[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is getting started with aws devops agent using aws cdk?

[Assistant]
# Getting started with AWS DevOps Agent using AWS CDK

## Overview

This guide walks you through deploying AWS DevOps Agent using the AWS Cloud Development Kit (AWS CDK). The CDK approach provides infrastructure as code benefits including type safety, IDE auto-completion, and the ability to compose higher-level abstractions. By the end of this guide, you will have a fully functional Agent Space with an associated AWS account and operator web app.

## Prerequisites

Before you begin, ensure you have the following:
+ AWS CDK v2 installed (`npm install -g aws-cdk`)
+ Node.js 18.x or later
+ AWS CLI version 2 installed and configured
+ An AWS account with permissions to create IAM roles, CloudFormation stacks, and AWS DevOps Agent resources
+ TypeScript 5.x or later (recommended)
+ A bootstrapped CDK environment (`cdk bootstrap aws://<ACCOUNT_ID>/<REGION>`)

## Resources created

This CDK stack creates the following resources:
+ An AWS DevOps Agent Space
+ An IAM role for the Agent Space with the `AIDevOpsAgentAccessPolicy` managed policy
+ An IAM role for the operator web app with the `AIDevOpsOperatorAppAccessPolicy` managed policy
+ An AWS account association connecting your account to the Agent Space
+ Operator web app configuration with IAM authentication

## Setup

### Clone the repository

```bash
git clone https://github.com/aws-samples/aws-devops-agent-cdk-starter.git
cd aws-devops-agent-cdk-starter
```

### Install dependencies

```bash
npm install
```

### Configure the deployment

Edit `cdk.json` or set context values via the command line:

```json
{
  "context": {
    "agentSpaceName": "MyAgentSpace",
    "agentSpaceDescription": "Agent Space for monitoring my applications",
    "region": "us-east-1"
  }
}
```

## Part 1: Deploy the Agent Space

### Review the CDK stack

The primary stack (`lib/devops-agent-stack.ts`) defines all required resources:

```typescript
import * as cdk from 'aws-cdk-lib';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';

export class DevOpsAgentStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const accountId = cdk.Stack.of(this).account;
    const region = cdk.Stack.of(this).region;

    // Agent Space IAM Role
    const agentSpaceRole = new iam.Role(this, 'AgentSpaceRole', {
      roleName: 'DevOpsAgentRole-AgentSpace',
      assumedBy: new iam.ServicePrincipal('aidevops.amazonaws.com', {
        conditions: {
          StringEquals: {
            'aws:SourceAccount': accountId,
          },
          ArnLike: {
            'aws:SourceArn': `arn:aws:aidevops:${region}:${accountId}:agentspace/*`,
          },
        },
      }),
    });

    agentSpaceRole.addManagedPolicy(
      iam.ManagedPolicy.fromAwsManagedPolicyName('AIDevOpsAgentAccessPolicy')
    );

    // Operator Web App IAM Role
    const operatorRole = new iam.Role(this, 'OperatorAppRole', {
      roleName: 'DevOpsAgentRole-WebappAdmin',
      assumedBy: new iam.ServicePrincipal('aidevops.amazonaws.com', {
        conditions: {
          StringEquals: {
            'aws:SourceAccount': accountId,
          },
          ArnLike: {
            'aws:SourceArn': `arn:aws:aidevops:${region}:${accountId}:agentspace/*`,
          },
        },
      }),
    });

    operatorRole.addManagedPolicy(
      iam.ManagedPolicy.fromAwsManagedPolicyName('AIDevOpsOperatorAppAccessPolicy')
    );

    // Agent Space (Custom Resource)
    const agentSpace = new cdk.CustomResource(this, 'AgentSpace', {
      serviceToken: agentSpaceProviderArn,
      properties: {
        Name: this.node.tryGetContext('agentSpaceName') || 'MyAgentSpace',
        Description: this.node.tryGetContext('agentSpaceDescription') || '',
      },
    });

    // Outputs
    new cdk.CfnOutput(this, 'AgentSpaceId', {
      value: agentSpace.getAttString('AgentSpaceId'),
      description: 'The ID of the created Agent Space',
    });

    new cdk.CfnOutput(this, 'AgentSpaceRoleArn', {
      value: agentSpaceRole.roleArn,
      description: 'ARN of the Agent Space IAM role',
    });

    new cdk.CfnOutput(this, 'OperatorRoleArn', {
      value: operatorRole.roleArn,
      description: 'ARN of the Operator Web App IAM role',
    });
  }
}
```

### Synthesize and deploy

```bash
# Preview the CloudFormation template
cdk synth

# Deploy the stack
cdk deploy --require-approval broadening
```

### Associate your AWS account

After the stack deploys, associate your AWS account with the Agent Space:

```bash
AGENT_SPACE_ID=$(aws cloudformation describe-stacks \
  --stack-name DevOpsAgentStack \
  --query 'Stacks[0].Outputs[?OutputKey==`AgentSpaceId`].OutputValue' \
  --output text \
  --region <REGION>)

aws devops-agent associate-service \
  --agent-space-id $AGENT_SPACE_ID \
  --service-id aws \
  --configuration '{
    "aws": {
      "assumableRoleArn": "arn:aws:iam::'$(aws sts get-caller-identity --query Account --output text)':role/DevOpsAgentRole-AgentSpace",
      "accountId": "'$(aws sts get-caller-identity --query Account --output text)'",
      "accountType": "monitor"
    }
  }' \
  --region <REGION>
```

### Enable the operator app

```bash
aws devops-agent enable-operator-app \
  --agent-space-id $AGENT_SPACE_ID \
  --auth-flow iam \
  --operator-app-role-arn "arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/DevOpsAgentRole-WebappAdmin" \
  --region <REGION>
```

## Part 2: Optional cross-account monitoring

To monitor resources in additional AWS accounts, deploy a cross-account role stack.

### Cross-account role stack

Create `lib/cross-account-stack.ts`:

```typescript
import * as cdk from 'aws-cdk-lib';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';

interface CrossAccountProps extends cdk.StackProps {
  monitoringAccountId: string;
  agentSpaceRegion: string;
}

export class DevOpsAgentCrossAccountStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: CrossAccountProps) {
    super(scope, id, props);

    const crossAccountRole = new iam.Role(this, 'CrossAccountRole', {
      roleName: 'DevOpsAgentCrossAccountRole',
      assumedBy: new iam.ArnPrincipal(
        `arn:aws:iam::${props.monitoringAccountId}:role/DevOpsAgentRole-AgentSpace`
      ),
    });

    crossAccountRole.addManagedPolicy(
      iam.ManagedPolicy.fromAwsManagedPolicyName('AIDevOpsAgentAccessPolicy')
    );

    new cdk.CfnOutput(this, 'CrossAccountRoleArn', {
      value: crossAccountRole.roleArn,
      description: 'ARN of the cross-account role for DevOps Agent',
    });
  }
}
```

