How DevOps Agent handle incident resolution across multiple AWS accounts

AWS DevOps Agent is a standalone AWS service (announced in preview at re:Invent 2025, GA March 31, 2026), built on Amazon Bedrock AgentCore. Critically, it natively supports multi-account investigation — it is designed to correlate signals across multiple AWS accounts in an organization, not just the single account where it's configured.

Multi-Account Investigation (Native):

The agent is organized around an Agent Space bound to a primary AWS account (where the Agent Space is created). To investigate across accounts, you associate secondary AWS accounts, which gives the agent visibility into resources in those accounts during an investigation. This is a built-in capability, configured via IAM roles rather than an external workaround.

IAM Model:

Primary account role — When you create the Agent Space, you set up an IAM role granting it access to discover and describe resources in the primary account. *Cross-account IAM roles in secondary accounts *— For each secondary (source) account, deploy a cross-account IAM role (the CDK/Terraform getting-started paths automate this). Its trust policy allows the Agent Space to assume it. Monitoring vs. operator roles — The agent distinguishes read-only monitoring roles (discover/describe resources during investigation) from operator roles (used to take actions). Scope each with least privilege.

Guardrails— Use permission boundaries and SCPs to constrain what the agent can do in production accounts (e.g., allow reboot, deny terminate). Centralized Telemetry (Complementary):

CloudWatch cross-account observability (a monitoring account linked to source accounts via OAM sinks/links) centralizes metrics, logs, and traces. CloudWatch Investigations can correlate telemetry across up to 25 accounts plus the monitoring account, and requires cross-account observability as a prerequisite. This complements the DevOps Agent's investigation but is a separate mechanism from the agent's own primary/secondary account associations.

Enterprise Pattern:

Primary/Agent Space account: Where the Agent Space runs and investigations are coordinated. Secondary/workload accounts: Associated to the Agent Space with scoped cross-account roles so the agent can investigate resource-level detail and pull logs.

The agent learns application relationships as part of its investigations, so it is not purely stateless per session. Cross-account access is not auto-discovered from AWS Organizations; secondary accounts and their cross-account roles must be provisioned (via console, CDK, or Terraform).

AWS DevOps Agent as a native multi-account incident investigator backed by centralized CloudWatch telemetry. For automated remediation, gate it behind least-privilege operator roles and human/change-management approval.