AWS DevOps Agent 検証 — EventBridge 連携で調査完了を自動通知する

REGION=ap-northeast-1
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
 
# CloudWatch Logs グループ
aws logs create-log-group --log-group-name /aws/events/devops-agent --region $REGION
aws logs put-retention-policy --log-group-name /aws/events/devops-agent \
  --retention-in-days 7 --region $REGION
 
# EventBridge ルール（全 DevOps Agent イベント）
aws events put-rule \
  --name devops-agent-all-events \
  --event-pattern '{"source":["aws.aidevops"]}' \
  --state ENABLED --region $REGION
 
# CloudWatch Logs へのリソースベースポリシー
aws logs put-resource-policy \
  --policy-name EventBridgeToDevOpsAgentLogs \
  --policy-document "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"events.amazonaws.com\"},\"Action\":[\"logs:CreateLogStream\",\"logs:PutLogEvents\"],\"Resource\":\"arn:aws:logs:${REGION}:${ACCOUNT_ID}:log-group:/aws/events/devops-agent:*\"}]}" \
  --region $REGION
 
# ターゲット設定
aws events put-targets \
  --rule devops-agent-all-events \
  --targets "Id=cwlogs,Arn=arn:aws:logs:${REGION}:${ACCOUNT_ID}:log-group:/aws/events/devops-agent" \
  --region $REGION

aws sns create-topic --name devops-agent-notifications --region $REGION
 
aws sns subscribe \
  --topic-arn "arn:aws:sns:${REGION}:${ACCOUNT_ID}:devops-agent-notifications" \
  --protocol email \
  --notification-endpoint "your-email@example.com" \
  --region $REGION

aws iam create-role \
  --role-name DevOpsAgentEventBridgeLambdaRole \
  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}'
 
aws iam attach-role-policy \
  --role-name DevOpsAgentEventBridgeLambdaRole \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

aws iam put-role-policy \
  --role-name DevOpsAgentEventBridgeLambdaRole \
  --policy-name DevOpsAgentSNSAccess \
  --policy-document "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"aidevops:ListJournalRecords\"],\"Resource\":\"*\"},{\"Effect\":\"Allow\",\"Action\":\"sns:Publish\",\"Resource\":\"arn:aws:sns:${REGION}:${ACCOUNT_ID}:devops-agent-notifications\"}]}"

import json
import os
import boto3
 
devops_agent = boto3.client("devops-agent")
sns = boto3.client("sns")
 
SNS_TOPIC_ARN = os.environ["SNS_TOPIC_ARN"]
 
 
def lambda_handler(event, context):
    print(json.dumps(event))
 
    detail = event.get("detail", {})
    metadata = detail.get("metadata", {})
    data = detail.get("data", {})
 
    agent_space_id = metadata.get("agent_space_id", "")
    task_id = metadata.get("task_id", "")
    execution_id = metadata.get("execution_id", "")
    summary_record_id = data.get("summary_record_id")
    detail_type = event.get("detail-type", "")
    priority = data.get("priority", "")
    status = data.get("status", "")
 
    # サマリ取得
    summary_text = "(no summary available)"
    if summary_record_id and execution_id:
        try:
            records = devops_agent.list_journal_records(
                agentSpaceId=agent_space_id,
                executionId=execution_id,
            )
            for r in records.get("records", []):
                if r.get("recordId") == summary_record_id:
                    summary_text = r.get("content", "(no content)")
                    break
        except Exception as e:
            summary_text = f"(failed to retrieve summary: {e})"
 
    # SNS 通知
    subject = f"[DevOps Agent] {detail_type} - {priority}"
    message = (
        f"Event: {detail_type}\n"
        f"Status: {status}\n"
        f"Priority: {priority}\n"
        f"Task ID: {task_id}\n"
        f"エージェントスペース: {agent_space_id}\n"
        f"\n--- Investigation Summary ---\n\n"
        f"{summary_text}"
    )
 