### Deploy to the secondary account

```bash
cdk deploy DevOpsAgentCrossAccountStack \
  --context monitoringAccountId=<MONITORING_ACCOUNT_ID> \
  --context agentSpaceRegion=<REGION> \
  --profile <SECONDARY_ACCOUNT_PROFILE>
```

### Associate the secondary account

```bash
aws devops-agent associate-service \
  --agent-space-id <AGENT_SPACE_ID> \
  --service-id aws \
  --configuration '{
    "sourceAws": {
      "accountId": "<EXTERNAL_ACCOUNT_ID>",
      "accountType": "source",
      "assumableRoleArn": "arn:aws:iam::<EXTERNAL_ACCOUNT_ID>:role/DevOpsAgentCrossAccountRole"
    }
  }' \
  --region <REGION>
```

## Troubleshooting

### CDK bootstrap errors

If you encounter "This stack uses assets" errors, ensure your environment is bootstrapped:

```bash
cdk bootstrap aws://<ACCOUNT_ID>/<REGION>
```

### IAM role creation fails

+ Verify your AWS credentials have `iam:CreateRole` and `iam:AttachRolePolicy` permissions
+ Check if a role with the same name already exists: `aws iam get-role --role-name DevOpsAgentRole-AgentSpace`
+ If the role exists from a previous deployment, either delete it or modify the CDK stack to use a different name

### Stack deployment times out

+ CDK deployments typically complete within 5 minutes
+ Check CloudFormation events for specific resource failures: `aws cloudformation describe-stack-events --stack-name DevOpsAgentStack`
+ Ensure you have sufficient IAM permissions for all resources in the stack

### Agent Space creation fails

+ Verify the AWS DevOps Agent service is available in your chosen Region
+ Check that you have not exceeded the maximum number of Agent Spaces for your account
+ Review CloudTrail logs for detailed error messages

## Cleanup

Remove all resources created by this guide:

```bash
# Delete the primary stack
cdk destroy DevOpsAgentStack

# If cross-account stack was deployed
cdk destroy DevOpsAgentCrossAccountStack --profile <SECONDARY_ACCOUNT_PROFILE>
```

Before deleting stacks, you may want to delete the Agent Space association and disable the operator app:

```bash
aws devops-agent delete-agent-space \
  --agent-space-id <AGENT_SPACE_ID> \
  --region <REGION>
```

## Security considerations

+ The Agent Space IAM role grants read-only access to AWS resources for investigation purposes. Review the `AIDevOpsAgentAccessPolicy` to understand which services can be accessed.
+ The operator web app role provides access to the DevOps Agent console. Limit who can assume this role.
+ For production deployments, consider restricting the trust policy conditions to specific Agent Space ARNs rather than using wildcards.
+ Use AWS Organizations Service Control Policies (SCPs) to limit which accounts can create Agent Spaces.
+ Enable AWS CloudTrail logging to audit all DevOps Agent API calls.

## Next steps

+ Add secondary accounts if your applications span multiple AWS accounts
+ Configure third-party integrations like observability tools or ticketing systems
+ Set up AWS Identity Center authentication for production environments
+ Create a test environment to validate the agent's detection capabilities
+ Review DevOps Agent Skills to understand available investigation capabilities


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is getting started with aws devops agent using aws cdk in AWS DevOps Agent?

[Assistant] This guide walks you through deploying AWS DevOps Agent using the AWS Cloud Development Kit (AWS CDK). The CDK approach provides infrastructure as code benefits including type safety, IDE auto-completion, and the ability to compose higher-level abstractions. By the end of this guide, you will have a fully functional Agent Space with an associated AWS account and operator web app.


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Explain getting started with aws devops agent using aws cdk in AWS DevOps Agent.

[Assistant] This guide walks you through deploying AWS DevOps Agent using the AWS Cloud Development Kit (AWS CDK). The CDK approach provides infrastructure as code benefits including type safety, IDE auto-completion, and the ability to compose higher-level abstractions. By the end of this guide, you will have a fully functional Agent Space with an associated AWS account and operator web app.


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is Prerequisites in AWS DevOps Agent?

[Assistant]
Before you begin, ensure you have the following:
+ AWS CDK v2 installed (`npm install -g aws-cdk`)
+ Node.js 18.x or later
+ AWS CLI version 2 installed and configured
+ An AWS account with permissions to create IAM roles, CloudFormation stacks, and AWS DevOps Agent resources
+ TypeScript 5.x or later (recommended)
+ A bootstrapped CDK environment (`cdk bootstrap aws://<ACCOUNT_ID>/<REGION>`)


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about Prerequisites in AWS DevOps Agent.

[Assistant]
Before you begin, ensure you have the following:
+ AWS CDK v2 installed (`npm install -g aws-cdk`)
+ Node.js 18.x or later
+ AWS CLI version 2 installed and configured
+ An AWS account with permissions to create IAM roles, CloudFormation stacks, and AWS DevOps Agent resources
+ TypeScript 5.x or later (recommended)
+ A bootstrapped CDK environment (`cdk bootstrap aws://<ACCOUNT_ID>/<REGION>`)


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is Resources created in AWS DevOps Agent?

[Assistant]
This CDK stack creates the following resources:
+ An AWS DevOps Agent Space
+ An IAM role for the Agent Space with the `AIDevOpsAgentAccessPolicy` managed policy
+ An IAM role for the operator web app with the `AIDevOpsOperatorAppAccessPolicy` managed policy
+ An AWS account association connecting your account to the Agent Space
+ Operator web app configuration with IAM authentication


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about Resources created in AWS DevOps Agent.

[Assistant]
This CDK stack creates the following resources:
+ An AWS DevOps Agent Space
+ An IAM role for the Agent Space with the `AIDevOpsAgentAccessPolicy` managed policy
+ An IAM role for the operator web app with the `AIDevOpsOperatorAppAccessPolicy` managed policy
+ An AWS account association connecting your account to the Agent Space
+ Operator web app configuration with IAM authentication


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is Clone the repository in AWS DevOps Agent?

[Assistant]
```bash
git clone https://github.com/aws-samples/aws-devops-agent-cdk-starter.git
cd aws-devops-agent-cdk-starter
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about Clone the repository in AWS DevOps Agent.

[Assistant]
```bash
git clone https://github.com/aws-samples/aws-devops-agent-cdk-starter.git
cd aws-devops-agent-cdk-starter
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is Configure the deployment in AWS DevOps Agent?

[Assistant]
Edit `cdk.json` or set context values via the command line:

```json
{
  "context": {
    "agentSpaceName": "MyAgentSpace",
    "agentSpaceDescription": "Agent Space for monitoring my applications",
    "region": "us-east-1"
  }
}
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about Configure the deployment in AWS DevOps Agent.

[Assistant]
Edit `cdk.json` or set context values via the command line:

```json
{
  "context": {
    "agentSpaceName": "MyAgentSpace",
    "agentSpaceDescription": "Agent Space for monitoring my applications",
    "region": "us-east-1"
  }
}
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is Review the CDK stack in AWS DevOps Agent?

