AWS Cloud Operations Blog

Category: Management Tools

Bring AWS Security Hub CSPM findings into your Amazon CloudWatch

Bring AWS Security Hub CSPM findings into your Amazon CloudWatch on-call workflow

At 2:47 AM, an on-call engineer gets paged: CPU on a production Amazon EC2 instance has been above 95% for five minutes. They open Amazon CloudWatch and run the usual triage, checking recent deployments, traffic spikes, memory, and disk I/O. Nothing lines up. They scale the instance; utilization climbs back within minutes. Thirty-two minutes later, […]

Profile your Amazon CloudWatch Logs estate with an AWS DevOps Agent skill in sandbox, no infrastructure to deploy.

A zero-infrastructure  AWS DevOps Agent skill profiles your Amazon CloudWatch Logs estate and gives you one view of it. CloudWatch Logs already captures the signals you need to operate it well, including how each log group is classed, how long it is kept, who reads it, where its data flows, and how fast it grows. […]

Find your logging gaps before they become compliance gaps with CloudTrail Data Event Coverage

AWS CloudTrail now includes a Data event coverage page in the AWS CloudTrail console, giving you a single view of how well your resources are covered by data event logging. CloudTrail records API activity across your AWS account for security auditing, compliance, and operational troubleshooting. Management events, the control-plane actions such as creating a bucket […]

Tag Editor moves to AWS Resource Explorer: bulk-tag resources across Regions

Tag Editor moves to AWS Resource Explorer: bulk-tag resources across Regions

Starting today, you can manage resource tags in bulk in the AWS Resource Explorer console, and requests to Tag Editor console will redirect to Resource Explorer automatically. This post shows how each Tag Editor task works in Resource Explorer and where the steps differ. Benefits of tagging resources in Resource Explorer. Finding resources and tagging […]

Embracing Observability for the AI era at re:Invent 2026

As organizations continue to scale their cloud presence and bring AI agents into production, effective operations become increasingly critical for success. The AWS re:Invent 2026 Cloud Operations track brings together industry experts, AWS leaders, and customers to share how they modernize monitoring and observability for applications and the AI agents now running alongside them. This […]

Controlled self-healing Amazon EKS Clusters with AWS DevOps Agent and A2A remote agents

1. Introduction A pod on your Amazon Elastic Kubernetes Service (Amazon EKS) cluster is restarting on a memory limit. An automated agent spots it, doubles the memory, and syncs the application. On a quiet afternoon that is a tidy self healing story. During a release window, or on a service that is mid rollout, the […]

AI-powered anomaly detection for AWS Systems Manager Session Manager logs using Amazon Bedrock

When an operations engineer or developer starts an AWS Systems Manager Session Manager session on a managed node, every command they run is captured as a transcript. Any one of those commands is either routine work or the first sign of a security incident. At scale, with hundreds of nodes generating thousands of command entries […]

Control investigation costs before they start with AWS DevOps Agent

Introduction Before an AWS DevOps Agent investigation runs its first billable query, you can see what it will cost and decide whether to proceed. The Investigation Cost Guardrail skill brings cost awareness to AWS DevOps Agent, giving your team visibility and control over scope before the investigation begins. This post introduces the Investigation Cost Guardrail, […]

Share Systems Manager documents across your AWS Organization with AWS RAM

Introduction If you operate AWS Systems Manager (SSM) documents, such as Automation runbooks and Run Command documents, across an AWS Organization, you must decide which accounts can run them. Until now, that meant sharing each document with a list of individual account IDs through the ModifyDocumentPermission API, which accepts up to 1,000 account IDs per […]

Automate RCA across ServiceNow, Dynatrace and Slack with AWS DevOps Agent

If you manage production incidents, you know the drill. A ServiceNow ticket fires at 2 AM. The on-call engineer wakes up, logs in to Dynatrace, pulls traces and metrics across multiple dashboards, cross-references change records, forms a hypothesis, updates the ticket, and posts findings to Slack. The investigation takes one to three hours, and that’s […]