    # SNS subject は 100 文字制限
    if len(subject) > 100:
        subject = subject[:97] + "..."
 
    # SNS message は 256KB 制限
    max_bytes = 256 * 1024
    if len(message.encode("utf-8")) > max_bytes:
        message = message[:max_bytes // 4] + "\n\n(truncated due to SNS size limit)"
 
    sns.publish(TopicArn=SNS_TOPIC_ARN, Subject=subject, Message=message)
 
    return {"statusCode": 200, "body": "Notification sent"}

# lambda_function.py を作成後、boto3 をバンドルしてデプロイ
mkdir lambda-pkg && cd lambda-pkg
pip install boto3 -t . --quiet
cp ../lambda_function.py .
zip -r lambda_function.zip .
 
aws lambda create-function \
  --function-name devops-agent-notification \
  --runtime python3.13 \
  --handler lambda_function.lambda_handler \
  --role "arn:aws:iam::${ACCOUNT_ID}:role/DevOpsAgentEventBridgeLambdaRole" \
  --zip-file fileb://lambda_function.zip \
  --timeout 30 \
  --environment "Variables={SNS_TOPIC_ARN=arn:aws:sns:${REGION}:${ACCOUNT_ID}:devops-agent-notifications,PYTHONPATH=/var/task}" \
  --region $REGION

aws events put-rule \
  --name devops-agent-investigation-completed \
  --event-pattern '{"source":["aws.aidevops"],"detail-type":["Investigation Completed"]}' \
  --state ENABLED --region $REGION
 
aws lambda add-permission \
  --function-name devops-agent-notification \
  --statement-id EventBridgeInvoke \
  --action lambda:InvokeFunction \
  --principal events.amazonaws.com \
  --source-arn "arn:aws:events:${REGION}:${ACCOUNT_ID}:rule/devops-agent-investigation-completed" \
  --region $REGION
 
aws events put-targets \
  --rule devops-agent-investigation-completed \
  --targets "Id=lambda,Arn=arn:aws:lambda:${REGION}:${ACCOUNT_ID}:function:devops-agent-notification" \
  --region $REGION

REGION=ap-northeast-1
INSTANCE_ID=<your-instance-id>
 
# stress-ng で CPU 高負荷を発生（2分間）
aws ssm send-command \
  --instance-ids $INSTANCE_ID \
  --document-name "AWS-RunShellScript" \
  --parameters '{"commands":["nohup stress-ng --cpu 2 --timeout 120 > /dev/null 2>&1 &"]}' \
  --region $REGION

import boto3
 
client = boto3.client("devops-agent", region_name="ap-northeast-1")
 
response = client.create_backlog_task(
    agentSpaceId="<your-agent-space-id>",
    taskType="INVESTIGATION",
    title="CPU spike on web-app-prod-01",
    description="インスタンスで CPU 使用率が高い状態が続いている。原因を調査してほしい。",
    priority="HIGH"
)
print(response["task"]["taskId"])

REGION=ap-northeast-1
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
 
# EventBridge ルール削除
aws events remove-targets --rule devops-agent-investigation-completed \
  --ids lambda --region $REGION
aws events delete-rule --name devops-agent-investigation-completed --region $REGION
 
aws events remove-targets --rule devops-agent-all-events \
  --ids cwlogs --region $REGION
aws events delete-rule --name devops-agent-all-events --region $REGION
 
# Lambda 関数削除
aws lambda delete-function --function-name devops-agent-notification --region $REGION
 
# IAM ロール削除
aws iam delete-role-policy --role-name DevOpsAgentEventBridgeLambdaRole \
  --policy-name DevOpsAgentSNSAccess
aws iam detach-role-policy --role-name DevOpsAgentEventBridgeLambdaRole \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
aws iam delete-role --role-name DevOpsAgentEventBridgeLambdaRole
 
# SNS トピック削除
aws sns delete-topic \
  --topic-arn "arn:aws:sns:${REGION}:${ACCOUNT_ID}:devops-agent-notifications" \
  --region $REGION
 
# CloudWatch Logs 削除
aws logs delete-log-group --log-group-name /aws/events/devops-agent --region $REGION
aws logs delete-resource-policy --policy-name EventBridgeToDevOpsAgentLogs --region $REGION
 
# Lambda ログ削除
aws logs delete-log-group \
  --log-group-name /aws/lambda/devops-agent-notification --region $REGION