[Assistant]
The primary stack (`lib/devops-agent-stack.ts`) defines all required resources:

```typescript
import * as cdk from 'aws-cdk-lib';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';

export class DevOpsAgentStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const accountId = cdk.Stack.of(this).account;
    const region = cdk.Stack.of(this).region;

    // Agent Space IAM Role
    const agentSpaceRole = new iam.Role(this, 'AgentSpaceRole', {
      roleName: 'DevOpsAgentRole-AgentSpace',
      assumedBy: new iam.ServicePrincipal('aidevops.amazonaws.com', {
        conditions: {
          StringEquals: {
            'aws:SourceAccount': accountId,
          },
          ArnLike: {
            'aws:SourceArn': `arn:aws:aidevops:${region}:${accountId}:agentspace/*`,
          },
        },
      }),
    });

    agentSpaceRole.addManagedPolicy(
      iam.ManagedPolicy.fromAwsManagedPolicyName('AIDevOpsAgentAccessPolicy')
    );

    // Operator Web App IAM Role
    const operatorRole = new iam.Role(this, 'OperatorAppRole', {
      roleName: 'DevOpsAgentRole-WebappAdmin',
      assumedBy: new iam.ServicePrincipal('aidevops.amazonaws.com', {
        conditions: {
          StringEquals: {
            'aws:SourceAccount': accountId,
          },
          ArnLike: {
            'aws:SourceArn': `arn:aws:aidevops:${region}:${accountId}:agentspace/*`,
          },
        },
      }),
    });

    operatorRole.addManagedPolicy(
      iam.ManagedPolicy.fromAwsManagedPolicyName('AIDevOpsOperatorAppAccessPolicy')
    );

    // Agent Space (Custom Resource)
    const agentSpace = new cdk.CustomResource(this, 'AgentSpace', {
      serviceToken: agentSpaceProviderArn,
      properties: {
        Name: this.node.tryGetContext('agentSpaceName') || 'MyAgentSpace',
        Description: this.node.tryGetContext('agentSpaceDescription') || '',
      },
    });

    // Outputs
    new cdk.CfnOutput(this, 'AgentSpaceId', {
      value: agentSpace.getAttString('AgentSpaceId'),
      description: 'The ID of the created Agent Space',
    });

    new cdk.CfnOutput(this, 'AgentSpaceRoleArn', {
      value: agentSpaceRole.roleArn,
      description: 'ARN of the Agent Space IAM role',
    });

    new cdk.CfnOutput(this, 'OperatorRoleArn', {
      value: operatorRole.roleArn,
      description: 'ARN of the Operator Web App IAM role',
    });
  }
}
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about Review the CDK stack in AWS DevOps Agent.

[Assistant]
The primary stack (`lib/devops-agent-stack.ts`) defines all required resources:

```typescript
import * as cdk from 'aws-cdk-lib';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';

export class DevOpsAgentStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const accountId = cdk.Stack.of(this).account;
    const region = cdk.Stack.of(this).region;

    // Agent Space IAM Role
    const agentSpaceRole = new iam.Role(this, 'AgentSpaceRole', {
      roleName: 'DevOpsAgentRole-AgentSpace',
      assumedBy: new iam.ServicePrincipal('aidevops.amazonaws.com', {
        conditions: {
          StringEquals: {
            'aws:SourceAccount': accountId,
          },
          ArnLike: {
            'aws:SourceArn': `arn:aws:aidevops:${region}:${accountId}:agentspace/*`,
          },
        },
      }),
    });

    agentSpaceRole.addManagedPolicy(
      iam.ManagedPolicy.fromAwsManagedPolicyName('AIDevOpsAgentAccessPolicy')
    );

    // Operator Web App IAM Role
    const operatorRole = new iam.Role(this, 'OperatorAppRole', {
      roleName: 'DevOpsAgentRole-WebappAdmin',
      assumedBy: new iam.ServicePrincipal('aidevops.amazonaws.com', {
        conditions: {
          StringEquals: {
            'aws:SourceAccount': accountId,
          },
          ArnLike: {
            'aws:SourceArn': `arn:aws:aidevops:${region}:${accountId}:agentspace/*`,
          },
        },
      }),
    });

    operatorRole.addManagedPolicy(
      iam.ManagedPolicy.fromAwsManagedPolicyName('AIDevOpsOperatorAppAccessPolicy')
    );

    // Agent Space (Custom Resource)
    const agentSpace = new cdk.CustomResource(this, 'AgentSpace', {
      serviceToken: agentSpaceProviderArn,
      properties: {
        Name: this.node.tryGetContext('agentSpaceName') || 'MyAgentSpace',
        Description: this.node.tryGetContext('agentSpaceDescription') || '',
      },
    });

    // Outputs
    new cdk.CfnOutput(this, 'AgentSpaceId', {
      value: agentSpace.getAttString('AgentSpaceId'),
      description: 'The ID of the created Agent Space',
    });

    new cdk.CfnOutput(this, 'AgentSpaceRoleArn', {
      value: agentSpaceRole.roleArn,
      description: 'ARN of the Agent Space IAM role',
    });

    new cdk.CfnOutput(this, 'OperatorRoleArn', {
      value: operatorRole.roleArn,
      description: 'ARN of the Operator Web App IAM role',
    });
  }
}
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is Associate your AWS account in AWS DevOps Agent?

[Assistant]
After the stack deploys, associate your AWS account with the Agent Space:

```bash
AGENT_SPACE_ID=$(aws cloudformation describe-stacks \
  --stack-name DevOpsAgentStack \
  --query 'Stacks[0].Outputs[?OutputKey==`AgentSpaceId`].OutputValue' \
  --output text \
  --region <REGION>)

aws devops-agent associate-service \
  --agent-space-id $AGENT_SPACE_ID \
  --service-id aws \
  --configuration '{
    "aws": {
      "assumableRoleArn": "arn:aws:iam::'$(aws sts get-caller-identity --query Account --output text)':role/DevOpsAgentRole-AgentSpace",
      "accountId": "'$(aws sts get-caller-identity --query Account --output text)'",
      "accountType": "monitor"
    }
  }' \
  --region <REGION>
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about Associate your AWS account in AWS DevOps Agent.

[Assistant]
After the stack deploys, associate your AWS account with the Agent Space:

```bash
AGENT_SPACE_ID=$(aws cloudformation describe-stacks \
  --stack-name DevOpsAgentStack \
  --query 'Stacks[0].Outputs[?OutputKey==`AgentSpaceId`].OutputValue' \
  --output text \
  --region <REGION>)

aws devops-agent associate-service \
  --agent-space-id $AGENT_SPACE_ID \
  --service-id aws \
  --configuration '{
    "aws": {
      "assumableRoleArn": "arn:aws:iam::'$(aws sts get-caller-identity --query Account --output text)':role/DevOpsAgentRole-AgentSpace",
      "accountId": "'$(aws sts get-caller-identity --query Account --output text)'",
      "accountType": "monitor"
    }
  }' \
  --region <REGION>
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is Enable the operator app in AWS DevOps Agent?

