How do I automatically trigger AWS DevOps Agent investigations from CloudWatch Alarms and EventBridge rules for Media Services Workflow Monitor?

Content level: Intermediate
Reading time: ~15 minutes
Tags: AWS DevOps Agent, AWS Elemental MediaConnect, AWS Elemental MediaLive, AWS Elemental MediaPackage, Amazon CloudWatch Alarms, Amazon EventBridge, Workflow Monitor

---

Overview

I want to automatically invoke AWS DevOps Agent investigations when a CloudWatch Alarm deployed by workflow monitor for AWS Media Services enters an ALARM state. This article walks through configuring the end-to-end integration — from setting up workflow monitor with best-practice alarm templates for your live video workflow, to routing those alarms through Amazon EventBridge to DevOps Agent for autonomous incident investigation.

Live video workflows are time-sensitive — a dropped frame, a source loss, or an encoder overload can disrupt viewer experience within seconds. Traditional alarming notifies operators, but investigation still requires manual correlation of metrics, logs, and recent changes. By connecting workflow monitor alarms to DevOps Agent, you can trigger autonomous investigation the moment an issue is detected, reducing mean time to root cause from minutes to seconds.

---

Architecture

Figure 1: When a CloudWatch Alarm deployed by workflow monitor transitions to ALARM state, an EventBridge rule invokes a Lambda function that creates a DevOps Agent investigation task. DevOps Agent then autonomously correlates metrics, logs, and API changes across the media signal chain.

---

Prerequisites

Before configuring this integration, ensure the following:

1. An active AWS Media Services live workflow — AWS Elemental MediaConnect, MediaLive, and/or MediaPackage resources deployed in your account.
2. Workflow monitor configured — Signal maps discovered and alarm templates deployed. See Configuring workflow monitor.
3. An active AWS DevOps Agent Space — Created in your AWS account. See Creating an Agent Space.
4. DevOps Agent associated with your AWS account — The Agent Space must have access to Amazon CloudWatch, AWS CloudTrail, and CloudWatch Logs.
5. AWS CLI version 2.34 or later installed.
6. IAM permissions to create CloudFormation stacks, Lambda functions, and EventBridge rules.

---

Step 1: Configure Workflow Monitor for Your Live Workflow

1.1 Discover Signal Maps

Signal maps visualize the resources in your live video workflow. Workflow monitor automatically discovers connected resources across MediaConnect, MediaLive, MediaPackage, Amazon S3, and Amazon CloudFront.

1. Open the AWS Elemental MediaLive console.
2. In the left navigation, select Workflow monitor → Signal maps.
3. Choose Create signal map.
4. Select a starting resource (e.g., a MediaConnect flow or MediaLive channel) and let workflow monitor discover the connected pipeline.
5. Review the discovered resources and confirm the signal map.

Figure 2: Workflow monitor's signal map visualization shows the auto-discovered topology — MediaConnect flow → MediaLive input → MediaLive channel → MediaPackage channel → MediaPackage origin endpoint.

1.2 Deploy Recommended Alarm Templates

Workflow monitor provides AWS-curated alarm templates with best-practice thresholds for each media service. These templates deploy CloudWatch Alarms tuned for live video streaming.

1. In workflow monitor, navigate to Alarm template groups.
2. Create a new alarm template group (e.g., LiveStreaming-Production).
3. Select Import → Choose an AWS recommended group:
   • MediaConnect Standard Flow — monitors source health, output status, and connected/disconnected state
   • MediaLive Standard Channel — monitors input loss, active alerts, pipeline errors, and output locking
   • MediaPackage Channel — monitors egress request count errors and ingress bytes
4. Review and import the selected templates.
5. Optionally customize thresholds (e.g., lower the ConnectedOutputs threshold if your workflow has redundant outputs).
6. Deploy the alarm templates to your signal map.

Figure 3: The signal map shows DEPLOYMENT_IN_PROGRESS as workflow monitor deploys alarm templates to the discovered resources.

Figure 4: The alarm template group "TestA" contains 10 curated alarm templates imported from AWS recommended groups.

After deployment, workflow monitor creates CloudWatch Alarms with names following the pattern:

• SignalMap-Alarm-<MetricName>-<ResourceHash> (e.g., SignalMap-Alarm-ActiveAlerts-c9abe3c2efd531afb4794e810de87963)
• MediaConnect-<TemplateGroupName>-<FlowName>-<MetricName> (e.g., MediaConnect-MediaConnectMonitoring-TestA-SourceBitRate)

Important: The alarm naming prefix varies depending on how workflow monitor deploys the alarms and which template group you use. Before configuring the EventBridge rule, always discover your actual alarm prefix using the steps in Step 3.4: Identify Your Alarm Prefix.

