Bedrock DevOps Demo

Team

Model

Max Tokens

Team

Model

Select a document to summarize:

🏗️ AWS Well-Architected Framework

~80K tokens • Cloud architecture best practices

📖 Amazon Bedrock User Guide

~50K tokens • Service documentation & API patterns

🦙 Meta Llama 4 Research Paper

~100K tokens • Model architecture & training

Select a document above and click "Summarize" to see the AI-generated summary via PrivateLink.

Bedrock Incident Simulator

Trigger real Bedrock errors to test the DevOps Agent investigation flow.
Each scenario sends a request that causes an error → CW Alarm fires → DevOps Agent investigates.

🔴 Deprecated Model (ValidationException)

Calls claude-3-haiku (EOL) → "model identifier is invalid"

Maps to: Model EOL migration issue

🟠 Invalid Parameters (ValidationException)

Sends temperature + topP to Opus 4.7 → "cannot both be specified"

Maps to: Meta Case #2 (parameter conflict)

🟣 Max Tokens Exceeded (ValidationException)

Requests 999,999 output tokens → exceeds model's max output limit

Maps to: Meta Case #2 (parameter validation failure)

🟡 Non-existent Model (ValidationException)

Calls a completely fake model ID → "model identifier is invalid"

Maps to: Misconfiguration / typo in model ID

🔌 PrivateLink Connectivity Failure

Blocks Lambda SG egress → next request times out → DevOps Agent investigates network

Maps to: Network misconfiguration / SG change

⚪ NLB Targets Unhealthy

Deregisters NLB targets → health checks fail → DevOps Agent investigates NLB

Maps to: Infrastructure failure / target group misconfiguration

🟡 429 Throttling (Synthetic)

Publishes throttle metrics → alarm fires in 10s → DevOps Agent investigates quota

Maps to: Meta Case #3/#4 (TPM/RPM quota exceeded)

📘 Best practices: Scale & Reliability on Bedrock

🔴 503 Capacity Exhaustion (Synthetic)

Publishes server error metrics → alarm fires in 10s → DevOps Agent investigates

Maps to: Meta Case #1/#5 (model fleet capacity exhaustion)

📘 Best practices: Scale & Reliability on Bedrock

Incident log will appear here...

DynamoDB Load Test

Simulates high write throughput against a provisioned DynamoDB table. When throttling occurs, CloudWatch Alarm fires → DevOps Agent investigates.

Intensity (requests/sec) 10 req/s

Duration (seconds)

Live Statistics

Requests Sent 0

Successful 0

Throttled 0

Error Rate 0%

Elapsed 0s

CW Alarm Status —

DevOps Agent —

End-to-End Architecture

Cross-Account PrivateLink Architecture

┌─────────────────────────────────────────────────────────────────────────────┐
│                    SPOKE ACCOUNT (us-east-1) — Consumer                      │
│                                                                              │
│  ┌──────────────┐     ┌─────────────┐     ┌──────────────────────────────┐  │
│  │  CloudFront  │────▶│ API Gateway │────▶│  Lambda (VPC)                │  │
│  │  + S3 (UI)   │     │  /api/*     │     │  • ConverseStream            │  │
│  └──────────────┘     └─────────────┘     │  • Per-team role assumption  │  │
│                                            │  • Cost attribution          │  │
│                                            └──────────────┬───────────────┘  │
│                                                           │ HTTPS :443       │
│                                                           ▼                  │
│                                            ┌──────────────────────────────┐  │
│                                            │  VPC Endpoint Interface       │  │
│                                            │  (Cross-Region PrivateLink)   │  │
│                                            │  ServiceRegion: us-east-2     │  │
│                                            └──────────────┬───────────────┘  │
└───────────────────────────────────────────────────────────┼──────────────────┘
                                                            │
                                               ╔════════════╧════════════╗
                                               ║  AWS PrivateLink        ║
                                               ║  Cross-Region Traffic   ║
                                               ║  (private, encrypted)   ║
                                               ╚════════════╤════════════╝
                                                            │
┌───────────────────────────────────────────────────────────┼──────────────────┐
│                    HUB ACCOUNT (us-east-2) — Provider                         │
│                                                           │                  │
│                                            ┌──────────────▼───────────────┐  │
│                                            │  VPC Endpoint Service         │  │
│                                            │  (No acceptance required)     │  │
│                                            └──────────────┬───────────────┘  │
│                                                           │                  │
│                                            ┌──────────────▼───────────────┐  │
│                                            │  Network Load Balancer        │  │
│                                            │  (Internal, TCP :443)         │  │
│                                            └───┬──────────┬──────────┬────┘  │
│                                                │          │          │       │
│                                            ┌───▼───┐  ┌───▼───┐  ┌──▼────┐  │
│                                            │Target │  │Target │  │Target │  │
│                                            │10.1.1x│  │10.1.2x│  │10.1.3x│  │
│                                            └───┬───┘  └───┬───┘  └───┬───┘  │
│                                                └──────────┼──────────┘       │
│                                            ┌──────────────▼───────────────┐  │
│                                            │  Bedrock VPC Endpoints        │  │
│                                            │  • bedrock-runtime            │  │
│                                            │  • bedrock-agent-runtime      │  │
│                                            └──────────────┬───────────────┘  │
└───────────────────────────────────────────────────────────┼──────────────────┘
                                                            │
                                                            ▼
                                               ┌────────────────────────┐
                                               │   Amazon Bedrock       │
                                               │   (US CRIS Routing)    │
                                               │                        │
                                               │   us-east-1 / us-east-2│
                                               │   / us-west-2          │
                                               └────────────────────────┘

