awsobservabilityPractitioner

Mastering Closed-Loop Incident Response: Connect AWS DevOps Agent to OpenSearch

5 min read AWS DevOps BlogOct 2, 2026Reviewed for accuracy

Practitioner — Hands-on experience recommended

Closed-loop incident response is essential for maintaining operational integrity in modern applications. By connecting the AWS DevOps Agent to OpenSearch, you can streamline your incident response workflow, ensuring that alerts lead to actionable insights. This setup allows your applications to emit logs and traces directly to OpenSearch, where alerting monitors can detect anomalies and trigger responses, ultimately improving your incident management process.

The architecture operates in six stages: first, applications emit logs and traces to OpenSearch. Alerting monitors detect anomalies and publish notifications to Amazon SNS. This triggers a webhook forwarder AWS Lambda function, which transforms notifications into HMAC-signed payloads for the agent’s Event Channel. The AWS DevOps Agent then queries OpenSearch indices through MCP, correlating data with CloudTrail and CloudWatch to deliver a root cause analysis. Key configuration parameters include the OpenSearchEndpoint, AWSRegion, and AgentName, which you need to set up correctly for seamless integration.

In production, ensure that fine-grained access control (FGAC) is properly configured to manage the AWS DevOps Agent's access to logs and traces. Be aware that the Network Load Balancer (NLB) must have a security group attached at creation time, as it cannot be modified later. Also, remember that the OpenSearch MCP servers utilize streamable-HTTP transport, which requires an NLB for proper operation, as Application Load Balancers (ALBs) may disrupt the Server-Sent Events (SSE) stream. This integration is supported in OpenSearch versions 3.3 and above, so ensure your environment meets this requirement.

Key takeaways

→Connect AWS DevOps Agent to OpenSearch using the Model Context Protocol (MCP) for effective incident response.
→Configure fine-grained access control (FGAC) to manage access to logs and traces in OpenSearch.
→Deploy the MCP server behind a Network Load Balancer (NLB) to avoid issues with Server-Sent Events (SSE).
→Set the OpenSearchEndpoint, AWSRegion, and AgentName parameters correctly for seamless integration.
→Ensure your OpenSearch version is 3.3 or higher to support this functionality.

Why it matters

This integration significantly reduces the time to detect and respond to incidents, enhancing your operational efficiency and minimizing downtime. A closed-loop system allows for real-time insights, which is critical in maintaining service reliability.

Code examples

Bash

1# Generate a self-signed cert whose SAN matches the NLB DNS, then import to ACM
2openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
3  -keyout /tmp/mcp-key.pem -out /tmp/mcp-cert.pem \
4  -subj "/CN=mcp-server" -addext "subjectAltName=DNS:<your-nlb-dns>"
5aws acm import-certificate --certificate fileb:///tmp/mcp-cert.pem \
6  --private-key fileb:///tmp/mcp-key.pem --region <region> \
7  --query "CertificateArn" --output text

JavaScript

1// Representative wiring — adapt into your CDK app (full construct in the linked Guidance).
2// Fargate task runs the MCP server; grant it read on the domain (FGAC handles index auth).
3taskDef.addContainer('mcp', {
4  image: ecs.ContainerImage.fromRegistry('python:3.12-slim'),
5  command: ['sh','-c', 'pip install opensearch-mcp-server-py --quiet && '
6    + 'opensearch-mcp-server-py --transport stream --host 0.0.0.0 --port 8080'],
7  environment: { OPENSEARCH_URL: https://${props.openSearchDomain.domainEndpoint},
8    OPENSEARCH_USE_SSL: 'true' }, portMappings: [{ containerPort: 8080 }] });

Bash

cdk deploy --require-approval broadening --region <region>

When NOT to use this

The official docs don't call out specific anti-patterns here. Use your judgment based on your scale and requirements.

Want the complete reference?

Read official docs

Test what you just learned

Quiz questions written from this article

Take the quiz →

DigitalOceanSponsor

Simple, affordable cloud — VMs, Kubernetes, and managed databases in minutes. Trusted by 600,000+ developers. Spin up a Droplet in 60 seconds.

Try DigitalOcean →

Mastering Closed-Loop Incident Response: Connect AWS DevOps Agent to OpenSearch

Key takeaways

Why it matters

Code examples

When NOT to use this

More on this topic

Unlocking Observability: How Amazon CloudWatch Omni Transforms Application Monitoring

Unlocking AI Observability with Amazon CloudWatch Omni

Unlocking AWS Elastic Beanstalk's Cluster Mode: A Game Changer for Microservices