Querying AWS DevOps Agent investigations from Kiro CLI for incident response

Introduction

Operations engineers, AWS DevOps teams, and Site Reliability Engineers (SREs) have faced the same fundamental challenge for years: Getting the best information available to the SRE or on-call engineer where they work. The industry has invested heavily in unified dashboards, enriched tickets, and consolidated alerting to try to reduce context-switching, which slows incident resolution. In the AI-enabled SRE world, that interface is rapidly becoming the engineer's preferred AI tool. Whether that is Kiro CLI, Claude Code, or another agentic interface, the on-call engineer increasingly expects their AI assistant to surface the right signals at the right time.

This article completes the incident lifecycle across this three-part series: Detection (Part 1 — Onboarding alarms to AWS Incident Detection and Response, response (Part 2 — Automatically triggering AWS DevOps Agent investigation), and resolution (this article — Bringing investigation findings to the engineer's tool of choice for action). The key to shrinking the incident lifecycle is to address that fundamental challenge of information availability to the SRE or on-call engineer in the interface that they already use. This way, they don’t need to navigate consoles, dashboards, or ticketing systems during a critical incident.

This solution uses Kiro CLI with the AWS MCP Server with an intentionally portable architecture. Because it is on the pluggable MCP standard, you can access the same AWS DevOps Agent capabilities from MCP-compatible clients, Kiro CLI, Claude code, or your organization's preferred agentic interface. This article shows you how your on-call engineer can use AWS DevOps Agent investigation results from an Incident Detection and Response onboarded alarm through their terminal.

Solution overview

This solution uses the AWS MCP Server to connect Kiro CLI to your AWS account. When an on-call engineer opens Kiro CLI, they can use natural language to query the AWS DevOps Agent APIs. Kiro CLI translates these requests into authenticated AWS API calls through AWS MCP Server.

The solution consists of the following components (see Figure 1):

• Kiro CLI: The AI-powered coding agent running in the engineer's terminal.

• AWS MCP Server: A managed remote MCP server that authenticates and routes API calls.

• AWS DevOps Agent APIs: The devops-agent service APIs that expose investigation data (list-backlog-tasks, get-backlog-task, list-journal-records, create-chat).

• AWS DevOps Agent Space: Contains the active investigations that the Amazon EventBridge automation triggers from Part 2.

Figure 1: Kiro CLI to AWS DevOps Agent investigation query architecture

The workflow operates as follows:

1. An alarm fires and AWS DevOps Agent begins investigation automatically (we configured this agent in Part 2).

2. Incident Detection and Response contacts the on-call engineer.

3. The on-call engineer opens Kiro CLI and asks Kiro to check for active investigations in their Agent Space.

4. Kiro CLI uses the AWS MCP Server to call devops-agent list-backlog-tasks and returns the results.

5. The engineer reviews findings and requests for a mitigations plan from AWS DevOps Agent. They then discuss it with the AWS experts available on the call with context from the setup to rapidly resolve the issue.

Prerequisites

This solution requires the following prerequisites:

• Kiro CLI installed on your workstation

• AWS Command Line Interface (AWS CLI) version 2.32 or later installed and configured

• uv package manager installed (for the MCP proxy)

• An active AWS DevOps Agent Space with investigations (set up in Part 2)

• AWS Identity and Access Management (IAM) permissions for `devops-agent` API operations (`aidevops:*` or scoped to your Agent Space)

Note: If you receive errors when you run AWS CLI commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Solution implementation

To implement this solution, complete the following steps:

1. Configure the AWS MCP Server in Kiro CLI.

2. Verify the connection.

3. Query active investigations.

4. Review investigation findings.

5. Initiate mitigation generation.

6. Retrieve the mitigation plan.

7. Apply the fix.

Configure the AWS MCP Server in Kiro CLI

The AWS MCP Server is a managed remote server that translates MCP requests into authenticated API calls through SigV4. To configure AWS MCP Server in Kiro CLI, create or update the file ~/.kiro/settings/mcp.json with the following configuration. Always refer to the latest documentation for updates.

{
"mcpServers": {
"aws-mcp": {
"command": "uvx",
"timeout": 100000,
"transport": "stdio",
"args": [
"mcp-proxy-for-aws@latest",
"https://aws-mcp.us-east-1.api.aws/mcp",\ "--metadata", "AWS_REGION=<your-region>"
]
}
}
}

Note: Replace your-region with the AWS Region where you deployed your AWS DevOps Agent Space. The AWS MCP Server is available in US East (N. Virginia) us-east-1 and Europe (Frankfurt) eu-central-1. The endpoint Region determines which MCP server you connect to, and the AWS_REGION metadata parameter sets the default Region for operations.

Before you start Kiro CLI, check that your AWS credentials are active. If you need to set this up, then refer to the AWS CLI configuration guide. Run the following command on your terminal:

aws sts get-caller-identity

If your credentials have expired, then refresh them through this command:

aws login

Verify the connection

Start Kiro CLI and verify that the AWS MCP Server connected. Run the following command in Kiro CLI:

/mcp

Verify that aws-mcp appears as a connected server. To confirm that the tools are available, run this command:

/tools

Confirm that tools that include aws___call_aws, aws___search_documentation, and aws___run_script appear. These tools allow Kiro CLI to make AWS DevOps Agent API calls on your behalf.

