GS Retail Innovates Operations Automation with AIOps Agent

GS Retail operates large-scale retail services 24/7, spanning over 18,000 stores nationwide, an O4O platform, and home shopping. However, when an incident occurred, operators had to navigate an average of 5-6 tools including Datadog, Bitbucket, Confluence, AWS, EKS, DB, and analysis took an average of over 30 minutes.

To solve this problem, the Cloud Infrastructure Team built an AIOps Agent that injects the mindset of a skilled SRE into AI. The core is combining Amazon Bedrock Converse API with Model Context Protocol (MCP), enabling AI to autonomously select the appropriate tools for each situation, interpret results, and trace root causes to completion.

The design criteria were three-fold:

• Tool utilization capability: The model must be able to directly call external tools and continue reasoning
• Balance of cost and quality: Fast Claude Sonnet series for repeated investigation, Claude Opus 4.5 for final judgment
• Integration with existing operational tools: AI directly uses 7 or more tools including Datadog, Bitbucket, Confluence, AWS, EKS, PostgreSQL, OpenSearch

The operational flow was automated from incident detection to report writing. Datadog Webhook sends events to Amazon EventBridge, and the Data Filter Worker on ECS Fargate performs deduplication and severity classification before storing in DynamoDB. The AI Orchestration Worker then detects the NEW status and begins analysis, cycling through tool calls to synthesize logs, metrics, traces, commit history, EKS status, and DB queries.

The core of the agent is dynamic tool loading and autonomous Thinking logic. If an incident is a DB failure, it selectively loads PostgreSQL tools; for K8s issues, EKS tools; for code issues, Bitbucket tools, reducing token cost and confusion. The system prompt also embeds principles such as "don't just list symptoms, trace why it occurred to the end," "if in doubt, always verify directly," and "distinguish between speculation and fact," driving repeated 5 Whys-style root cause analysis.

Once analysis is complete, the results are saved as an RCA report in Confluence, and a summary notification is automatically sent to the Microsoft Teams channel. Operators can immediately check the cause of an incident and recommended actions directly in Teams, without a separate dashboard.

The implemented technology stack is as follows.

• Datadog MCP: Directly queries metrics, logs, and APM traces for 16 organizations via the official server
• Bitbucket MCP: Traces deployment causes through recent commits, PR changes, and code search
• AWS / EKS / PostgreSQL / OpenSearch MCP: Analyzes infrastructure status, Pod events, slow queries, and log patterns
• RAG: Searches for similar past incident cases using Amazon S3 Vectors and Titan Embeddings v2

As a result of this structure, incident analysis time was reduced from an average of 30 minutes to about 2 minutes, a 93% reduction. This represents a shift from an operational approach where humans moved from one tool to another, to an autonomous operational system where AI gathers evidence and narrows down causes on its own.