The problem

The first 15 minutes of an incident are spent collecting context: which metric, which logs, what changed, where’s the runbook? It’s repetitive, it’s stressful, and it happens at 3 a.m. Large language models are good at exactly this kind of synthesis, as long as you feed them real evidence and constrain them to it.

What you’ll build

• An EventBridge rule catching every CloudWatch alarm that enters ALARM
• A read-only evidence collector: metric history, Logs Insights error search, CloudTrail write events from the last 2 hours
• Optional RAG over your runbooks with a Bedrock Knowledge Base
• A Claude call via the Bedrock Converse API that produces summary, severity, ranked hypotheses, next steps and “do NOT do” warnings
• Delivery to Slack + email, and an incident record (brief + evidence) in DynamoDB
• A built-in demo service you can break on demand

Architecture

CloudWatch alarm ─ALARM─▶ EventBridge ─▶ Lambda co-pilot
                                           ├─ metric history (last 60 min)
                                           ├─ Logs Insights: errors/timeouts (last 30 min)
                                           ├─ CloudTrail: write events (last 2 h)  ← "what changed?"
                                           ├─ Bedrock Knowledge Base: matching runbook (optional)
                                           └─ Bedrock Converse (Claude) ─▶ brief ─▶ Slack + SNS + DynamoDB

AWS services used

How it works

1. TriggerAny alarm → EventBridge → co-pilot Lambda.
2. GatherThe Lambda pulls the metric, matching error logs, recent infrastructure changes and relevant runbook excerpts.
3. ReasonClaude receives only that evidence plus a strict SRE prompt, and must state its uncertainty.
4. DeliverThe brief posts to Slack and email and is stored for the post-incident review.

Key design decisions

• The co-pilot is read-only. It advises, humans act.
• “What changed?” from CloudTrail is often the single most useful clue, so it is always included.
• Every brief is stored with its evidence, so you can audit the AI later.

Deploy it

npm install
npx cdk deploy -c alertEmail=you@example.com
# choose a different model / inference profile:
npx cdk deploy -c modelId=<your-claude-model-or-inference-profile-id>

Full prerequisites, parameters and clean-up steps are in the project README on the code page.

See it work

Set the demo function’s failure rate to 70% and invoke it a few dozen times. The alarm fires, and in Slack you get a brief identifying connection-pool exhaustion, citing the log line and the config change that preceded it.

Skills this demonstrates