Blog Posts

AI Can Find the Causes of an AWS Incident Faster. Can Your Team Tell If They’re Right?

• Executive brief

• The thesis: AWS now applies AI across the incident pipeline, from spotting an anomaly to proposing a root cause. The tools are changing faster than the problems they solve, so invest in what carries across them. 
• The stakes: Amazon DevOps Guru, AWS's machine-learning operations service since 2021, closed to new customers on October 29, 2026, and shuts down on September 30, 2027.
• The key evidence: AWS reports that DevOps Agent customers in preview saw up to 75% lower mean time to resolution. The Western Governors University reported resolution time falling from an estimated two hours to 28 minutes.
• The caveat: Both figures are AWS-published. The same preview claim cites 94% root-cause accuracy, which, if it means correct calls, leaves about one wrong call in 17.
• The recommendation: Adopt AI investigation but judge it by how quickly your team can verify its answers. Our reading is that four practices carry across tools: OpenTelemetry instrumentation, shared trace context, versioned runbooks, and a test set of past incidents.

On October 29, 2026, DevOps Guru, an AWS service built to find the causes of application problems, stopped taking new customers. Amazon DevOps Guru reached general availability in May 2021, promising machine learning that spots unusual behavior and suggests fixes. AWS now tells customers to move anomaly detection to Amazon CloudWatch and AI-assisted investigation to its newer DevOps Agent. This retirement is not a failure story but a signal about pace. In about five years, AWS's answer to "why is this broken?" has moved from one machine-learning service to a set of generative AI assistants, and at least one of those has already changed its name. 

Our reading of AWS's documentation is that the capability is real and maturing, but specific tooling is the least durable part of it. The parts that last are the signals that AI reads and the people who check its conclusions.

• AWS Now Applies AI Across the Incident Pipeline.

We divide an incident into six stages. The division is our framing, not AWS’s. AWS now offers machine learning or generative AI for most of them, while people still own the last two.

• Detecting Anomalies

CloudWatch anomaly detection models a metric's expected range from up to two weeks of history, including hourly, daily, and weekly patterns, and flags values outside a band. For logs, a CloudWatch Logs anomaly detector trains on two weeks of a log group's events and then watches for new ones; AWS says creating one "doesn't incur charges." Engineers can also run anomaly detection on demand inside a Logs Insights query.

• Correlating Alerts

Composite alarms reduce alarm noise by taking actions only at an aggregated level.

• Investigating and Forming Hypotheses

CloudWatch Investigations, available since June 2025, surfaces related metrics, logs, and deployment events, proposes root-cause hypotheses, and suggests remediation steps such as Systems Manager runbooks. AWS describes it as available "at no additional cost," with a limit of 150 AI-enhanced investigations per account each month; some underlying API calls can still appear on the bill. AWS DevOps Agent, generally available since March 31, 2026, starts investigating when an alert or ticket arrives and works with AWS CloudWatch & third-party tools including Datadog, Dynatrace, Splunk and PagerDuty.

• Verifying

In CloudWatch investigations, the engineer decides whether to accept or discard each suggestion.

• Remediating under Control

A systems manager runbook’s approval step “temporarily pauses an automation until designated principals either approve or reject that action.” A rejected hypothesis sends the incident back to investigation.

For a CFO, the costs differ sharply. Log anomaly detectors and CloudWatch investigations (within its limits) add little or no charge, while DevOps Agent is billed per second of agent work at about $30 per agent-hour, with no charge while idle and monthly credits worth 30% to 100% of an AWS Support bill, depending on the plan; queries the agent runs in other AWS services, such as CloudWatch Logs Insights, are billed separately.

• Feature and Service Names are Changing Faster than the Problems.

 The product history is worth the CIO’s attention.

The feature now called CloudWatch investigations was first previewed as "Amazon Q Developer operational investigations." In April 2026, AWS announced that Amazon Q Developer's IDE plugins and paid subscriptions will reach end of support on April 30, 2027, while Q Developer inside the AWS console continues. DevOps Guru's shutdown leaves its existing customers about 11 months to move. AWS’s guidance is to move anomaly detection to CloudWatch, move investigation to DevOps Agent, and export past insights first: after September 30, 2027, they “will no longer be retrievable.”

AWS's own migration advice points to what carries over. It routes DevOps Guru's anomaly detection to CloudWatch, and its investigation role to an agent that reads CloudWatch alongside other vendors' tools. Our reading is that an incident program anchored to one product name inherits that product’s lifespan, while the CloudWatch data and alarms a team has built stay in place. The tool on top is the part that gets replaced.