[Assistant]
```bash
aws devops-agent enable-operator-app \
  --agent-space-id $AGENT_SPACE_ID \
  --auth-flow iam \
  --operator-app-role-arn "arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/DevOpsAgentRole-WebappAdmin" \
  --region <REGION>
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about Enable the operator app in AWS DevOps Agent.

[Assistant]
```bash
aws devops-agent enable-operator-app \
  --agent-space-id $AGENT_SPACE_ID \
  --auth-flow iam \
  --operator-app-role-arn "arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/DevOpsAgentRole-WebappAdmin" \
  --region <REGION>
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is Part 2: Optional cross-account monitoring in AWS DevOps Agent?

[Assistant] To monitor resources in additional AWS accounts, deploy a cross-account role stack.


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about Part 2: Optional cross-account monitoring in AWS DevOps Agent.

[Assistant] To monitor resources in additional AWS accounts, deploy a cross-account role stack.


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is Cross-account role stack in AWS DevOps Agent?

[Assistant]
Create `lib/cross-account-stack.ts`:

```typescript
import * as cdk from 'aws-cdk-lib';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';

interface CrossAccountProps extends cdk.StackProps {
  monitoringAccountId: string;
  agentSpaceRegion: string;
}

export class DevOpsAgentCrossAccountStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: CrossAccountProps) {
    super(scope, id, props);

    const crossAccountRole = new iam.Role(this, 'CrossAccountRole', {
      roleName: 'DevOpsAgentCrossAccountRole',
      assumedBy: new iam.ArnPrincipal(
        `arn:aws:iam::${props.monitoringAccountId}:role/DevOpsAgentRole-AgentSpace`
      ),
    });

    crossAccountRole.addManagedPolicy(
      iam.ManagedPolicy.fromAwsManagedPolicyName('AIDevOpsAgentAccessPolicy')
    );

    new cdk.CfnOutput(this, 'CrossAccountRoleArn', {
      value: crossAccountRole.roleArn,
      description: 'ARN of the cross-account role for DevOps Agent',
    });
  }
}
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about Cross-account role stack in AWS DevOps Agent.

[Assistant]
Create `lib/cross-account-stack.ts`:

```typescript
import * as cdk from 'aws-cdk-lib';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';

interface CrossAccountProps extends cdk.StackProps {
  monitoringAccountId: string;
  agentSpaceRegion: string;
}

export class DevOpsAgentCrossAccountStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: CrossAccountProps) {
    super(scope, id, props);

    const crossAccountRole = new iam.Role(this, 'CrossAccountRole', {
      roleName: 'DevOpsAgentCrossAccountRole',
      assumedBy: new iam.ArnPrincipal(
        `arn:aws:iam::${props.monitoringAccountId}:role/DevOpsAgentRole-AgentSpace`
      ),
    });

    crossAccountRole.addManagedPolicy(
      iam.ManagedPolicy.fromAwsManagedPolicyName('AIDevOpsAgentAccessPolicy')
    );

    new cdk.CfnOutput(this, 'CrossAccountRoleArn', {
      value: crossAccountRole.roleArn,
      description: 'ARN of the cross-account role for DevOps Agent',
    });
  }
}
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is Deploy to the secondary account in AWS DevOps Agent?

[Assistant]
```bash
cdk deploy DevOpsAgentCrossAccountStack \
  --context monitoringAccountId=<MONITORING_ACCOUNT_ID> \
  --context agentSpaceRegion=<REGION> \
  --profile <SECONDARY_ACCOUNT_PROFILE>
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about Deploy to the secondary account in AWS DevOps Agent.

[Assistant]
```bash
cdk deploy DevOpsAgentCrossAccountStack \
  --context monitoringAccountId=<MONITORING_ACCOUNT_ID> \
  --context agentSpaceRegion=<REGION> \
  --profile <SECONDARY_ACCOUNT_PROFILE>
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is Associate the secondary account in AWS DevOps Agent?

[Assistant]
```bash
aws devops-agent associate-service \
  --agent-space-id <AGENT_SPACE_ID> \
  --service-id aws \
  --configuration '{
    "sourceAws": {
      "accountId": "<EXTERNAL_ACCOUNT_ID>",
      "accountType": "source",
      "assumableRoleArn": "arn:aws:iam::<EXTERNAL_ACCOUNT_ID>:role/DevOpsAgentCrossAccountRole"
    }
  }' \
  --region <REGION>
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about Associate the secondary account in AWS DevOps Agent.

[Assistant]
```bash
aws devops-agent associate-service \
  --agent-space-id <AGENT_SPACE_ID> \
  --service-id aws \
  --configuration '{
    "sourceAws": {
      "accountId": "<EXTERNAL_ACCOUNT_ID>",
      "accountType": "source",
      "assumableRoleArn": "arn:aws:iam::<EXTERNAL_ACCOUNT_ID>:role/DevOpsAgentCrossAccountRole"
    }
  }' \
  --region <REGION>
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is CDK bootstrap errors in AWS DevOps Agent?

[Assistant]
If you encounter "This stack uses assets" errors, ensure your environment is bootstrapped:

```bash
cdk bootstrap aws://<ACCOUNT_ID>/<REGION>
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about CDK bootstrap errors in AWS DevOps Agent.

[Assistant]
If you encounter "This stack uses assets" errors, ensure your environment is bootstrapped:

```bash
cdk bootstrap aws://<ACCOUNT_ID>/<REGION>
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] How does getting started with aws devops agent using aws cdk work in AWS DevOps Agent?

[Assistant]
+ Verify your AWS credentials have `iam:CreateRole` and `iam:AttachRolePolicy` permissions
+ Check if a role with the same name already exists: `aws iam get-role --role-name DevOpsAgentRole-AgentSpace`
+ If the role exists from a previous deployment, either delete it or modify the CDK stack to use a different name


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What security features does AWS DevOps Agent provide for getting started with aws devops agent using aws cdk?

[Assistant]
+ Verify your AWS credentials have `iam:CreateRole` and `iam:AttachRolePolicy` permissions
+ Check if a role with the same name already exists: `aws iam get-role --role-name DevOpsAgentRole-AgentSpace`
+ If the role exists from a previous deployment, either delete it or modify the CDK stack to use a different name


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is Stack deployment times out in AWS DevOps Agent?

[Assistant]
+ CDK deployments typically complete within 5 minutes
+ Check CloudFormation events for specific resource failures: `aws cloudformation describe-stack-events --stack-name DevOpsAgentStack`
+ Ensure you have sufficient IAM permissions for all resources in the stack


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about Stack deployment times out in AWS DevOps Agent.

