Summary

OpsAgent Controller addresses the critical need for efficient, secure, and auditable AWS incident response for platform engineers. It transforms chat interfaces into a serverless Tier-1 Ops assistant, enabling rapid diagnosis and controlled remediation of production incidents, thereby reducing Mean Time To Resolution (MTTR) and operational friction.

How It Works

This serverless system leverages AWS Lambda and API Gateway, integrating with Amazon Bedrock for LLM-powered intent parsing and tool selection. A robust security model includes API key authentication, user allow-listing, resource tagging (OpsAgentManaged=true), and a mandatory explicit approval workflow for all write operations, enforced via time-limited tokens. All actions are meticulously logged to CloudWatch Logs and DynamoDB, providing a complete audit trail.

Quick Start & Requirements

Deployment is managed via Terraform (infrastructure-terraform/). Key prerequisites include Python 3.9+ (local), AWS CLI v2.x, Terraform >= 1.5, and necessary AWS permissions. Bedrock model access is required, with Amazon Nova Pro as the default and Claude models needing a one-time marketplace subscription. Detailed setup and configuration guides are available in QUICK_START.md and CONFIGURATION.md.

Highlighted Details

• Serverless & Chat-Centric: Fully serverless architecture on AWS Lambda, offering interaction via Amazon Q Business, Microsoft Teams, or a web interface.
• LLM-Powered Operations: Utilizes Amazon Bedrock (Nova Pro or Claude) to interpret natural language requests and select appropriate AWS tools for diagnosis and remediation.
• Multi-Layered Security: Enforces API key authentication, user allow-lists, resource tagging (OpsAgentManaged=true), and a strict, time-bound approval process for destructive actions.
• Comprehensive Auditing: Every operation, successful or denied, is logged to CloudWatch Logs and DynamoDB with a unique correlation ID.
• Infrastructure as Code: Supports deployment via Terraform and AWS SAM.

Maintenance & Community

The project is maintained by Olu Oluwafemi (@OluOlus). No specific community channels (e.g., Discord, Slack) or sponsorship details are listed in the README.

Licensing & Compatibility

The project is released under the permissive MIT License, which generally allows for commercial use and integration into closed-source projects without significant restrictions.

Limitations & Caveats

Teams integration requires a Microsoft 365 tenant with Teams enabled; personal Azure accounts without Teams cannot test the bot directly within Teams. Write operations are strictly gated by the OpsAgentManaged=true resource tag, and approval tokens have a 15-minute time-to-live.