The prefix you identify will be used in the EventBridge rule to filter which alarms trigger DevOps Agent investigations.

1.3 Key Metrics Deployed (Examples)

Service	Metric	Template	What it monitors
MediaConnect	SourceBitRate	Standard Flow	Source ingress bit rate drops below threshold
MediaConnect	ConnectedOutputs	Standard Flow	Output disconnection from downstream
MediaConnect	SourcePATErrors	Standard Flow	MPEG-TS program association table errors
MediaLive	ActiveAlerts	Standard Channel	Active alert count exceeds threshold
MediaLive	InputVideoFrameRate	Standard Channel	Input frame rate drops (source issues)
MediaLive	OutputVideoFrameRate	Standard Channel	Output frame rate drops (encoding issues)
MediaLive	NetworkIn	Standard Channel	Network input anomalies
MediaPackage	EgressRequestCount 4xx/5xx	Channel	Packaging or origin errors
MediaPackage	IngressBytes	Channel	Ingress drops (encoder not pushing)

---

Step 2: Set Up the DevOps Agent Space

2.1 Verify or Create an Agent Space

aws devops-agent list-agent-spaces --region us-east-1

Note your agentSpaceId. If you don't have one, create it:

1. Navigate to the AWS DevOps Agent console.
2. Choose Create Agent Space.
3. Associate your AWS account with the space — enable access to CloudWatch, CloudWatch Logs, CloudTrail, and X-Ray.

Figure 5: The list-agent-spaces command confirms your Agent Space exists and is ready for use.

2.2 Verify Account Association

aws devops-agent list-associations \
  --agent-space-id your-agent-space-id \
  --region us-east-1

Ensure the account running your media services is associated. This allows DevOps Agent to access the CloudWatch metrics and logs generated by MediaConnect, MediaLive, and MediaPackage during investigation.

---

Step 3: Identify Your Alarm Prefix and Deploy the Integration

3.4 Identify Your Alarm Prefix

Workflow monitor alarm names vary depending on your configuration. Before deploying the EventBridge rule, identify the prefix your alarms use:

# List all media-related alarms in your account
aws cloudwatch describe-alarms \
  --region us-east-1 \
  --query "MetricAlarms[?Namespace=='AWS/MediaConnect' || Namespace=='AWS/MediaLive' || Namespace=='AWS/MediaPackage'].AlarmName" \
  --output table

Common prefixes deployed by workflow monitor include:

Prefix pattern	When it appears
SignalMap-Alarm-	Default signal map alarm deployments
MediaConnect-<TemplateGroup>-	MediaConnect-specific template groups
WorkflowMonitor-	Some workflow monitor configurations

Alternatively, list all alarm prefixes to find yours:

# Find unique prefixes from your alarms
aws cloudwatch describe-alarms \
  --region us-east-1 \
  --query "MetricAlarms[].AlarmName" \
  --output text | tr '\t' '\n' | grep -iE 'signal|media|workflow' | sed 's/\(.*-\).*/\1/' | sort -u

Use the prefix you identify as the AlarmPrefix parameter when deploying the CloudFormation stack below. You can also specify multiple prefixes by deploying separate EventBridge rules, or use a broader prefix (e.g., SignalMap-Alarm-) to capture all workflow monitor alarms at once.

Step 3: Deploy the EventBridge → Lambda → DevOps Agent Integration

3.1 CloudFormation Template

The following CloudFormation template creates an EventBridge rule that matches workflow monitor alarm state changes and invokes a Lambda function to create DevOps Agent investigation tasks.

Save this as media-workflow-monitor-devopsagent.yaml:

AWSTemplateFormatVersion: '2010-09-09'
Description: >-
  Routes AWS Media Services Workflow Monitor alarms to AWS DevOps Agent
  for autonomous incident investigation of live video workflows.

