"Understaffed operations" and the rise of AIOps
The most severe challenge facing mid-market and SMB infrastructure operations is staffing shortages.
- Chronic shortages of on-call personnel for nights and weekends
- Initial incident triage heavily dependent on a handful of senior engineers
- Logs accumulate, but anomaly detection remains siloed in individual expertise
- Post-mortems are written, but subsequent incidents repeat the same failures
While cloud adoption multiplies infrastructure components, operations headcount remains static. Bridging this gap is why AIOps (AI for IT Operations) is garnering intense interest.
In April 2026, AWS announced that AWS DevOps Agent now supports incident response across Azure and on-premises environments. Expanding an AI agent previously confined to AWS ecosystems into multicloud and hybrid environments lowers adoption barriers for mid-market enterprises that are not AWS-centric.
What is AWS DevOps Agent?
Permissions
AWS DevOps Agent is an AI agent designed to assist operations teams with incident response and routine operational tasks.
| Features | Details |
|---|---|
| Primary incident triage | Receives alerts → Gathers relevant logs → Formulates hypotheses |
| Automated runbook execution | Automates routine remediation (reboots, scaling, notifications) |
| Post-mortem drafting | Generates initial timeline summaries, root-cause hypotheses, and prevention steps |
| Continuous learning | Improves future accuracy using past response histories |
Previously, these workflows relied on the tacit knowledge of SREs and senior infrastructure engineers. Delegating them to AI agents enables teams to automate initial night-time incident handling.
The significance of multicloud support
The critical takeaway of this update is that scope has expanded into non-AWS environments.
- Incident response for Azure VMs, Azure Functions, and AKS
- Log collection and triage for on-premises Kubernetes and VMs
- Cross-cloud correlation analysis in hybrid environments
Many mid-market companies face the reality that they use both AWS and Azure, and on-premises systems still remain. AIOps tools restricted to a single cloud proved unhelpful in actual operations, but multicloud support now allows teams to manage the entire footprint centrally.
Adoption benefits for mid-market enterprises
1. Alleviating night-time on-call burdens
Delegating primary triage to an AI agent drastically reduces human callouts. Routing only genuine decisions and critical tasks to on-call engineers becomes a workable reality.
2. Eliminating knowledge silos
Scenarios where "only one specific engineer understands this alert" can be converted into institutional knowledge stored in the agent's operational history. Because agent prompts and runbooks can be version-controlled in repositories as code assets, this mitigates turnover and reorganization risks.
3. Improving post-mortem quality
Post-mortem writing after incidents often suffers from inconsistent quality because exhausted engineers write them. Having the agent draft the initial review so humans can focus on reviewing and adding insights helps institutional learning stick.
4. Evaluating non-AWS environments on an equal footing
Previously, teams were stuck with disjointed operations across separate tools—Azure Monitor for Azure, CloudWatch for AWS, and Zabbix for on-premises. Multicloud support consolidates everything into a single operational cockpit.
How to approach rollout design
Phase 1: Observation mode (1–2 months)
Start by having the agent observe and propose without executing direct actions.
- Add DevOps Agent as a recipient for existing alerts
- Configure the agent to post proposed remediation plans to Slack only
- Humans execute actions manually as before
- Evaluate the accuracy of the agent's proposals via logs
Phase 2: Approval-based execution (2–3 months)
Where confidence is established, shift to a mode where the agent executes actions only after human approval.
- Low-risk actions such as service reboots and scaling up instances
- Provide single-click approval UI in Slack
- Ensure all execution logs are preserved in Slack and audit logs
Phase 3: Automated execution (3–6 months)
Fully automate recurring, routine responses only.
- Set strict trigger conditions based on "specific alert × time window × execution limit"
- Always preserve escalation pathways to humans
- Conduct weekly human reviews of execution logs
Phase 4: Automated post-mortem generation
The AI agent correlates timelines and logs to create initial post-mortem drafts, which humans finalize. At this stage, operations teams can concentrate on decision-making and continuous learning.
Operational design considerations
1. Enforcing least privilege in permission design
Granting cloud access permissions to an AI agent gives it destructive potential equal to or greater than human actions.
- Strictly enforce least privilege using IAM and RBAC
- Limit automated execution within production environments
- Store audit logs in a separate location outside target cloud accounts
For foundational security architecture, refer to our Basic Web Security Guide, and for Google Workspace environments, see our Google Workspace Security Checklist.
2. Prompt injection defense
If malicious strings are injected into logs or alert text, attacks that compromise agent judgment are theoretically possible. Always sanitize external input strings and deliberately define the boundaries exposed to the agent.
3. Guarding against the "black box" effect
As automation deepens, situations emerge where humans no longer comprehend why a specific remediation was performed.
- Require the agent to post the rationale behind its decisions to Slack
- Perform monthly human reviews of all remediation actions taken by the agent
- Maintain architectures that preserve end-to-end decision traceability
4. Cost monitoring
Invoking AI agents incurs API token costs. Feeding large volumes of logs into models can cause costs to spike rapidly, making input filtering crucial. For cost modeling strategies, our guide on Gemini API Flex and Priority Tiers is also helpful.
Integrating with existing toolchains
| Role | Tool examples |
|---|---|
| Monitoring and alerting | Datadog / New Relic / CloudWatch / Azure Monitor |
| Log aggregation | OpenSearch / Splunk / Loki |
| Communication | Slack / Microsoft Teams / Google Chat |
| Runbooks | Ansible / Terraform / Step Functions |
| AI agent | AWS DevOps Agent + Claude / Bedrock |
AWS DevOps Agent is not a standalone replacement tool, but a component designed to integrate into your existing operations stack. Phased substitution while preserving existing assets represents the most practical path.
Projected ROI for mid-market businesses
| Item | Traditional | After adoption |
|---|---|---|
| Night-time on-call callouts | 30–50 per month | 5–15 per month |
| Initial triage duration | 30–60 min average | 5–10 min average |
| Post-mortem authoring effort | 2–4 hours per incident | 30–60 min per incident |
| Knowledge silo risk | High | Medium |
Achieving financial returns equivalent to several million to 10 million yen annually in labor costs is not uncommon. Furthermore, enabling senior engineers to dedicate time to strategic initiatives provides substantial qualitative value.
Conclusion
AWS DevOps Agent's multicloud support represents a practical stepping stone for mid-market businesses adopting AIOps.
- Context: Simultaneous challenges of labor shortages and multicloud expansion
- Capabilities: Primary triage, runbook execution, post-mortem generation, continuous learning
- Rollout phases: Observation → Approval-based execution → Automated execution → Automated post-mortems
- Key considerations: Least privilege, prompt injection defense, black box prevention, cost monitoring
For foundational automation preceding full AIOps, our Complete MCP Guide and Claude Code Workflow serve as helpful references.
At GleamHub, we support mid-market enterprises with multicloud operational architecture, AIOps implementation partnerships, and runbook formalization. If your operations team struggles with on-call fatigue or knowledge silos, please reach out to us.
References
