AWS Cloud & Log Intelligence Agent

Inspiration

Debugging complex cloud infrastructure, tracking down obscure IAM permissions errors, and sifting through endless CloudWatch log streams can consume hours of developer time. We wanted to build a solution that transforms raw error logs and configuration snippets into immediate, clear, and actionable troubleshooting steps—ensuring developers spend less time searching for answers and more time building.

What it does

AWS Cloud & Log Intelligence Agent is an automated troubleshooting assistant powered by RAG and Amazon Bedrock. Users can submit AWS error messages, CloudWatch log snippets, or security/IAM configuration files to receive:

• Structured Diagnoses: Immediate identification of root causes with confidence ratings and grounded citations from indexed runbooks.
• Deterministic Signal Extraction & Linting: Pre-LLM parsing to detect AWS error codes, ARNs, HTTP statuses, and security misconfigurations (e.g., wildcard permissions like Action: "*", open security groups like 0.0.0.0/0, or public S3 access).
• Step-by-Step Remediations: Clear, ordered instructions and CLI/console commands to resolve the issue.
• Runtime Document Ingestion: POST /ingest endpoint allowing teams to dynamically upload markdown runbooks, logs, .yaml, or .json files to instantly expand the agent's knowledge base.
• Offline Resiliency: Built-in graceful degradation ensuring that even if the primary LLM is unreachable, an offline pattern-matching engine continues providing diagnostic context from local rules and retrieved documents.

How we built it

• Framework & API: FastAPI backend providing scalable, structured REST endpoints (/query, /ingest, /health).
• Embeddings & Vector Store: BAAI/bge-small-en-v1.5 embeddings integrated with ChromaDB using LangChain markdown-aware splitters for precise semantic chunk retrieval.
• LLM Integration: Amazon Bedrock (utilizing the Converse API) for high-reasoning, structured JSON outputs, with provider-agnostic flexibility for fallback options.
• Pre-Processing Logic: Custom regex engines for exact parameter extraction and policy linting before prompt assembly to eliminate hallucinations.

Challenges we faced

• Handling Context Overhead: Filtering noisy, repetitive raw logs so that only relevant error traces and metadata were sent to the LLM without exceeding token limits or diluting context.
• Ensuring Idempotent Chunking: Developing deterministic document IDs (SHA-1 hashing of source content) so continuous knowledge ingestion on /ingest wouldn't pollute the vector store with duplicate entries.
• Robust Fallback Handling: Ensuring seamless, non-breaking user experiences by designing schema-validated JSON fallback flows when LLM responses were degraded or unavailable during live demos.

Accomplishments that we're proud of

• Zero-Downtime Fallback: Successfully implementing an offline analysis mode that guarantees actionable feedback even without active external API access.
• Sub-Second Signal Detection: Combining regex-based static linting with RAG vector search to highlight obvious security risks instantly.
• Dynamic Knowledge Ingestion: Allowing custom runbooks and logs to be ingested dynamically at runtime without requiring application restarts.

What we learned

• Best practices for optimizing retrieval using query-side BGE embedding instruction prompts.
• Advanced patterns for schema-enforced output generation with Amazon Bedrock Converse API and Pydantic validation.
• How to balance deterministic signal parsing with generative AI reasoning to create high-precision developer tools.

What's next for AWS Cloud & Log Intelligence Agent

• Live AWS Integration: Direct integration with AWS CloudWatch Logs Insights and AWS Health Dashboard.
• Infrastructure as Code (IaC) Parsing: Replacing regex linting with full AST parsing for Terraform, CloudFormation

Built With

• amazon-bedrock
• amazon-web-services
• chromadb
• cloudwatch
• docker
• fastapi
• huggingface
• iam
• langchain
• pydantic
• python
• rag
• rest-api
• sentence-transformers
• uvicorn