AWS DevOps Agent helps administrators inspect logs, review firewall rules and network paths, identify configuration changes that caused AWS Network Firewall to block traffic, and restore connectivity.
The service is an AI-powered operations assistant for DevOps and SRE teams that investigates and troubleshoots application and infrastructure issues. It connects to monitoring tools, logs, code repositories, and deployment pipelines, analyses incidents, pinpoints likely root causes, and recommends fixes or preventive improvements. It works across AWS, multicloud, and on-premises environments.
For AWS Network Firewall investigations, the agent reads firewall logs, VPC Flow Logs, route tables, firewall policies, and recent AWS CloudTrail events through AWS APIs to identify the root cause and present a mitigation plan for review.
The sample workload (Source: AWS)
Network Firewall troubleshooting scenarios
AWS provides three examples of how DevOps Agent troubleshoots common AWS Network Firewall connectivity issues: a domain deny list, a stateless rule priority issue, and asymmetric cross-Availability Zone routing. In each scenario, the agent identifies the root cause and recommends a fix. The examples demonstrate two methods for detecting firewall issues, built-in Network Firewall metrics and application health metrics, both using the same alerting pipeline.
How the alerting pipeline works
Each scenario follows the same workflow. When a CloudWatch alarm enters the ALARM state, it sends a notification to an Amazon SNS topic. Amazon SNS invokes an AWS Lambda function, which retrieves the webhook URL and signing secret from AWS Secrets Manager, signs the alarm payload, and sends it to the DevOps Agent webhook. The agent then analyses the collected data to determine the cause of the connectivity issue. Amazon SNS also manages message retries, fan-out to multiple subscribers, and cross-account message delivery.
Deployment insights and recommendations
“You can also give the agent more to work with. DevOps Agent connects to source repositories and CI/CD pipelines, integrating with GitHub, including GitHub Enterprise Server, and GitLab Self-Managed through a private connection. It can associate AWS resources with deployments of AWS CloudFormation, AWS CDK, Amazon Elastic Container Registry (Amazon ECR) images, and Terraform,” Salman Ahmed, Senior Technical Account Manager at AWS, explained.
Using the deployed configuration and recent deployment events, the agent correlates the disruption with the change that introduced it and recommends a fix that matches the intended design.
The DevOps Agent can also help prevent future incidents. It analyses previous investigations and recommends improvements to reduce recurring issues, such as adding guardrails to CI/CD pipelines for Network Firewall rule changes. These recommendations are available on the Improvements page in the DevOps Agent Operator web application.