AWS for Industries
How Mary Kay Built Self-Triaging Operations with Amazon Bedrock
Introduction
As one of the world’s largest direct-selling beauty companies, Mary Kay supports millions of Independent Beauty Consultants across 40 markets around the world through a highly connected global digital ecosystem. These platforms power critical business capabilities – from order management and inventory visibility to commission processing and consultant engagement – helping entrepreneurs around the world serve their customers seamlessly.
To continue advancing operational excellence at global scale, Mary Kay’s engineering organization set out to further accelerate how infrastructure events are investigated, triaged, and resolved. Rather than relying solely on traditional operational workflows, the team explored how AI-powered automation could augment engineering expertise, reduce repetitive tasks, and enable teams to focus on higher-value innovation.
Leveraging the AWS DevOps Agent, Mary Kay built a sophisticated intelligent operations framework powered by Amazon Bedrock. By combining automated investigation, AI-driven reasoning, and secure execution capabilities, the company created a system that can progress many routine operational events from detection to remediation in minutes while maintaining visibility, governance, and engineering oversight.
Like many large-scale enterprises, Mary Kay continuously evaluates opportunities to streamline operational activities and maximize engineering productivity. The organization’s cloud teams identified a category of repetitive yet well-understood operational tasks—including infrastructure drift remediation, configuration updates, and deployment-related troubleshooting—that followed established patterns and governance controls.
Rather than dedicating valuable engineering capacity to repetitive remediation work, Mary Kay envisioned an intelligent operational model where AI agents could investigate issues, recommend actions, and execute approved resolutions while engineers remained focused on strategic architecture, platform innovation, and business-enabling initiatives.
As part of its ongoing commitment to operational excellence, Mary Kay sought to further accelerate the investigation and resolution of routine infrastructure events through AI-powered automation and intelligent orchestration by activating a capability most Amazon Web Services (AWS) Enterprise Support customers already pay for but never use: the AWS DevOps Agent. The team wrapped the agent in an AI reasoning layer powered by Amazon Bedrock, with the Strands SDK providing multi-model orchestration and Amazon Bedrock AgentCore enabling secure execution. The result: incidents go from alert to merged pull request in under two minutes, at roughly $1 per resolved action.
How it works: Walking through a real incident
Imagine it’s 2 AM. A scheduled drift sweep detects that a VPC configuration in Mary Kay’s Terraform state has drifted from its expected value. Here is exactly what happens—without a human waking up:
Figure 1 – Mary Kay’s five-stage agentic architecture for autonomous operations
Stage 1: Something triggers the system
The drift alert arrives directly at the AWS DevOps Agent, alongside Datadog alerts, Ivanti tickets, EC2 disk-full warnings, and webhook/A2A integrations. Anything can trigger the agent: any tool, any system, any human-initiated event.
Stage 2: The AWS DevOps Agent investigates
The AWS DevOps Agent picks up the event and gets to work. It connects to Wiz, Datadog, all of Mary Kay’s AWS accounts and Azure subscriptions, GitHub, Azure DevOps, and CATO—pulling logs, checking recent deployments, comparing current state to expected state. When it’s done, it produces what the team calls a “novel of text”: a structured JSON document containing the full investigation, from context and findings to evidence and preliminary recommendations. This is stored in Amazon S3 as a knowledge artifact.
Stage 3: A triage agent decides what to do
The investigation flows through an asynchronous pipeline: Amazon EventBridge routes the output to AWS Lambda, which dispatches it to Amazon SQS (guarding against duplicate work on the same incident), then AWS Step Functions orchestrates the decision. An Amazon Bedrock triage agent reads the investigation and classifies it:
- Terraform drift? → Route to the Terraform-Drift-Agent.
- Terraform build error? → Route to the Terraform-Error-Fixer-Agent, which diagnoses the failure, writes a fix, and opens a PR.
- EC2 disk full or firewall change? → Route to the General-Terraform-Agent, which pulls the appropriate runbook from SharePoint and executes it.
- Business-critical application issue? → Escalate to the app team’s App-Specific-Agent for pull request creation.
- Something genuinely novel? → Escalate to an engineer with the full investigation pre-assembled—no 30-minute context-gathering phase.
Stage 4: Specialized agents do the work
In our drift scenario, the Terraform-Drift-Agent spins up in a private microVM container using Amazon Bedrock AgentCore—isolated, secure, and ephemeral. Built with the Strands SDK, the agent uses Anthropic Claude Sonnet for reasoning and planning (“What changed?” “What’s the correct state?” “What’s the safest fix?”) and Claude Haiku for fast mechanical operations (find-and-replace in the Terraform files). It reasons through the fix, writes the code, tests it, iterates if needed, and opens a pull request in Azure DevOps, all within Mary Kay’s private VPC.
Stage 5: Transparent outputs, every time
The initiative demonstrates how Mary Kay is applying AI to build a more intelligent, scalable operational model. By combining automation, observability, and agentic workflows, the company has accelerated resolution times while increasing operational consistency and freeing engineering teams to focus on innovation that directly supports business growth and consultant success.
Every resolved action produces three things: (1) a pull request with a cost breakdown comment showing the exact model used, tokens consumed, and dollar cost (typically $0.16–$0.50); (2) a Microsoft Teams Completion Card in the “DevOps Agent Actions” channel so the team has real-time visibility; and (3) metrics flowing to Datadog dashboards for tracking cost per PR, success rates, and sprint-over-sprint savings.
Total elapsed time from drift detection to pull request: under two minutes. Total cost: $0.17.
Results
| Metric | Outcome |
|---|---|
| Sprint time recovered | 18–36% of each 2-week sprint redirected from remediation to real engineering |
| Cost per action | ~$0.16–$0.50 per PR; ~$1 blended per resolved action |
| Throughput | 50 automated PRs per 2-week sprint |
| Speed | Alert to merged PR in under 2 minutes |
| Transparency | Per-PR cost receipt on every action; visible in dashboards to all stakeholders |
Getting started
Mary Kay approached agentic operations as a strategic capability rather than a point solution. The team began with a targeted use case, validated operational controls and governance, and then expanded the architecture into a reusable framework capable of supporting multiple operational domains. This phased approach enabled rapid value realization while establishing a foundation for broader enterprise adoption. The pattern is reproducible:
- Activate the AWS DevOps Agent (available with Enterprise Support) and connect your operational tools.
- Build a triage layer with Amazon Bedrock to classify and route investigations.
- Deploy specialized agents in Amazon Bedrock AgentCore using the Strands SDK for cost-transparent, isolated execution.
- Add new agents as patterns emerge. Each one plugs into the same pipeline, the same observability, and the same cost model.
The agents now handle drift, build errors, disk alerts, and firewall changes. The team is expanding to runbook-driven operations and cross-team agent contributions—all running at sprint velocity, with every action’s cost visible to every stakeholder.