How AWS DevOps Agent is architected, and what it means to restructure a managed-services NOC around it instead of around headcount.
An SRE responding to a page must manually correlate telemetry from multiple sources, trace dependencies across services, and form a hypothesis — a process that routinely takes hours even for a strong engineer. AWS DevOps Agent, generally available since March 2026 and built on Amazon Bedrock AgentCore, is AWS’s attempt to compress that process into minutes by running as an autonomous operational teammate rather than a query tool.
1. How It’s Architected
DevOps Agent ingests signal from wherever a team’s operational data actually lives: CloudWatch alarms, PagerDuty and ServiceNow tickets, Dynatrace problems, and — critically for a partner running a hybrid or multi-tool estate — built-in integrations with Datadog, Splunk, New Relic, Grafana, GitHub, GitLab, and Azure DevOps. It learns application relationships over time rather than requiring them to be hand-mapped, and correlates telemetry, code, and deployment data to form a root-cause hypothesis before a human has opened a dashboard.
When an incident triggers via any configured webhook, the agent begins investigating immediately, without a human prompting it. If the investigation resolves cleanly, it can act through SSM Automation on reversible operations — scale out, restart, toggle a feature flag. If it hits genuine ambiguity, it surfaces a disambiguation card to the on-call engineer rather than guessing, and the investigation resumes once a human responds. Since June 2026 this runs through Model Context Protocol (MCP) and Agent-to-Agent (A2A) support, letting DevOps Agent call external tools and orchestrate with other agents — including, notably, calling AWS Security Agent or FinOps Agent as sub-investigators when an incident’s root cause turns out to be a security or cost event rather than a pure availability one.
{
"investigation_id": "inv-2026-06-1147",
"root_cause_confidence": 0.93,
"decision": "act",
"action": {
"runbook": "ssm-automation:scale-out-service",
"target": "svc-checkout-prod",
"reversible": true,
"requires_approval": false
},
"iam_scope": ["ssm:StartAutomationExecution"],
"blast_radius": "single service, single environment"
}Below a confidence threshold, or for any action tagged requires_approval: true (scaling in, terminating a resource, rolling back a deployment), the agent stops and emits a disambiguation card instead of guessing — the investigation state persists so the human’s answer resumes it rather than restarting it. That threshold, and the IAM policy scoping which actions the agent’s execution role can even call, is the actual governance surface a partner configures per client — not a setting exposed once and forgotten.
2. What GA Added Since Preview
The preview version (re:Invent 2025) worked AWS-native environments. General availability added the ability to investigate applications running in Azure and on-premises environments, custom agent skills so a team can extend the agent with its own institutional knowledge, custom charts and reports, and updated IAM managed policies for tighter permission scoping. June 2026 layered on custom SRE agents (encoding a specific team’s runbooks and failure modes), webhook-triggered invocation from any external system, and static IP support for outbound calls — the detail that lets the agent integrate with an on-premises ITSM platform sitting behind an IP allowlist.
3. Productizing the Practice
DevOps Agent bills on cumulative agent task time, billed per second — a fundamentally different cost shape from a headcount-based NOC. That opens a pricing conversation most MSPs have wanted to have for years but couldn’t justify: moving clients off time-and-materials support retainers onto outcome-based SLA pricing, where the fee is tied to measured MTTR rather than hours staffed. AWS reported preview customers seeing up to 75% lower MTTR and 94% root-cause accuracy — treat that as a starting negotiating anchor, not a guarantee, and instrument your own baseline against your own incident history before quoting it to a client.
Enterprise — custom SRE agents encoding the client’s specific architecture and runbooks, full MCP integration with their existing Datadog/Splunk investment rather than requiring migration to CloudWatch.
SMB — a standardized agent configuration across CloudWatch and a small set of common integrations, sold as a flat monthly NOC replacement.
DNB — webhook-driven, API-first: the client’s own engineering team owns the pager, and the agent runs as an investigation accelerant rather than a full NOC replacement, priced per incident investigated.
What changes for the SI partner
The billable unit stops being a shift and becomes an investigation. That is a harder number to pad and a more attractive one to a client comparing your quote against a traditional MSP’s staffing-based rate card — which is exactly why this is worth leading with in new-logo conversations rather than only offering it to existing accounts.
Business Value Mapping
| Technical capability | Business outcome | Metric / KPI | Primary stakeholder |
|---|---|---|---|
| Autonomous investigation on webhook trigger | Investigation starts in seconds, not after an engineer picks up a page | Time-to-first-hypothesis | VP Engineering / Ops |
| Cross-tool correlation (CloudWatch, Datadog, Splunk, GitHub) | No migration required to unlock the agent on an existing toolchain | Integration time for net-new client | IT/Ops director |
| Reversible-action automation via SSM | Common incidents resolved without waking an engineer | % of incidents auto-remediated | On-call SRE lead |
| Disambiguation card on low-confidence findings | No false-confidence automated actions on ambiguous incidents | False-action rate | CTO / risk owner |
| Per-second consumption billing | NOC cost tracks incident volume, not fixed headcount | Cost per investigation vs. cost per staffed hour | CFO |
| MCP/A2A handoff to Security or FinOps Agent | Root cause resolved even when it crosses domain boundaries | % of incidents correctly routed cross-domain | Head of Managed Services |
A NOC staffed by people bills for time spent looking. A NOC run on an investigation agent bills for answers found — and that difference is the entire pitch.
Sources: Announcing general availability of AWS DevOps Agent (AWS Cloud Operations Blog) · AWS Announces General Availability of DevOps Agent (InfoQ, April 2026) · This Month in AWS Observability: June 2026 (custom SRE agents, MCP/A2A, webhook triggers) · Leverage agentic AI for autonomous incident response with AWS DevOps Agent (AWS DevOps Blog).