Parameters:
  AgentSpaceId:
    Type: String
    Description: Your DevOps Agent Space ID
  AgentSpaceRegion:
    Type: String
    Default: us-east-1
    Description: Region where the Agent Space resides
  AlarmPrefix:
    Type: String
    Default: 'SignalMap-Alarm-'
    Description: >-
      Prefix to match workflow monitor alarm names. Common values:
      'SignalMap-Alarm-' (default signal map deployments),
      'MediaConnect-' (MediaConnect template groups).
      Run describe-alarms to identify your prefix before deploying.
  Boto3LayerArn:
    Type: String
    Description: >-
      ARN of Lambda Layer containing boto3 with DevOps Agent support.
      Required because the default Lambda runtime may not include the
      devops-agent service client.

Resources:
  # IAM Role for Lambda
  MediaWorkflowInvestigatorRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: CreateDevOpsAgentTask
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: aidevops:CreateBacklogTask
                Resource: !Sub >-
                  arn:aws:aidevops:${AgentSpaceRegion}:${AWS::AccountId}:agentspace/${AgentSpaceId}

  # Lambda Function
  MediaWorkflowInvestigatorFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: media-workflow-monitor-to-devopsagent
      Runtime: python3.13
      Handler: index.lambda_handler
      Role: !GetAtt MediaWorkflowInvestigatorRole.Arn
      Timeout: 30
      ReservedConcurrentExecutions: 10
      Layers:
        - !Ref Boto3LayerArn
      Environment:
        Variables:
          AGENT_SPACE_ID: !Ref AgentSpaceId
          AGENT_SPACE_REGION: !Ref AgentSpaceRegion
      Code:
        ZipFile: |
          import json, os, boto3

          client = boto3.client(
              'devops-agent',
              region_name=os.environ['AGENT_SPACE_REGION']
          )

          # Media service namespace mapping for richer context
          MEDIA_NAMESPACES = {
              'AWS/MediaConnect': 'AWS Elemental MediaConnect',
              'AWS/MediaLive': 'AWS Elemental MediaLive',
              'AWS/MediaPackage': 'AWS Elemental MediaPackage',
              'AWS/MediaPackageV2': 'AWS Elemental MediaPackage v2',
              'AWS/CloudFront': 'Amazon CloudFront'
          }

          def lambda_handler(event, context):
              """
              Triggered by EventBridge when a Workflow Monitor CloudWatch Alarm
              transitions to ALARM state. Creates a DevOps Agent investigation task
              with media-workflow-specific context.
              """
              print(f"Received event: {json.dumps(event)}")

              detail = event.get("detail", {})
              alarm_name = detail.get("alarmName", "Unknown")
              state = detail.get("state", {})
              reason = state.get("reason", "Alarm state changed")
              timestamp = state.get("timestamp", "")
              region = event.get("region", "us-east-1")
              account_id = event.get("account", "")

              # Only investigate ALARM state
              if state.get("value") != "ALARM":
                  print(f"State is {state.get('value')}, skipping")
                  return {'statusCode': 200, 'body': 'Not ALARM state'}

              # Extract metric details for media-specific context
              config = detail.get("configuration", {})
              metrics = config.get("metrics", [])
              metric_context = ""
              service_name = "AWS Media Services"

              if metrics:
                  metric_stat = metrics[0].get("metricStat", {})
                  metric = metric_stat.get("metric", {})
                  namespace = metric.get("namespace", "")
                  metric_name = metric.get("name", "")
                  dimensions = metric.get("dimensions", {})
                  service_name = MEDIA_NAMESPACES.get(namespace, namespace)
                  metric_context = f"\nService: {service_name}"
                  metric_context += f"\nMetric: {namespace}/{metric_name}"
                  if dimensions:
                      metric_context += f"\nDimensions: {json.dumps(dimensions)}"
                      # Extract resource identifiers
                      for key in ['FlowArn', 'ChannelId', 'Channel',
                                   'OriginEndpointId', 'PackagingGroupId']:
                          if key in dimensions:
                              metric_context += f"\nResource ({key}): {dimensions[key]}"

              # Build investigation description
              description = (
                  f"Workflow Monitor Alarm: {alarm_name}\n"
                  f"Service: {service_name}\n"
                  f"AWS Account: {account_id}\n"
                  f"Region: {region}\n"
                  f"State: ALARM\n"
                  f"Reason: {reason}\n"
                  f"Timestamp: {timestamp}"
                  f"{metric_context}\n\n"
                  f"INVESTIGATION GUIDANCE:\n"
                  f"This alarm was deployed by AWS Media Services Workflow Monitor "
                  f"as part of a live video streaming workflow. Investigate:\n"
                  f"1. Check the upstream source - is the encoder/source still "
                  f"   transmitting correctly?\n"
                  f"2. Review CloudWatch metrics for correlated drops across "
                  f"   the signal chain (MediaConnect → MediaLive → MediaPackage).\n"
                  f"3. Check CloudTrail for recent API changes (UpdateFlow, "
                  f"   UpdateChannel, DeleteOriginEndpoint) that may have caused "
                  f"   the disruption.\n"
                  f"4. Look for network-level issues (VPC flow logs, "
                  f"   MediaConnect source disconnections).\n"
                  f"5. Check for scheduled maintenance events via AWS Health "
                  f"   Dashboard."
              )

