This project demonstrates a **AI-powered AWS operations platform** that transforms how DevOps teams interact with AWS infrastructure. By combining **Amazon Bedrock's Claude 3.7 Sonnet**, **Model Context Protocol (MCP)**, and **serverless architecture**, users can perform complex AWS operations through natural language conversations.
### **Real-World Use Cases**
**🔍 Infrastructure Discovery & Monitoring**
- "Show me all EC2 instances that haven't been accessed in 30 days"
- "Which RDS databases are consuming the most storage?"
- "List all Lambda functions with error rates above 5%"
- "Find S3 buckets with public read access"
**💰 Cost Optimization & Analysis**
- "What are my top 10 most expensive AWS services this month?"
- "Show me unused EBS volumes across all regions"
- "Which CloudFormation stacks are costing more than $100/month?"
- "Find EC2 instances running 24/7 that could be scheduled"
**🔐 Security & Compliance Auditing**
- "List all IAM users with admin privileges"
- "Show me security groups with unrestricted inbound access"
- "Which resources don't have required tags?"
- "Find VPCs without flow logs enabled"
**⚡ Operational Troubleshooting**
- "Why is my application load balancer showing 5xx errors?"
- "Show me CloudWatch alarms that fired in the last 24 hours"
- "Which Lambda functions are hitting timeout limits?"
- "Find auto-scaling groups that scaled recently"
### **What You'll Learn**
**🏗️ Advanced Serverless Architecture**
- **Multi-Lambda orchestration** with Function URLs and Docker containers
- **Cross-service authentication** using AWS SigV4 and Okta JWT tokens
- **Production-grade deployment** with SAM templates and infrastructure as code
- **Container optimization** for Lambda with platform-specific Docker builds
**🤖 AI Agent Development**
- **Model Context Protocol (MCP)** implementation for tool integration
- **Conversational AI patterns** with streaming responses and memory persistence
- **Natural language to API translation** using Claude 3.7 Sonnet
- **Agent orchestration** with the Strands framework for complex workflows
**🔐 Enterprise Authentication & Security**
- **Dual authentication patterns** combining AWS IAM and external OAuth2
- **Production security practices** with least-privilege IAM roles
- **Token management** and secure credential handling
- **API gateway alternatives** using Lambda Function URLs
**☁️ AWS Operations at Scale**
- **20+ AWS service integrations** including EC2, S3, RDS, CloudWatch, IAM
- **Cross-region resource management** with unified interfaces
- **Real-time monitoring** and alerting through conversational queries
- **Infrastructure automation** through natural language commands
**🛠️ DevOps & Platform Engineering**
- **GitOps workflows** with automated deployment pipelines
- **Observability patterns** using CloudWatch, DynamoDB, and structured logging
- **Error handling** and resilience patterns in distributed systems
- **Performance optimization** for serverless applications
### **Technical Innovation Highlights**
**🔄 Production-Ready Patterns**
- **Conversation persistence** with DynamoDB for stateful interactions
- **Streaming responses** for real-time user experience
- **Reduce operational overhead** by 60% through natural language interfaces
- **Accelerate troubleshooting** with AI-powered root cause analysis
- **Improve security posture** through automated compliance checking
- **Enable self-service operations** for development teams
A complete Bedrock AgentCore Gateway MCP (Model Context Protocol) solution enabling natural language AWS operations through AWS Operations Agent interface with Function URL deployment and DynamoDB conversation persistence.
## 🏗️ Architecture Overview
This project implements a **serverless AI-powered AWS operations platform** using a multi-Lambda architecture with dual authentication. The flow begins with a **Client App** that authenticates via AWS SigV4 to invoke the **AWS Operations Agent Lambda** through a Function URL. The Agent Lambda, built with FastAPI and the Strands framework, manages conversations in DynamoDB and communicates with the **Bedrock AgentCore Gateway** using MCP (Model Context Protocol) and Okta JWT authentication. The Gateway then invokes the **MCP Tool Lambda** (Docker-based) which provides 20 AWS service tools for operations like EC2 management, S3 operations, CloudWatch monitoring, and more. This architecture eliminates API Gateway complexity while providing enterprise-grade security and scalability.
This agent is currently configured for **read-only AWS operations** as a security best practice. All 20 AWS service tools are designed to query and retrieve information without making changes to your infrastructure.
**Current Capabilities:**
- ✅ List and describe AWS resources (EC2, S3, RDS, etc.)
- ✅ Query CloudWatch metrics and logs
- ✅ Analyze costs and billing information
- ✅ Audit security configurations and compliance
- ✅ Monitor infrastructure health and performance
### **Enabling Write Operations**
To enable write operations (create, update, delete resources), you need to make two key changes:
#### **1. Update MCP Tool Lambda Permissions**
```bash
# Edit the IAM role for the MCP Tool Lambda
# Current: ReadOnlyAccess policy
# Add: Specific write permissions for required services
# In agent-lambda/src/main.py, modify the system prompt:
# Current: "You are a read-only AWS operations assistant..."
# Update to: "You are an AWS operations assistant with read and write capabilities..."
# Example system prompt update:
SYSTEM_PROMPT = """
You are an AWS operations assistant with comprehensive read and write capabilities.
You can query AWS resources AND make changes when explicitly requested.
Always confirm destructive operations before executing.
Use appropriate AWS tools for both read and write operations.
"""
```
#### **3. Security Considerations for Write Operations**
- **Implement confirmation prompts** for destructive operations
- **Use resource tagging** to identify managed vs. unmanaged resources
- **Enable CloudTrail logging** for audit trails of all changes
- **Consider approval workflows** for high-impact operations
- **Test in non-production environments** first
**⚠️ Warning**: Write operations can modify or delete AWS resources. Always test thoroughly and implement appropriate safeguards before enabling in production environments.
