Spaces, then you must choose the Agent Space to use for the investigation.

The following table describes the different Agent Space setup scenarios:

Scenario	What Happens
No Agent Space exists	AWS DevOps Agent activation creates a new Agent Space with the required IAM role (DevOpsAgentRole-AgentSpace) and read-only access policy.
One Agent Space exists	AWS DevOps Agent uses the existing Agent Space to start the investigation. No additional setup needed.
Multiple Agent Spaces exist	You must choose the Agent Space to use for the investigation. You select your preferred space, and the investigation proceeds.

See the following prompt to run Devops Agent investigations:

See the following prompt for Agent Space selection when multiple spaces exist: 

Amazon EKS access entry for Kubernetes issues

When your issue involves an Amazon EKS cluster, AWS DevOps Agent needs cluster access to inspect pods, nodes, deployments, and events.

As part of the Agent Space setup, AI-enhanced troubleshooting takes the following actions:

1. Extracts the cluster name and AWS Region from your issue description

2. Automatically creates an Amazon EKS access entry with read-only permissions as part of the onboarding

3. Proceeds with the cluster-level investigation using the access entry

This eliminates the requirement to manually configure kubeconfig or distribute cluster credentials. The access entry grants read-only Kubernetes permissions for the duration of the investigation.

Prerequisite: Your EKS cluster must activate API or API_AND_CONFIG_MAP authentication mode.

Real-time investigation

AWS DevOps Agent investigates and streams progress directly in your Support interaction. You can view each step as the agent works.

See the following example real-time investigation progress streaming in the Support Center Console:

Summary and next steps

You receive a structured investigation summary with the following information:

• Symptoms: What's failing and when it started

• Root cause: The specific issue with supporting evidence

• Investigation gaps: Areas that the agent couldn't fully investigate

Based on the summary, you can take the following actions:

• Ask follow-up questions while AWS DevOps Agent maintains full context.

• Continue with additional AI-enhanced troubleshooting recommendations.

• Create a support case, where the investigation report automatically populates so that the engineer can more quickly resolve the problem.

See the following example complete investigation summary with root cause and mitigation plan:

Security model

AWS DevOps Agent operates with minimal permissions and maintains strict security boundaries throughout every interaction.

AWS DevOps Agent takes the following security precautions:

• Read-only access only The DevOpsAgentRole-AgentSpace IAM role uses the AIDevOpsAgentAccessPolicymanaged policy, providing strictly read-only access.

• Scoped and revocable credentials AWS DevOps Agent encrypts credentials, scopes the credentials to the specific Support interaction, and automatically revokes them when the investigation completes.

• Immutable audit trail AWS DevOps Agent records every action in an immutable journal. If you decline consent at any point, then AI-enhanced troubleshooting continues with standard AI-enhanced recommendations.

The AWS DevOps Agent Web App

After you activate AWS DevOps Agent on the Support Console, you gain access to the AWS DevOps Agent Web App.

From the Web app, you can use AWS DevOps Agent in the following ways:

• Browse all past investigations and findings.

• Launch new investigations.

• Chat with the agent about your infrastructure.

• Configure third-party integrations, such as Datadog, Dynatrace, Grafana, New Relic, Splunk, PagerDuty, and GitHub.

Cleanup

To remove AWS DevOps Agent resources from your account, complete the following steps:

1. Delete the Agent Space from the AWS DevOps Agent console.

2. Remove the DevOpsAgentRole-AgentSpace IAM role.

3. Remove the Amazon EKS access entry from your cluster, if applicable.

Conclusion

AI-enhanced troubleshooting in the Support Console changes how you interact with Support by delivering AI-enhanced guidance and contextual recommendations in seconds. For complex operational issues, you no longer need to manually correlate metrics, analyze logs, and trace deployment history because AWS DevOps Agent handles your investigation in minutes. If you need to escalate, then the engineer who picks up your case starts with a complete investigation report without the need to repeat questions and without lost context.

Try AWS DevOps Agent from your AWS Support Center console today. Open a support conversation describing your operational issue and let the agent investigate autonomously.

Related information

• About AWS DevOps Agent

• AWS DevOps Agent workshop

About the authors

Tipu Qureshi is a Senior Principal Technologist in AWS Agentic AI, focusing on operational excellence and incident response automation. He works with AWS customers to design resilient, observable cloud applications and autonomous operational systems.

Bhavani Kanneganti is a Principal Engineer at Support, with deep expertise in infrastructure-as-code and container orchestration services including AWS CloudFormation, Amazon Elastic Container Service (Amazon ECS), and EKS. She focuses on integrating AI-enhanced agents into support workflows to accelerate incident resolution and enhance the customer experience.