Cost Attribution Flow (Gateway Pattern)

┌─────────────┐     ┌─────────────────┐     ┌──────────────────────┐     ┌─────────────┐
│  Web UI     │────▶│  Lambda         │────▶│  STS AssumeRole      │────▶│  Bedrock    │
│  (team      │     │  (Gateway)      │     │  per-team role       │     │  (invoked   │
│  selector)  │     │                 │     │                      │     │  as team)   │
└─────────────┘     └─────────────────┘     └──────────────────────┘     └─────────────┘
                                                      │
                                                      ▼
                                            ┌──────────────────────┐
                                            │  CUR 2.0 shows:      │
                                            │  iamPrincipal/team   │
                                            │  = ml-platform       │
                                            │  = data-science      │
                                            │  = product-eng       │
                                            └──────────────────────┘

Incident → DevOps Agent Investigation Flow

┌─────────────┐     ┌─────────────┐     ┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│  Error      │────▶│  CloudWatch │────▶│  SNS Topic  │────▶│  Webhook    │────▶│  DevOps     │
│  Occurs     │     │  Alarm      │     │             │     │  Lambda     │     │  Agent      │
│             │     │  (10s)      │     │             │     │  (HMAC)     │     │             │
└─────────────┘     └─────────────┘     └─────────────┘     └─────────────┘     └──────┬──────┘
                                                                                        │
     ┌──────────────────────────────────────────────────────────────────────────────────┘
     │
     ▼
┌─────────────────────────────────────────────────────────────────────────────┐
│  DevOps Agent Investigation:                                                 │
│                                                                              │
│  1. Checks CloudWatch Logs (Lambda errors, Bedrock invocation logs)          │
│  2. Checks CloudTrail (recent deployments, config changes)                   │
│  3. Inspects Lambda code (GetFunction)                                       │
│  4. Checks NLB health, VPC Endpoint status                                  │
│  5. Correlates timeline (error start → deployment → config change)           │
│  6. Posts findings to Slack (#meta-bedrockdevops-agent-investigation)        │
│                                                                              │
└─────────────────────────────────────────────────────────────────────────────┘

CloudFormation Stacks

Stack	Account	Resources
bedrock-devops-demo-spoke-vpc	Spoke	VPC, 3 subnets, IGW, SSM/STS/S3 endpoints
bedrock-devops-demo-hub-vpc	Hub	VPC, 3 subnets, IGW
bedrock-devops-demo-hub	Hub	Bedrock VPCEs, NLB, VPCE Service, Invocation Logging
bedrock-devops-demo-spoke	Spoke	VPCE Interface, STS endpoint, Test Lambda
bedrock-devops-demo-cost-attribution	Hub	Per-team IAM roles (ml-platform, data-science, product-eng)
bedrock-devops-demo-monitoring	Hub	NLB/VPCE alarms, CloudWatch dashboard
bedrock-devops-demo-observability	Hub	Metric filters, Bedrock alarms, VPC Flow Logs, Ops dashboard
bedrock-devops-demo-web-ui	Spoke	CloudFront, S3, API GW, Lambdas, DynamoDB, Alarms
bedrock-devops-demo-agent-space	Spoke	DevOps Agent Space, IAM roles, Associations

⚡ Bedrock DevOps Demo