              # Create investigation task
              resp = client.create_backlog_task(
                  agentSpaceId=os.environ['AGENT_SPACE_ID'],
                  taskType='INVESTIGATION',
                  priority='HIGH',
                  title=f"Media Workflow Alarm: {alarm_name}",
                  description=json.dumps({
                      "summary": description,
                      "incidentId": f"{alarm_name}-{timestamp}",
                      "incidentRegion": region,
                      "event": event
                  })
              )

              task_id = resp.get('taskId', resp.get('backlogTaskId', ''))
              print(f"Created investigation task: {task_id}")

              return {
                  'statusCode': 200,
                  'body': json.dumps({'taskId': task_id})
              }

  # EventBridge Rule - matches Workflow Monitor alarm prefix
  WorkflowMonitorAlarmRule:
    Type: AWS::Events::Rule
    Properties:
      Name: media-workflow-monitor-to-devopsagent
      Description: >-
        Routes Workflow Monitor CloudWatch Alarms to DevOps Agent
        for automated investigation of media service issues.
      State: ENABLED
      EventPattern:
        source:
          - aws.cloudwatch
        detail-type:
          - "CloudWatch Alarm State Change"
        detail:
          alarmName:
            - prefix: !Ref AlarmPrefix
          state:
            value:
              - ALARM
      Targets:
        - Arn: !GetAtt MediaWorkflowInvestigatorFunction.Arn
          Id: DevOpsAgentTarget

  # Lambda permission for EventBridge
  EventBridgeLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref MediaWorkflowInvestigatorFunction
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt WorkflowMonitorAlarmRule.Arn

Outputs:
  FunctionArn:
    Description: Lambda function ARN
    Value: !GetAtt MediaWorkflowInvestigatorFunction.Arn
  RuleArn:
    Description: EventBridge rule ARN
    Value: !GetAtt WorkflowMonitorAlarmRule.Arn

3.2 Create the boto3 Lambda Layer

At time of publication, the Python 3.13 Lambda runtime may not include the devops-agent service client. Create a Lambda layer:

mkdir -p python && pip install boto3 -t python/ && zip -r boto3-layer.zip python

aws lambda publish-layer-version \
  --layer-name boto3-devops-agent \
  --zip-file fileb://boto3-layer.zip \
  --compatible-runtimes python3.13 \
  --query "LayerVersionArn" --output text

Note the returned ARN — you'll use it as the Boto3LayerArn parameter.

3.3 Deploy the Stack

aws cloudformation deploy \
  --template-file media-workflow-monitor-devopsagent.yaml \
  --stack-name media-workflow-monitor-devopsagent \
  --parameter-overrides \
    AgentSpaceId=your-agent-space-id \
    AgentSpaceRegion=us-east-1 \
    AlarmPrefix="SignalMap-Alarm-" \
    Boto3LayerArn="arn:aws:lambda:us-east-1:123456789012:layer:boto3-devops-agent:1" \
  --capabilities CAPABILITY_IAM \
  --region us-east-1

Note: Replace your-agent-space-id with your Agent Space ID and the Boto3LayerArn value with the ARN from the previous step.

Figure 7: The CloudFormation stack deploys successfully, creating the Lambda function, EventBridge rule, and IAM role.

Security Note: For production workloads, consider using AWS Secrets Manager to store sensitive configuration. The environment variables in this template do not contain secrets, but if you extend the function with additional credentials, use Secrets Manager.

---

Step 4: Testing the Integration

4.1 Trigger a Synthetic Alarm

Use set-alarm-state to simulate a workflow monitor alarm without affecting your live workflow:

aws cloudwatch set-alarm-state \
  --alarm-name "WorkflowMonitor-MyLiveWorkflow-MediaConnect-SourceBitRate-flow-abc123" \
  --state-value ALARM \
  --state-reason "Testing DevOps Agent integration - simulated source bit rate drop" \
  --region us-east-1

4.2 Verify Lambda Execution

aws logs tail /aws/lambda/media-workflow-monitor-to-devopsagent \
  --since 5m \
  --region us-east-1

You should see the event payload and a Created investigation task: <taskId> log entry.

