AWS Bedrock Agent

L2 triage copilot for support engineers: ingests incident evidence bundles and returns hypotheses, checks, and escalation-ready notes, not a general chat assistant.

Part of the Ops Support Demo portfolio.

Overview

A structured triage copilot that consumes incident evidence bundles and returns ranked hypotheses, recommended checks, and escalation documentation. Designed for support engineers who need AI assistance grounded in actual incident data, not open-ended conversation.

Features

• Structured Triage: POST /triage accepts an incident evidence bundle; returns JSON with hypotheses, checks, and escalation readiness.
• MCP Server: the same triage logic is exposed as an MCP tool at /mcp, so any MCP-aware client (n8n, a custom agent, etc.) can call it directly. See MCP Server docs.
• Mock Mode: BEDROCK_MOCK=true returns deterministic canned responses that work offline with no AWS credentials.
• Live Bedrock Mode: BEDROCK_MOCK=false invokes Amazon Bedrock Runtime with validated structured output.

Documentation

• Architecture - system boundaries, request flow, modes, and known limits
• MCP Server - the /mcp tool surface, transport, and how to connect a client
• n8n Workflow - webhook → triage → Slack automation, ready to import
• Operations Runbook - health checks, local/Render operations, failures, and rollback
• Security Notes - data handling, access controls, model output safety, and review checklist
• Portfolio Review Guide - suggested reviewer path, tradeoffs, and discussion topics

Quickstart

# Install runtime dependencies
pip install -r requirements.txt

# Start with mock mode (no AWS needed)
BEDROCK_MOCK=true python assistant.py

API

POST /triage

Request: incident evidence bundle

{
  "incident_id": "INC-001",
  "summary": "Auth cascade after token rotation",
  "timeline": [
    { "ts": "2025-01-15T10:00:00Z", "event": "...", "trace_id": "tx-001" }
  ],
  "log_lines": [
    { "level": "error", "message": "...", "trace_id": "tx-001" }
  ],
  "request_samples": [
    { "method": "GET", "path": "/api/v1/data", "status": 403 }
  ],
  "related_endpoints": ["/login", "/api/v1/data"]
}

Response: structured triage output

{
  "incident_id": "INC-001",
  "hypotheses": [
    {
      "rank": 1,
      "hypothesis": "Token rotation invalidated active sessions without grace period",
      "confidence": "high",
      "evidence_ids": ["tx-001"],
      "check_command": "curl -s -H 'Authorization: Bearer <old_token>' http://localhost:8000/api/v1/data"
    }
  ],
  "recommended_checks": [
    "Verify token expiry on /login response",
    "Check if /api/v1/data accepts the new token format"
  ],
  "escalation_ready": true,
  "customer_comms_draft": "We identified an authentication failure caused by a token rotation that invalidated active sessions. Engineering is reviewing the rollout sequence."
}

Environment Variables

Note: CORS is pre-configured to accept requests from http://localhost:8080 and http://127.0.0.1:8080 (the debug console). For production, set CORS_ORIGINS to the deployed browser origin. /mcp has its own separate Host/Origin allowlist. See docs/MCP_SERVER.md.

Endpoints

Deployment

Live Demo (Render)

curl https://aws-bedrock-ops-agent.onrender.com/health
curl -X POST https://aws-bedrock-ops-agent.onrender.com/triage \
  -H "Content-Type: application/json" \
  -d '{"incident_id":"INC-001","summary":"Auth cascade after token rotation","timeline":[],"log_lines":[],"request_samples":[],"related_endpoints":[]}'

The live demo runs on Render's free tier with BEDROCK_MOCK=true. No AWS credentials needed.

Local (Mock)

BEDROCK_MOCK=true python assistant.py

CORS

The FastAPI app includes pre-configured CORSMiddleware allowing http://localhost:8080 and http://127.0.0.1:8080 (the debug console). Set CORS_ORIGINS when deploying under a custom domain.

Development

pip install -r requirements-dev.txt
ruff check .
pytest

Security

Use least-privilege AWS credentials for live Bedrock mode. Keep the public demo in mock mode unless authentication, rate limiting, and stricter observability are added.

Related

• n8n-workflow-as-code: n8n workflows that call this repo's /mcp tool over live JSON-RPC
• postman-tse-incident-lab: reproducible API incidents that produce the kind of evidence /triage consumes
• incident-postmortems: where the escalation notes end up as written RCAs

License

MIT