Autonomous Root Cause Analysis for AWS Systems Manager Patch Failures Using AWS DevOps Agent

This article demonstrates how to build an event-driven solution using AWS DevOps Agent to automatically investigate and determine root causes of AWS Systems Manager patch failures across multiple accounts and regions.

• EventBridge captures patch failure events from Systems Manager and forwards them across accounts
• Lambda function deduplicates, enriches failures with fleet context, and triggers AWS DevOps Agent investigations
• AWS DevOps Agent autonomously correlates logs, configuration state, and infrastructure changes to identify root causes
• Solution uses centralized architecture with workload accounts forwarding events to primary account
• Includes filtering for tagged instances, deduplication windows, and per-command throttling to prevent duplicate investigations
• Provides CloudFormation templates for multi-account deployment via StackSets
• Reduces investigation time from hours to minutes with structured findings and evidence chains
• Supports continuous learning as each investigation contributes to Agent Space knowledge base

This event-driven automation eliminates manual log correlation across accounts and regions, enabling operations teams to quickly identify whether patch failures share common root causes or represent independent node-specific issues.