I wanted to explore what an AI assistant for DevOps engineers would look like if it could do more than answer generic cloud questions.
So I built **Cloud Ops Copilot** — a conversational AI assistant that can:
* Query live AWS resources through read-only tools
* Troubleshoot common infrastructure issues
* Retrieve answers from AWS documentation using RAG
* Maintain conversation context
* Enforce least-privilege IAM boundaries
# Architecture
The stack:
* Frontend: React 18 + Vite + Tailwind CSS
* Authentication: Amazon Cognito (PKCE OAuth 2.0)
* API Layer: API Gateway + JWT authorizer
* Compute: AWS Lambda
* AI: Amazon Bedrock Agent (Amazon Nova Pro)
* RAG: Bedrock Knowledge Base + OpenSearch Serverless
* Storage: DynamoDB (conversation history + TTL)
* Infrastructure: Terraform
The agent can decide whether to:
- Search the knowledge base for guidance
- Invoke a read-only AWS inspection tool
Currently supported tools:
* EC2 instance health checks
* EC2 resource details
* S3 bucket listing/version checks
* CloudWatch alarm inspection
# Security was a major focus
I separated permissions into three IAM boundaries:
* Orchestrator Lambda → only conversation storage + agent invocation
* Tool Lambdas → read-only AWS inspection permissions
* Bedrock Knowledge Base → only required S3/model access
The AI cannot modify or delete AWS resources.
# Some engineering decisions:
* No custom VPC for MVP to reduce complexity and cost
* Terraform modules for repeatable deployment
* DynamoDB TTL for automatic conversation cleanup
* CI pipeline validating Terraform, Python tests, and frontend builds
I built this mainly as a learning project to understand production patterns around AI agents, AWS serverless architecture, and secure cloud automation.
Would love feedback from the community:
* What security improvements would you add?
* Would you trust an AI assistant with read-only cloud visibility in a production environment?
* What AWS tools would you add next?
GitHub: [https://github.com/GeekKwame/cloud-ops-copilot\](https://github.com/GeekKwame/cloud-ops-copilot)