4.3 Confirm the Investigation

aws devops-agent list-backlog-tasks \
  --agent-space-id your-agent-space-id \
  --region us-east-1

Look for a task with:

• taskType: INVESTIGATION
• priority: HIGH
• status: IN_PROGRESS
• title: containing your alarm name

4.4 Review DevOps Agent Findings

Open the DevOps Agent console and navigate to your Agent Space. The investigation will show:

Figure 8: The Incident Response Dashboard shows both automated investigations — one triggered from a test alarm (Completed) and one from a real workflow monitor SignalMap-Alarm-ActiveAlerts alarm (In Progress). The Daily investigation frequency chart tracks activity over time.

• Correlated CloudWatch metrics across the media signal chain
• Recent CloudTrail API changes to media resources
• Log pattern analysis from CloudWatch Logs
• Recommended remediation steps

---

Step 5: Best Practices and Customization

5.1 Alarm Prioritization

Not all workflow monitor alarms require the same urgency. Consider extending the Lambda function to map alarm patterns to DevOps Agent priorities:

# Priority mapping based on alarm pattern
PRIORITY_MAP = {
    'SourceBitRate': 'CRITICAL',     # Source loss = immediate viewer impact
    'ActiveAlerts': 'CRITICAL',       # MediaLive active alerts
    'ConnectedOutputs': 'HIGH',       # Output disconnection
    'InputVideoFrameRate': 'HIGH',    # Frame rate drops
    'EgressRequestCount': 'MEDIUM',   # Packaging errors (may self-recover)
    'IngressBytes': 'HIGH',           # Encoder not pushing content
}

# In lambda_handler, determine priority from metric name:
priority = 'HIGH'  # default
for pattern, prio in PRIORITY_MAP.items():
    if pattern.lower() in alarm_name.lower():
        priority = prio
        break

5.2 Filtering Out Flapping Alarms

For metrics that may briefly breach thresholds during transitions (e.g., channel starts/stops), add a brief delay and re-check:

import time

# Wait 30 seconds and recheck
time.sleep(30)
cw_client = boto3.client('cloudwatch', region_name=region)
response = cw_client.describe_alarms(AlarmNames=[alarm_name])
if response['MetricAlarms'][0]['StateValue'] != 'ALARM':
    print(f"Alarm {alarm_name} recovered — skipping investigation")
    return {'statusCode': 200, 'body': 'Alarm self-recovered'}

Note: If you add a delay, increase the Lambda timeout to 60 seconds.

5.3 Multi-Region Workflows

If your live workflow spans multiple AWS Regions (e.g., MediaConnect flows in us-east-1 with MediaLive channels in us-west-2), deploy the CloudFormation stack in each Region. DevOps Agent can investigate across Regions within the same account from a single Agent Space.

5.4 Integrating with Incident Detection and Response (IDR)

If you use AWS Incident Detection and Response, this solution runs in parallel with IDR's 5-minute response. Your on-call engineer receives DevOps Agent findings before the IDR bridge call begins, accelerating the conversation with data-driven context.

---

Cost Awareness

Deploying this integration introduces costs from multiple AWS services. Understand the billing model to avoid surprises during high-alarm-volume periods.

DevOps Agent Pricing

AWS DevOps Agent charges $0.0083 per agent-second ($0.498 per agent-minute) for all operational tasks, including investigations triggered by this integration. A typical media alarm investigation takes 2–5 minutes, costing approximately $1.00–$2.50 per investigation.

Cost estimation example:

Scenario	Alarms/day	Avg. investigation duration	Daily cost	Monthly cost
Stable production workflow	1–2	3 min	~$1.50–$3.00	~$45–$90
Active workflow (multiple sources)	5–10	3 min	~$7.50–$15.00	~$225–$450
Flapping alarms (misconfigured)	50+	3 min	~$75+	~$2,250+

Important: Flapping alarms are the primary cost risk. If a metric oscillates around the threshold, each ALARM state transition triggers a new investigation. Use the flapping alarm filter pattern described in Step 5 to mitigate this.

