Can AWS DevOps Agent autonomously create a fix branch and raise a GitHub PR after RCA without a separate Lambda?

By design, AWS DevOps Agent cannot autonomously execute GitHub write operations (such as creating a branch or opening a PR) as part of a taskType=INVESTIGATION backlog task.

This is an intentional safety boundary. Autonomous incident response tasks are strictly restricted to read-only tool access to prevent unintended infrastructure mutations or code changes during the root cause analysis phase.

To directly address your specific questions:

1. Are write tools intentionally restricted to interactive chat sessions only? Yes. Even if your GitHub App is configured with Read & Write permissions and your create_backlog_task prompt explicitly requests a PR, the DevOps Agent backend enforces read-only access during INVESTIGATION tasks. Write operations require a human-in-the-loop and can only be invoked through interactive chat sessions, custom agents, or explicit remediation proposals.

2. Which specific GitHub MCP Server tools need to be allowlisted? Because the restriction is enforced server-side at the taskType level for investigations, allowlisting tools like create_branch or create_pull_request will not bypass the constraint for an autonomous RCA task. (Note: The GitHub App write permissions you configure during registration are primarily used for interactive chat remediation and release readiness code reviews).

3. Is there a native post-investigation hook or a different taskType? AWS DevOps Agent currently supports INVESTIGATION, EVALUATION, RELEASE_READINESS_REVIEW, and RELEASE_TESTING. There is no native REMEDIATION task type or built-in auto-approve hook that seamlessly transitions an autonomous investigation into an autonomous code commit.

Recommended Architecture Optimization While you cannot currently achieve an end-to-end RCA and PR creation in a single create_backlog_task, you can significantly streamline your 3-Lambda architecture by eliminating the polling phase (rca-generator).

AWS DevOps Agent natively emits state change events to Amazon EventBridge. You can collapse your workflow into a clean, 2-Lambda event-driven pattern:

Trigger Lambda: Triggered by CodePipeline failure → Calls create_backlog_task (taskType=INVESTIGATION).

EventBridge Rule: Listens for the investigation to finish on the default event bus.

JSON { "source": ["aws.aidevops"], "detail-type": ["Investigation Completed"] }

PR Automation Lambda: EventBridge triggers this Lambda natively as soon as the investigation finishes. This Lambda extracts the RCA context from the event payload and programmatically starts the interactive chat session to execute the GitHub MCP write tools.

This approach respects the agent's built-in safety boundaries while removing the ~90-second polling overhead and the complexity of your rca-generator Lambda.