For updated guidance on tools and other MCP capabilities, see the Setting up the AWS MCP Server.

Understand access controls

The AWS MCP Server uses the same AWS credentials configured on the engineer's workstation. Existing IAM controls continue to apply, and the engineer can only perform actions that their IAM principal has authorization to perform. There is no permissions escalation through the MCP layer.

Access governance occurs at three levels:

• IAM permissions: The engineer's IAM role or user must have permissions for the devops-agent API operations, such as aidevops:ListBacklogTasks, aidevops:GetBacklogTask, and aidevops:UpdateBacklogTask. Scope these permissions to specific Agent Space Amazon Resource Names (ARNs) to enforce least privilege.

• Agent Space access: The engineer can only query Agent Spaces that their IAM principal has access to. If your organization operates multiple Agent Spaces (for example, per team or per environment), then IAM resource-level policies control which spaces each engineer can interact with.

• Agent Space associations: AWS DevOps Agent can only investigate resources in accounts associated with the Agent Space. Associations define which accounts, Regions, and services that the agent has permission to query. Even if an engineer has broad IAM permissions, these associations set the boundary of the agent's investigation scope.

This layered model makes sure that the convenience of natural language access doesn’t bypass your organization's existing security boundaries.

Query active investigations

When an on-call engineer receives a page, they open Kiro CLI and ask for active investigations. The following is an example prompt:

Do I have any active DevOps Agent investigations running right now?

Kiro CLI discovers the Agent Space automatically, or engineers can specify one if there are multiple. Then, Kiro CLI calls devops-agent list-backlog-tasks and returns the results. The output shows the investigation tasks, including those that the EventBridge rule triggered automatically from Part 2.

Note: If you have multiple Agent Spaces, then you can be specific: *"Show me investigations in my production Agent Space."* Kiro CLI resolves the name to the correct Agent Space ID. If you operate with multiple Agent Spaces, then you can configure Kiro CLI steering to help reference the right Agent Space and save you time.

For example, filter for only active investigations through this prompt:

Show me only the ones that are still in progress.

Review investigation findings

After you identify the relevant investigation, ask Kiro CLI to retrieve the detailed findings:

What has the agent found so far on the ALB unhealthy hosts investigation?

Kiro CLI calls devops-agent get-backlog-task and devops-agent list-journal-records to retrieve the investigation details and timeline of findings. The journal records contain the agent's observations, correlated signals, and root cause analysis.

Initiate mitigation generation

After AWS DevOps Agent completes the investigation and identifies the root cause, initiate the mitigation agent to generate a structured remediation plan. The mitigation agent takes the investigation findings as input, re-verifies the current state, and produces a complete runbook with rollback steps. This process typically takes 90 seconds to 3 minutes.

To initiate mitigation:

The investigation looks complete. Trigger mitigation generation for this task.

Kiro CLI calls devops-agent update-backlog-task with --task-status PENDING_START. The response confirms that the task is queued with queueingReason HUMAN_APPROVE_MITIGATION — the mitigation agent is now generating the remediation plan.

To check progress:

Is the mitigation plan ready yet?

The task transitions through PENDING_START, IN_PROGRESS, and COMPLETED as the mitigation agent runs.

Retrieve the mitigation plan

When the task returns to COMPLETED, the mitigation agent has produced a structured remediation plan (for example, see Figure 2). Ask Kiro CLI to retrieve it:

Show me the step-by-step guidance and the proposed fix.

Kiro CLI calls devops-agent list-executions to find the mitigation execution. Then, Kiro CLI calls devops-agent list-journal-records with --record-type mitigation_summary_md to retrieve the complete mitigation plan in human-readable markdown. The plan includes:

• Action: The specific remediation to apply (for example, "Add self-referencing inbound rule to security group to allow ALB health checks on port 8080").

• Reasoning: Why this fix addresses the root cause.

• Step-by-step execution plan: Typically five phases: Prepare (capture rollback baseline), pre-validate (confirm broken state), apply (execute the fix), post-validate (verify that the fix worked), and rollback (revert if unsuccessful).

• Exact AWS CLI commands: Ready-to-execute AWS CLI commands for each step, with real resource ARNs from your environment.

• Risk assessment: Security or operational risks that the change introduced.

• Permanent fix specification: Infrastructure as code change, such as Amazon CloudFormation, AWS Cloud Development Kit (CDK), or Terraform, to make the fix permanent.

  

Figure 2: AWS DevOps Agent mitigation plan retrieved through Kiro CLI that shows the structured five-step runbook with executable commands and rollback steps

**Why the mitigation agent produces better fixes than a general-purpose coding agent The mitigation agent has access to the full investigation context: Correlated metrics, AWS CloudTrail events, resource topology, and the confirmed root cause. It re-verifies the current state before proposing a fix, validates the plan against potential violations, and includes rollback steps. A general-purpose coding agent would need to guess the root cause and couldn’t verify your infrastructure’s current state. The mitigation agent produces an operations-grade runbook, not a code snippet.