Other Service Costs

Service	Cost driver	Estimated cost
AWS Lambda	Invocations + duration (30s timeout, 128 MB)	Negligible (~$0.01/month for <1000 invocations)
Amazon EventBridge	Custom rule matching	Free (default bus rules are included)
CloudWatch Alarms	Per-alarm/month (deployed by workflow monitor)	~$0.10/alarm/month (standard resolution)

Cost Control Recommendations

1. Set up budget alerts for DevOps Agent usage — see Setting Up Real-Time Budget Alerts for AWS DevOps Agent Usage for a step-by-step guide.
2. Use the ReservedConcurrentExecutions: 10 setting in the CloudFormation template — this caps the maximum concurrent Lambda invocations, providing a natural throttle during alarm storms.
3. Tune alarm thresholds in workflow monitor to avoid unnecessary triggers. Use the recommended templates as a starting point and adjust based on your workflow's baseline behavior.
4. Implement the flapping alarm filter (Step 5.2) to skip investigations for alarms that self-recover within 30 seconds.
5. Consider alarm composite patterns — CloudWatch composite alarms can combine multiple conditions before firing, reducing false positives that waste DevOps Agent investigation time.

Tip: Monitor your DevOps Agent costs with aws ce get-cost-and-usage --service "AWS DevOps Agent" or via AWS Cost Explorer filtered to the DevOps Agent service.

---

Troubleshooting

Symptom	Check	Fix
No investigation created	Lambda logs: aws logs tail /aws/lambda/media-workflow-monitor-to-devopsagent --since 10m	Verify alarm name matches the prefix in stack parameters
Lambda permission error	"AccessDeniedException" in logs	Verify IAM policy has aidevops:CreateBacklogTask on the correct Agent Space ARN
EventBridge not triggering	aws events describe-rule --name media-workflow-monitor-to-devopsagent	Ensure rule state is ENABLED and pattern matches alarm name prefix
DevOps Agent not investigating	list-backlog-tasks shows PENDING_TRIAGE	Verify account association with the Agent Space and correct IAM role
Alarm name mismatch	Check actual alarm names in CloudWatch console	Workflow monitor may use a different prefix — check your signal map deployment

Configuring a Dead Letter Queue (DLQ)

For production workloads, configure a DLQ to capture failed Lambda invocations:

1. Create an Amazon SQS queue (e.g., media-workflow-monitor-dlq).
2. Add sqs:SendMessage permission to the Lambda execution role.
3. In the Lambda console → Configuration → Asynchronous invocation → set the DLQ to your SQS queue.

---

Cleanup

To remove the integration without affecting your media workflow or DevOps Agent Space:

aws cloudformation delete-stack \
  --stack-name media-workflow-monitor-devopsagent \
  --region us-east-1

This removes the Lambda function, EventBridge rule, and IAM role. Your workflow monitor alarms and Agent Space remain unaffected.

---

Conclusion

By connecting AWS Media Services Workflow Monitor to AWS DevOps Agent through Amazon EventBridge, you create an automated incident investigation pipeline for your live video workflows. Every alarm from your monitored signal chain — whether a source bit rate drop on MediaConnect, an active alert on MediaLive, or a packaging error on MediaPackage — now triggers autonomous investigation that correlates metrics, logs, and recent changes across your entire media pipeline.

This integration provides:

• Faster root cause analysis — DevOps Agent investigates in seconds, not minutes
• End-to-end signal chain visibility — Correlates issues across MediaConnect → MediaLive → MediaPackage → CloudFront
• Parallel response — Works alongside your existing alarm notifications, pager workflows, and IDR engagement
• Media-aware context — The investigation prompt guides DevOps Agent to check upstream sources, correlated pipeline drops, and recent API changes specific to media services

---

References

• Configuring workflow monitor to monitor AWS media services
• Recommended alarm templates for monitoring your AWS media workflow
• Getting started with the workflow monitor for AWS Media Services
• Discover, visualize, and monitor your live video workflows on AWS
• AWS DevOps Agent - Creating an Agent Space
• DevOps Agent CreateBacklogTask API
• How do I automatically trigger AWS DevOps Agent investigations from CloudWatch Alarms and EventBridge rules for ECS tasks?
• Automating AWS DevOps Agent investigation from Incident Detection and Response alarms
• Media and Entertainment Industry - Incident Detection and Response Alarming Best Practices

---

About the author:
Jorge Fernandes Costa is a Technical Account Manager (TAM) at AWS specializing in Media & Entertainment workloads. He helps customers design, operate, and optimize their live video streaming workflows using AWS Elemental Media Services.