[Assistant]
+ CDK deployments typically complete within 5 minutes
+ Check CloudFormation events for specific resource failures: `aws cloudformation describe-stack-events --stack-name DevOpsAgentStack`
+ Ensure you have sufficient IAM permissions for all resources in the stack


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is Agent Space creation fails in AWS DevOps Agent?

[Assistant]
+ Verify the AWS DevOps Agent service is available in your chosen Region
+ Check that you have not exceeded the maximum number of Agent Spaces for your account
+ Review CloudTrail logs for detailed error messages


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about Agent Space creation fails in AWS DevOps Agent.

[Assistant]
+ Verify the AWS DevOps Agent service is available in your chosen Region
+ Check that you have not exceeded the maximum number of Agent Spaces for your account
+ Review CloudTrail logs for detailed error messages


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is Cleanup in AWS DevOps Agent?

[Assistant]
Remove all resources created by this guide:

```bash


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about Cleanup in AWS DevOps Agent.

[Assistant]
Remove all resources created by this guide:

```bash


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is If cross-account stack was deployed in AWS DevOps Agent?

[Assistant]
cdk destroy DevOpsAgentCrossAccountStack --profile <SECONDARY_ACCOUNT_PROFILE>
```

Before deleting stacks, you may want to delete the Agent Space association and disable the operator app:

```bash
aws devops-agent delete-agent-space \
  --agent-space-id <AGENT_SPACE_ID> \
  --region <REGION>
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about If cross-account stack was deployed in AWS DevOps Agent.

[Assistant]
cdk destroy DevOpsAgentCrossAccountStack --profile <SECONDARY_ACCOUNT_PROFILE>
```

Before deleting stacks, you may want to delete the Agent Space association and disable the operator app:

```bash
aws devops-agent delete-agent-space \
  --agent-space-id <AGENT_SPACE_ID> \
  --region <REGION>
```


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] How does getting started with aws devops agent using aws cdk work in AWS DevOps Agent?

[Assistant]
+ The Agent Space IAM role grants read-only access to AWS resources for investigation purposes. Review the `AIDevOpsAgentAccessPolicy` to understand which services can be accessed.
+ The operator web app role provides access to the DevOps Agent console. Limit who can assume this role.
+ For production deployments, consider restricting the trust policy conditions to specific Agent Space ARNs rather than using wildcards.
+ Use AWS Organizations Service Control Policies (SCPs) to limit which accounts can create Agent Spaces.
+ Enable AWS CloudTrail logging to audit all DevOps Agent API calls.


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What security features does AWS DevOps Agent provide for getting started with aws devops agent using aws cdk?

[Assistant]
+ The Agent Space IAM role grants read-only access to AWS resources for investigation purposes. Review the `AIDevOpsAgentAccessPolicy` to understand which services can be accessed.
+ The operator web app role provides access to the DevOps Agent console. Limit who can assume this role.
+ For production deployments, consider restricting the trust policy conditions to specific Agent Space ARNs rather than using wildcards.
+ Use AWS Organizations Service Control Policies (SCPs) to limit which accounts can create Agent Spaces.
+ Enable AWS CloudTrail logging to audit all DevOps Agent API calls.


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is Next steps in AWS DevOps Agent?

[Assistant]
+ Add secondary accounts if your applications span multiple AWS accounts
+ Configure third-party integrations like observability tools or ticketing systems
+ Set up AWS Identity Center authentication for production environments
+ Create a test environment to validate the agent's detection capabilities
+ Review DevOps Agent Skills to understand available investigation capabilities


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Tell me about Next steps in AWS DevOps Agent.

[Assistant]
+ Add secondary accounts if your applications span multiple AWS accounts
+ Configure third-party integrations like observability tools or ticketing systems
+ Set up AWS Identity Center authentication for production environments
+ Create a test environment to validate the agent's detection capabilities
+ Review DevOps Agent Skills to understand available investigation capabilities


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] Give me a comprehensive overview of getting started with aws devops agent using aws cloudformation in AWS DevOps Agent.

[Assistant]
# Getting started with AWS DevOps Agent using AWS CloudFormation

## Overview

This guide walks you through deploying AWS DevOps Agent using AWS CloudFormation templates. CloudFormation provides a declarative way to define your infrastructure as code, enabling repeatable and consistent deployments. By the end of this guide, you will have a fully functional Agent Space with associated AWS accounts and the operator web app enabled.

## Prerequisites

Before you begin, ensure you have the following:
+ AWS CLI version 2 installed and configured
+ An AWS account with permissions to create CloudFormation stacks, IAM roles, and AWS DevOps Agent resources
+ Authentication to your AWS monitoring account
+ Familiarity with CloudFormation template syntax (YAML)

Throughout this guide, replace the following placeholder values:
+ `<MONITORING_ACCOUNT_ID>` — Your 12-digit AWS account ID
+ `<REGION>` — The AWS Region for your Agent Space (for example, `us-east-1`)
+ `<AGENT_SPACE_ID>` — The agent space identifier (obtained after deployment)
+ `<EXTERNAL_ACCOUNT_ID>` — The 12-digit account ID of any secondary account to monitor

## Part 1: Deploy the Agent Space

### CloudFormation template

Save the following template as `devops-agent-space.yaml`:

```yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: AWS DevOps Agent - Agent Space with IAM roles and operator web app

Parameters:
  AgentSpaceName:
    Type: String
    Default: MyAgentSpace
    Description: Name for the AWS DevOps Agent Space
    MinLength: 1
    MaxLength: 128

  AgentSpaceDescription:
    Type: String
    Default: Agent Space for monitoring my applications
    Description: Description of the Agent Space purpose

Resources:
  # IAM Role for the Agent Space
  AgentSpaceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: DevOpsAgentRole-AgentSpace
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: aidevops.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub arn:aws:aidevops:${AWS::Region}:${AWS::AccountId}:agentspace/*
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AIDevOpsAgentAccessPolicy
      Tags:
        - Key: ManagedBy
          Value: CloudFormation
        - Key: Purpose
          Value: DevOpsAgent

  # IAM Role for the Operator Web App
  OperatorAppRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: DevOpsAgentRole-WebappAdmin
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: aidevops.amazonaws.com
            Action:
              - sts:AssumeRole
              - sts:TagSession
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub arn:aws:aidevops:${AWS::Region}:${AWS::AccountId}:agentspace/*
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AIDevOpsOperatorAppAccessPolicy
      Tags:
        - Key: ManagedBy
          Value: CloudFormation
        - Key: Purpose
          Value: DevOpsAgentOperatorApp

Outputs:
  AgentSpaceRoleArn:
    Description: ARN of the Agent Space IAM role
    Value: !GetAtt AgentSpaceRole.Arn
    Export:
      Name: !Sub ${AWS::StackName}-AgentSpaceRoleArn