Apply the fix

With the mitigation plan retrieved, the on-call engineer reviews the steps and asks Kiro CLI to execute them. Because the plan contains exact AWS CLI commands with real resource ARNs, Kiro CLI executes each step directly through the AWS MCP Server:

Apply the fix — run step 3 to add the security group rule.

Kiro CLI executes the command through aws_call_aws, and then the engineer can verify the fix:

Run the post-validation step to confirm the targets are healthy.

If the fix doesn’t resolve the problem within the expected timeframe, then the rollback commands are ready to execute:

The targets are still unhealthy. Run the rollback step to revert the change.

For the permanent fix, the mitigation plan provides a CloudFormation or CDK specification that the engineer can apply to their infrastructure as code repository. This makes sure that the fix persists across future deployments.

The complete incident response workflow

The following image demonstrates the end-to-end workflow across all three parts of this series:

Figure 3: End-to-end incident response — Autonomous investigation and human engagement running in parallel

The on-call engineer arrives at the incident bridge with AWS DevOps Agent already investigating. AWS experts on the bridge discuss the root cause and mitigation steps provided by AWS DevOps Agent before implementing the changes.

Troubleshooting

If the integration doesn't work as expected during testing, then review the following common issues:

Symptom	Check	Fix
AWS MCP tools not available in Kiro CLI	Run `/mcp` to check server status	Verify that ~/.kiro/settings/mcp.json is correct and credentials are active (aws sts get-caller-identity).
"ExpiredTokenException" when querying	AWS credentials have expired	Run aws login to refresh credentials, then restart Kiro CLI.
No investigations found	Agent Space ID or Region is incorrect	Verify with aws devops-agent list-agent-spaces --region <your-region>.
Investigation shows PENDING_TRIAGE	Agent Space lacks observability associations	Run aws devops-agent list-associations --agent-space-id <id> and verify that AWS account association exists.
Journal records empty	The investigation is still in early stages	Wait 30-60 seconds for the agent to collect initial signals, and then query again.

Cleanup

The AWS MCP Server configuration doesn’t create AWS resources. To remove the integration, delete the aws-mcp entry from ~/.kiro/settings/mcp.json and restart Kiro CLI.

Your AWS DevOps Agent Space, investigations, and Incident Detection and Response configuration are unaffected.

Conclusion

By connecting your preferred AI assistant to AWS DevOps Agent through the AWS MCP Server, you can bring autonomous investigation findings directly to the on-call engineer's terminal. This terminal is the same interface where they write code, query infrastructure, and deploy fixes. Through this integration, you reduce the context-switching between consoles, dashboards, and ticketing systems that has historically slowed incident resolution.

The complete workflow across this three-part series transforms incident response from a manual, reactive process to an automated, evidence-driven lifecycle:

• Part 1 — Detection: Onboard workloads and alarms to Incident Detection and Response through the Incident Detection and Response CLI

• Part 2 — Response: Automatically trigger AWS DevOps Agent investigations when alarms fire

• Part 3 — Resolution: Query findings, trigger mitigation, and apply fixes from the engineer's tool of choice (this article)

Because this solution is on the MCP standard, it isn’t limited to Kiro CLI. MCP-compatible clients, such as Claude Desktop, Cursor, Codex, or a custom integration, can access the same AWS DevOps Agent capabilities. Organizations can adopt the agentic interface that best fits their engineering culture while maintaining a consistent, automated incident response workflow.

This integration:

• Brings investigation findings to the engineer where they already work.

• Generates structured mitigation plans with executable commands and rollback steps.

• Reduces mean time to resolution (TTR) by combining autonomous investigation with human expertise.

• Supports MCP-compatible AI tools, giving organizations flexibility in their choice of interface.

To get started, configure the AWS MCP Server in your preferred MCP client. Then, trigger a test alarm to create an investigation (from Part 2), and use the prompts in this article to query the results.

To learn more about how AWS Support plans and offerings can help you get the most out of your AWS environment, see AWS Support. For implementation support and AWS DevOps Agent and Incident Detection and Response configuration guidance, contact your Technical Account Manager (TAM).

Related articles

• Part 1: Accelerating Incident Detection and Response onboarding with the Incident Detection and Response CLI

• Part 2: Automating AWS DevOps Agent investigation from Incident Detection and Response alarms

• AWS MCP Server documentation

• AWS DevOps Agent documentation

• Kiro CLI

About the author

Yomesh Shah Yomesh Shah is a Senior Solutions Architect at AWS. He brings over 25 years of experience helping enterprises maximize the value of their IT investments through optimization, automation, and process improvement. He currently helps AWS customers use scalable AWS Support solutions to enhance operational resilience and incident response capabilities. Yomesh holds a patent for the design of a Managed Services control plane in the cloud (US11856055B2).

Chris Parkyn Chris Parkyn has worked in the IT industry for over 30 years, spanning software development, infrastructure, and operations management. As a Senior TAM at AWS, he partners with global financial services customers to strengthen operational resilience and optimize consumption.