That shifts the question from which AI tool to choose to whether your signals, runbooks, and past incidents are good enough for any of them.

• The Early Numbers Are Strong, and They Come from AWS.

AWS's announcement of DevOps Agent's general availability carries the clearest results so far. Western Governors University reported a resolution time cut from "an estimated two hours to just 28 minutes," a 77% improvement. Across the preview, AWS says customers and partners reported up to 75% lower mean time to resolution and 94% root-cause accuracy.

Read those figures as what they are: self-reported results from early adopters, published by the vendor. The announcement gives no sample size and no definition of how accuracy was measured. We found no independent evaluation of DevOps Agent as of November 2026; AWS itself recommends that customers “evaluate investigation accuracy on their own incidents.

The accuracy figure deserves a second look.

If 94% means that share of root-cause calls was right, about one in 17 was wrong. AWS’s service card sets a separate, internal measure: a target of “at least 95%” root-cause accuracy on a single attempt (Pass@1). It says the release criteria were met but does not publish results. For a team that acts on the agent’s conclusion without checking it, the error rate is the number that matters.

• The Strongest Objection: Faster Answers are NOT the SAME as the Right Answers.

A skeptical CISO will say that an AI proposing root causes and fixes in production adds risk. Practitioners also want to see the reasoning. In observability vendor Grafana Labs' 2026 survey of 1,363 practitioners and technology leaders, 95% said it matters that AI tools explain their reasoning, and 15% said they do not yet trust AI to act on their behalf. And AWS's own design partly agrees that it leaves stages 5 and 6 to humans.

In CloudWatch investigations, the engineer decides whether to accept or discard each suggestion. DevOps Agent’s service card says the agent ‘is not designed to autonomously execute remediation steps that modify production infrastructure without human review and approval.’ An October 2026 AWS example that adds automated remediation makes the same choice, and changes wait for a person: "The human approval gate is the security control."

So, the objection does not argue against the tools. It changes how to measure them. The service card says the agent ‘does not provide a confidence score for its outputs’ and that findings must be judged by people, for example, ‘by reviewing the cited evidence and validating findings before taking remediation actions.’ Our reading is that the useful metric is not how fast the AI produces an answer but how fast a qualified engineer can confirm or reject it.

• Invest in What Outlasts the tool.

Four practices survive a change of tool, in our reading. Each has its own source.

• OpenTelemetry instrumentation:  AWS is retiring its X-Ray SDKs and daemon, with support ending February 25, 2027, and recommends OpenTelemetry, “the industry-wide open-source standard for tracing instrumentation” (AWS Blog). CloudWatch has OTPL endpoints for logs, metrics, and traces.
• Shard trace context: W3C Trace Context, a W3C Recommendation since November 2021, standardizes how request context passes between services, and OpenTelemetry uses it by default (context propagation). Its problem statement says traces from different vendors can’t be correlated when each passes context in its own way.
• Versioned runbooks: AWS Well-architected (OPS07-BP03) says runbooks start as “a step-by-step text document,” are “stored in a central location (version control system),” and are automated over time.
• A test set of incidents: The service card recommends that customers “evaluate investigation accuracy on their own incidents across a representative sample of their workload before relying on the agent for critical production use cases.”

Before committing budget to AI-assisted investigation on AWS, ask the operations team four questions:

• Signals: Do critical services send OpenTelemetry data? And are all services involved in an incident covered by the agent’s AgentSpace, with an IAM role that lets the agent read them?
  
  AWS defines an Agent Space as a logical container and dedicated workspace that establishes the boundaries of what an AI agent, like the AWS DevOps Agent, can access, connect to, and investigate during operations and assessments. The service card warns that resources outside the agent’s Agent Space, or not readable by its IAM role, are not visible to it and may result in incomplete or incorrect root cause analysis.

• Verification: For the last few incidents, could an engineer have confirmed or rejected an AI's root cause from the evidence it showed? 

• Control: Which actions may an agent take without a person's approval, and who set that line?
  
  
• Portability: If the tool we choose is renamed or retired, what do we keep?

Three things could change this argument: independent measurements of these agents' accuracy, changes to DevOps Agent pricing, and further consolidation of AWS's operations tools.

Each leader can take one question into the next meeting:

• CIO: Which of our incident processes would survive a change of AI tool unchanged?
• CFO: What does an hour of agent time cost us against an hour of engineer time, after Support credits?
• CISO: Who approves an AI-proposed change in production, and is that recorded?

The AI tool you pick this year may not be the one you run in 2028. Build the signals, runbooks, and judgment that any of them will need.

If your team needs AWS operations specialists to strengthen those foundations, ITPN can help you find them.