AWS has published a reference workflow that turns DevOps Agent investigation summaries into proposed production fixes without allowing the diagnostic agent to change resources directly. The design keeps DevOps Agent in observe-and-report mode, then passes its root-cause analysis and recommendations to a separate remediation process.
Amazon EventBridge starts the workflow, Bedrock helps interpret the investigation, and Lambda Durable Functions coordinates long-running steps. The proposed change is validated and presented to an on-call engineer for a single approval action before execution. Durable Functions can keep a multi-step process running for up to a year, which avoids maintaining a separate workflow service.
The separation is the main safety feature: the component diagnosing an incident does not automatically gain permission to modify production. Human approval remains a control point after the system has assembled a fix. This is an AWS implementation guide, not measured evidence that every team will reduce recovery time, and organizations still need their own validation, access policies and rollback plans. It provides a concrete pattern for automating repetitive incident work while avoiding fully autonomous remediation of critical systems.