  OperatorAppRoleArn:
    Description: ARN of the Operator Web App IAM role
    Value: !GetAtt OperatorAppRole.Arn
    Export:
      Name: !Sub ${AWS::StackName}-OperatorAppRoleArn

  MonitoringAccountId:
    Description: The monitoring account ID
    Value: !Ref AWS::AccountId
    Export:
      Name: !Sub ${AWS::StackName}-MonitoringAccountId
```

### Deploy the stack

```bash
aws cloudformation create-stack \
  --stack-name devops-agent-space \
  --template-body file://devops-agent-space.yaml \
  --parameters \
    ParameterKey=AgentSpaceName,ParameterValue=MyAgentSpace \
    ParameterKey=AgentSpaceDescription,ParameterValue="Agent Space for monitoring my applications" \
  --capabilities CAPABILITY_NAMED_IAM \
  --region <REGION>
```

### Wait for deployment to complete

```bash
aws cloudformation wait stack-create-complete \
  --stack-name devops-agent-space \
  --region <REGION>
```

### Create the Agent Space

After the IAM roles are created, create the Agent Space using the CLI:

```bash
aws devops-agent create-agent-space \
  --name "MyAgentSpace" \
  --description "Agent Space for monitoring my applications" \
  --region <REGION>
```

Save the returned `AgentSpaceId` for use in subsequent commands.

### Associate your AWS account

```bash
AGENT_SPACE_ROLE_ARN=$(aws cloudformation describe-stacks \
  --stack-name devops-agent-space \
  --query 'Stacks[0].Outputs[?OutputKey==`AgentSpaceRoleArn`].OutputValue' \
  --output text \
  --region <REGION>)

aws devops-agent associate-service \
  --agent-space-id <AGENT_SPACE_ID> \
  --service-id aws \
  --configuration '{
    "aws": {
      "assumableRoleArn": "'$AGENT_SPACE_ROLE_ARN'",
      "accountId": "<MONITORING_ACCOUNT_ID>",
      "accountType": "monitor"
    }
  }' \
  --region <REGION>
```

### Enable the operator web app

```bash
OPERATOR_ROLE_ARN=$(aws cloudformation describe-stacks \
  --stack-name devops-agent-space \
  --query 'Stacks[0].Outputs[?OutputKey==`OperatorAppRoleArn`].OutputValue' \
  --output text \
  --region <REGION>)

aws devops-agent enable-operator-app \
  --agent-space-id <AGENT_SPACE_ID> \
  --auth-flow iam \
  --operator-app-role-arn "$OPERATOR_ROLE_ARN" \
  --region <REGION>
```

## Part 2: Optional cross-account monitoring

To monitor resources in additional AWS accounts, deploy a cross-account role in each secondary account.

### Cross-account CloudFormation template

Save the following template as `devops-agent-cross-account.yaml`:

```yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: AWS DevOps Agent - Cross-account role for secondary account monitoring

Parameters:
  MonitoringAccountId:
    Type: String
    Description: The 12-digit account ID of the monitoring (primary) account
    AllowedPattern: '[0-9]{12}'
    ConstraintDescription: Must be a valid 12-digit AWS account ID

  AgentSpaceRegion:
    Type: String
    Default: us-east-1
    Description: The Region where the Agent Space is deployed

Resources:
  CrossAccountRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: DevOpsAgentCrossAccountRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${MonitoringAccountId}:role/DevOpsAgentRole-AgentSpace
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AIDevOpsAgentAccessPolicy
      Tags:
        - Key: ManagedBy
          Value: CloudFormation
        - Key: Purpose
          Value: DevOpsAgentCrossAccount
        - Key: MonitoringAccount
          Value: !Ref MonitoringAccountId

Outputs:
  CrossAccountRoleArn:
    Description: ARN of the cross-account role for DevOps Agent
    Value: !GetAtt CrossAccountRole.Arn
```

### Deploy to the secondary account

```bash
aws cloudformation create-stack \
  --stack-name devops-agent-cross-account \
  --template-body file://devops-agent-cross-account.yaml \
  --parameters \
    ParameterKey=MonitoringAccountId,ParameterValue=<MONITORING_ACCOUNT_ID> \
    ParameterKey=AgentSpaceRegion,ParameterValue=<REGION> \
  --capabilities CAPABILITY_NAMED_IAM \
  --region <REGION> \
  --profile <SECONDARY_ACCOUNT_PROFILE>
```

### Associate the secondary account

```bash
aws devops-agent associate-service \
  --agent-space-id <AGENT_SPACE_ID> \
  --service-id aws \
  --configuration '{
    "sourceAws": {
      "accountId": "<EXTERNAL_ACCOUNT_ID>",
      "accountType": "source",
      "assumableRoleArn": "arn:aws:iam::<EXTERNAL_ACCOUNT_ID>:role/DevOpsAgentCrossAccountRole"
    }
  }' \
  --region <REGION>
```

## Verification

Verify your deployment by running the following commands:

```bash
# Check stack status
aws cloudformation describe-stacks \
  --stack-name devops-agent-space \
  --query 'Stacks[0].StackStatus' \
  --region <REGION>

# Verify IAM roles exist
aws iam get-role --role-name DevOpsAgentRole-AgentSpace
aws iam get-role --role-name DevOpsAgentRole-WebappAdmin

# Verify Agent Space
aws devops-agent get-agent-space \
  --agent-space-id <AGENT_SPACE_ID> \
  --region <REGION>

# Verify associations
aws devops-agent list-associations \
  --agent-space-id <AGENT_SPACE_ID> \
  --region <REGION>
```

## Troubleshooting

### Stack creation fails with CAPABILITY_NAMED_IAM error

You must include the `--capabilities CAPABILITY_NAMED_IAM` flag when creating stacks that define IAM roles with custom names:

```bash
aws cloudformation create-stack \
  --stack-name devops-agent-space \
  --template-body file://devops-agent-space.yaml \
  --capabilities CAPABILITY_NAMED_IAM \
  --region <REGION>
```

### Role already exists error

If a role with the same name already exists from a previous deployment:

```bash
# Check if the role exists
aws iam get-role --role-name DevOpsAgentRole-AgentSpace

# Either delete the existing role (if safe to do so)
aws iam detach-role-policy --role-name DevOpsAgentRole-AgentSpace --policy-arn arn:aws:iam::aws:policy/AIDevOpsAgentAccessPolicy
aws iam delete-role --role-name DevOpsAgentRole-AgentSpace

# Or modify the template to use a different role name
```

### Cross-account role assumption fails

+ Verify the monitoring account ID is correct in the trust policy
+ Ensure the Agent Space role in the monitoring account exists and is properly configured
+ Check that the cross-account role has the correct managed policy attached
+ Verify there are no SCPs blocking cross-account role assumption

### Agent Space association fails

+ Confirm the Agent Space ID is correct
+ Verify the IAM role ARN matches the role created by the CloudFormation stack
+ Ensure the role trust policy allows the `aidevops.amazonaws.com` service principal
+ Check that the Region is consistent across all commands

## Cleanup

Remove all resources in reverse order:

