Simplifying AWS resource troubleshooting with Amazon Bedrock Agents and AWS Support Automation Workflows (SAW) Part 2 - A hands-on guide to integrating various runbooks

Explains the integration pattern of keeping Amazon Bedrock Agent as a single interface while continuously expanding AWS Support Automation Workflows (SAW) runbooks. Building on the troubleshooting solution created in Part 1, this post adds a new runbook to extend the solution to handle more AWS resource issues in production environments.

The solution consists of five main components.

• Amazon Bedrock Agent: The interface that understands natural language requests and manages conversation flow
• Agent Action Group: A set of API operations defined by an OpenAPI schema
• Lambda function: Handles parameter validation and runbook execution between the agent and SAW
• IAM role: Provides execution permissions based on the principle of least privilege
• SAW runbook: Standard diagnostic automation created by the AWS Support Engineering team

The procedure for attaching a new SAW runbook is also clearly defined.

1. Choose the runbook to integrate and check the required inputs and permissions in the official AWS documentation.
2. Identify the step where results can be checked, i.e., the runbook's final output point.
3. Add a new path and request body to the OpenAPI schema.
4. Create a new endpoint in lambda/saw_troubleshooting/app.py and call the runbook using execute_automation.
5. Add the required IAM permissions in lib/bedrock-agent-saw-stack.ts.
6. Redeploy the CDK and test the behavior in the Bedrock Agent console.

As an example, the AWSSupport-TroubleshootCloudWatchAgent runbook is integrated. This runbook requires InstanceId and S3UploadBucket as mandatory inputs, and the execution results are collected at the outputFindings step and passed to the agent. The required permissions include ec2:DescribeInstances, several iam:* lookup permissions, ssm:DescribeInstanceInformation, ssm:SendCommand, ssm:GetCommandInvocation, ssm:DescribeInstanceAssociationsStatus, and ssm:StartAutomationExecution.

The core message is that other SAW runbooks can continue to be attached using the same pattern. This makes it possible to build an operations platform that diagnoses issues across the entire AWS infrastructure—including EC2, EKS, RDS, VPC, CloudWatch, Lambda, and Elastic Beanstalk—based on natural language.