```bash
# 1. Delete the Agent Space (removes associations and operator app)
aws devops-agent delete-agent-space \
  --agent-space-id <AGENT_SPACE_ID> \
  --region <REGION>

# 2. Delete the cross-account stack (if deployed)
aws cloudformation delete-stack \
  --stack-name devops-agent-cross-account \
  --region <REGION> \
  --profile <SECONDARY_ACCOUNT_PROFILE>

# 3. Delete the primary stack
aws cloudformation delete-stack \
  --stack-name devops-agent-space \
  --region <REGION>

# 4. Wait for deletion to complete
aws cloudformation wait stack-delete-complete \
  --stack-name devops-agent-space \
  --region <REGION>
```

## Next steps

+ Create a test environment to validate the agent's detection and investigation capabilities
+ Configure third-party integrations such as GitHub, ServiceNow, or observability tools
+ Set up AWS Identity Center authentication for multi-user production environments
+ Review the AWS DevOps Agent CLI onboarding guide for additional configuration options
+ Explore DevOps Agent Skills to understand available investigation capabilities


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is getting started with aws devops agent using aws cloudformation?

[Assistant]
# Getting started with AWS DevOps Agent using AWS CloudFormation

## Overview

This guide walks you through deploying AWS DevOps Agent using AWS CloudFormation templates. CloudFormation provides a declarative way to define your infrastructure as code, enabling repeatable and consistent deployments. By the end of this guide, you will have a fully functional Agent Space with associated AWS accounts and the operator web app enabled.

## Prerequisites

Before you begin, ensure you have the following:
+ AWS CLI version 2 installed and configured
+ An AWS account with permissions to create CloudFormation stacks, IAM roles, and AWS DevOps Agent resources
+ Authentication to your AWS monitoring account
+ Familiarity with CloudFormation template syntax (YAML)

Throughout this guide, replace the following placeholder values:
+ `<MONITORING_ACCOUNT_ID>` — Your 12-digit AWS account ID
+ `<REGION>` — The AWS Region for your Agent Space (for example, `us-east-1`)
+ `<AGENT_SPACE_ID>` — The agent space identifier (obtained after deployment)
+ `<EXTERNAL_ACCOUNT_ID>` — The 12-digit account ID of any secondary account to monitor

## Part 1: Deploy the Agent Space

### CloudFormation template

Save the following template as `devops-agent-space.yaml`:

```yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: AWS DevOps Agent - Agent Space with IAM roles and operator web app

Parameters:
  AgentSpaceName:
    Type: String
    Default: MyAgentSpace
    Description: Name for the AWS DevOps Agent Space
    MinLength: 1
    MaxLength: 128

  AgentSpaceDescription:
    Type: String
    Default: Agent Space for monitoring my applications
    Description: Description of the Agent Space purpose

Resources:
  # IAM Role for the Agent Space
  AgentSpaceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: DevOpsAgentRole-AgentSpace
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: aidevops.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub arn:aws:aidevops:${AWS::Region}:${AWS::AccountId}:agentspace/*
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AIDevOpsAgentAccessPolicy
      Tags:
        - Key: ManagedBy
          Value: CloudFormation
        - Key: Purpose
          Value: DevOpsAgent

  # IAM Role for the Operator Web App
  OperatorAppRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: DevOpsAgentRole-WebappAdmin
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: aidevops.amazonaws.com
            Action:
              - sts:AssumeRole
              - sts:TagSession
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub arn:aws:aidevops:${AWS::Region}:${AWS::AccountId}:agentspace/*
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AIDevOpsOperatorAppAccessPolicy
      Tags:
        - Key: ManagedBy
          Value: CloudFormation
        - Key: Purpose
          Value: DevOpsAgentOperatorApp

Outputs:
  AgentSpaceRoleArn:
    Description: ARN of the Agent Space IAM role
    Value: !GetAtt AgentSpaceRole.Arn
    Export:
      Name: !Sub ${AWS::StackName}-AgentSpaceRoleArn

  OperatorAppRoleArn:
    Description: ARN of the Operator Web App IAM role
    Value: !GetAtt OperatorAppRole.Arn
    Export:
      Name: !Sub ${AWS::StackName}-OperatorAppRoleArn

  MonitoringAccountId:
    Description: The monitoring account ID
    Value: !Ref AWS::AccountId
    Export:
      Name: !Sub ${AWS::StackName}-MonitoringAccountId
```

### Deploy the stack

```bash
aws cloudformation create-stack \
  --stack-name devops-agent-space \
  --template-body file://devops-agent-space.yaml \
  --parameters \
    ParameterKey=AgentSpaceName,ParameterValue=MyAgentSpace \
    ParameterKey=AgentSpaceDescription,ParameterValue="Agent Space for monitoring my applications" \
  --capabilities CAPABILITY_NAMED_IAM \
  --region <REGION>
```

### Wait for deployment to complete

```bash
aws cloudformation wait stack-create-complete \
  --stack-name devops-agent-space \
  --region <REGION>
```

### Create the Agent Space

After the IAM roles are created, create the Agent Space using the CLI:

```bash
aws devops-agent create-agent-space \
  --name "MyAgentSpace" \
  --description "Agent Space for monitoring my applications" \
  --region <REGION>
```

Save the returned `AgentSpaceId` for use in subsequent commands.

### Associate your AWS account

```bash
AGENT_SPACE_ROLE_ARN=$(aws cloudformation describe-stacks \
  --stack-name devops-agent-space \
  --query 'Stacks[0].Outputs[?OutputKey==`AgentSpaceRoleArn`].OutputValue' \
  --output text \
  --region <REGION>)

aws devops-agent associate-service \
  --agent-space-id <AGENT_SPACE_ID> \
  --service-id aws \
  --configuration '{
    "aws": {
      "assumableRoleArn": "'$AGENT_SPACE_ROLE_ARN'",
      "accountId": "<MONITORING_ACCOUNT_ID>",
      "accountType": "monitor"
    }
  }' \
  --region <REGION>
```

### Enable the operator web app

```bash
OPERATOR_ROLE_ARN=$(aws cloudformation describe-stacks \
  --stack-name devops-agent-space \
  --query 'Stacks[0].Outputs[?OutputKey==`OperatorAppRoleArn`].OutputValue' \
  --output text \
  --region <REGION>)

aws devops-agent enable-operator-app \
  --agent-space-id <AGENT_SPACE_ID> \
  --auth-flow iam \
  --operator-app-role-arn "$OPERATOR_ROLE_ARN" \
  --region <REGION>
```

## Part 2: Optional cross-account monitoring

To monitor resources in additional AWS accounts, deploy a cross-account role in each secondary account.

### Cross-account CloudFormation template

Save the following template as `devops-agent-cross-account.yaml`:

```yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: AWS DevOps Agent - Cross-account role for secondary account monitoring

Parameters:
  MonitoringAccountId:
    Type: String
    Description: The 12-digit account ID of the monitoring (primary) account
    AllowedPattern: '[0-9]{12}'
    ConstraintDescription: Must be a valid 12-digit AWS account ID

  AgentSpaceRegion:
    Type: String
    Default: us-east-1
    Description: The Region where the Agent Space is deployed

Resources:
  CrossAccountRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: DevOpsAgentCrossAccountRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${MonitoringAccountId}:role/DevOpsAgentRole-AgentSpace
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AIDevOpsAgentAccessPolicy
      Tags:
        - Key: ManagedBy
          Value: CloudFormation
        - Key: Purpose
          Value: DevOpsAgentCrossAccount
        - Key: MonitoringAccount
          Value: !Ref MonitoringAccountId

Outputs:
  CrossAccountRoleArn:
    Description: ARN of the cross-account role for DevOps Agent
    Value: !GetAtt CrossAccountRole.Arn
```

### Deploy to the secondary account

```bash
aws cloudformation create-stack \
  --stack-name devops-agent-cross-account \
  --template-body file://devops-agent-cross-account.yaml \
  --parameters \
    ParameterKey=MonitoringAccountId,ParameterValue=<MONITORING_ACCOUNT_ID> \
    ParameterKey=AgentSpaceRegion,ParameterValue=<REGION> \
  --capabilities CAPABILITY_NAMED_IAM \
  --region <REGION> \
  --profile <SECONDARY_ACCOUNT_PROFILE>
```

### Associate the secondary account

```bash
aws devops-agent associate-service \
  --agent-space-id <AGENT_SPACE_ID> \
  --service-id aws \
  --configuration '{
    "sourceAws": {
      "accountId": "<EXTERNAL_ACCOUNT_ID>",
      "accountType": "source",
      "assumableRoleArn": "arn:aws:iam::<EXTERNAL_ACCOUNT_ID>:role/DevOpsAgentCrossAccountRole"
    }
  }' \
  --region <REGION>
```

## Verification

Verify your deployment by running the following commands:

```bash
# Check stack status
aws cloudformation describe-stacks \
  --stack-name devops-agent-space \
  --query 'Stacks[0].StackStatus' \
  --region <REGION>

# Verify IAM roles exist
aws iam get-role --role-name DevOpsAgentRole-AgentSpace
aws iam get-role --role-name DevOpsAgentRole-WebappAdmin

# Verify Agent Space
aws devops-agent get-agent-space \
  --agent-space-id <AGENT_SPACE_ID> \
  --region <REGION>

# Verify associations
aws devops-agent list-associations \
  --agent-space-id <AGENT_SPACE_ID> \
  --region <REGION>
```

## Troubleshooting

### Stack creation fails with CAPABILITY_NAMED_IAM error

You must include the `--capabilities CAPABILITY_NAMED_IAM` flag when creating stacks that define IAM roles with custom names:

```bash
aws cloudformation create-stack \
  --stack-name devops-agent-space \
  --template-body file://devops-agent-space.yaml \
  --capabilities CAPABILITY_NAMED_IAM \
  --region <REGION>
```

### Role already exists error

If a role with the same name already exists from a previous deployment:

```bash
# Check if the role exists
aws iam get-role --role-name DevOpsAgentRole-AgentSpace

# Either delete the existing role (if safe to do so)
aws iam detach-role-policy --role-name DevOpsAgentRole-AgentSpace --policy-arn arn:aws:iam::aws:policy/AIDevOpsAgentAccessPolicy
aws iam delete-role --role-name DevOpsAgentRole-AgentSpace

# Or modify the template to use a different role name
```

### Cross-account role assumption fails

+ Verify the monitoring account ID is correct in the trust policy
+ Ensure the Agent Space role in the monitoring account exists and is properly configured
+ Check that the cross-account role has the correct managed policy attached
+ Verify there are no SCPs blocking cross-account role assumption

### Agent Space association fails

+ Confirm the Agent Space ID is correct
+ Verify the IAM role ARN matches the role created by the CloudFormation stack
+ Ensure the role trust policy allows the `aidevops.amazonaws.com` service principal
+ Check that the Region is consistent across all commands

## Cleanup

Remove all resources in reverse order:

```bash
# 1. Delete the Agent Space (removes associations and operator app)
aws devops-agent delete-agent-space \
  --agent-space-id <AGENT_SPACE_ID> \
  --region <REGION>

# 2. Delete the cross-account stack (if deployed)
aws cloudformation delete-stack \
  --stack-name devops-agent-cross-account \
  --region <REGION> \
  --profile <SECONDARY_ACCOUNT_PROFILE>

# 3. Delete the primary stack
aws cloudformation delete-stack \
  --stack-name devops-agent-space \
  --region <REGION>

# 4. Wait for deletion to complete
aws cloudformation wait stack-delete-complete \
  --stack-name devops-agent-space \
  --region <REGION>
```

## Next steps

+ Create a test environment to validate the agent's detection and investigation capabilities
+ Configure third-party integrations such as GitHub, ServiceNow, or observability tools
+ Set up AWS Identity Center authentication for multi-user production environments
+ Review the AWS DevOps Agent CLI onboarding guide for additional configuration options
+ Explore DevOps Agent Skills to understand available investigation capabilities


[System]
/no_think
You are Tech Advisor, an expert on AWS cloud services with deep knowledge of AWS DevOps Agent.

You have comprehensive knowledge of AWS DevOps Agent including:
- What it is and how it works (Agent Spaces, topology, dual-console architecture)
- Key features: autonomous incident response, proactive prevention, on-demand SRE tasks
- Integrations: CloudWatch, Datadog, Dynatrace, New Relic, Splunk, Grafana, PagerDuty, GitHub, GitLab, Azure DevOps, ServiceNow, Slack
- GA features: Azure/on-prem support, Triage Agent, Learned/Custom Skills, Code Indexing, Private Connections
- Pricing: $0.0083 per agent-second, free trial details, AWS Support credits
- Getting started: Agent Spaces, connecting tools, running investigations
- Security: encryption, customer managed keys, IdP integration, CloudTrail auditing
- Available regions: US East, US West, Frankfurt, Ireland, Sydney, Tokyo

Be concise and structured. Use bullet points where appropriate. Provide accurate, detailed answers.

[User] What is getting started with aws devops agent using aws cloudformation in AWS DevOps Agent?

[Assistant] This guide walks you through deploying AWS DevOps Agent using AWS CloudFormation templates. CloudFormation provides a declarative way to define your infrastructure as code, enabling repeatable and consistent deployments. By the end of this guide, you will have a fully functional Agent Space with associated AWS accounts and the operator web app enabled.