aws-cloud-ops-power

⚡ AWS Cloud Operations Power

A Kiro Power for Autonomous AWS Cloud Operations

Turn every developer into a Senior SRE. Collapse 8 AWS console tabs and 45 minutes of incident investigation into a single conversation.

┌─────────────────────────────────────────────────────────────────────┐
│                                                                     │
│   "Production is down!"                                             │
│                                                                     │
│   Without aws-cloud-ops:              With aws-cloud-ops:           │
│   ┌──────────────────────┐            ┌──────────────────────────┐  │
│   │ 🔍 CloudWatch tab    │            │ You: "Lambda timeouts     │  │
│   │ 📋 CloudTrail tab    │            │       since 3:42 PM"      │  │
│   │ 🔭 X-Ray tab         │    VS      │                           │  │
│   │ 💰 Cost Explorer     │            │ AI: Root cause found in   │  │
│   │ 🛡️ GuardDuty tab     │            │ 30 seconds:               │  │
│   │ 🏗️ Config tab        │            │ IAM policy removed by     │  │
│   │ 📊 Trusted Advisor   │            │ terraform at 3:38 PM ✅   │  │
│   │ 😱 3 Slack threads   │            └──────────────────────────┘  │
│   │ ⏱️  45 minutes later │                                          │
│   └──────────────────────┘                                          │
└─────────────────────────────────────────────────────────────────────┘

---

🎯 What This Power Does

This is a Kiro Power — a specialized context package that gives Kiro's AI agents on-demand access to AWS APIs, observability data, and SRE runbooks. It activates automatically when you mention AWS-related problems, and brings 8 expert workflows into your IDE conversation.

                    ┌─────────────────────────────────┐
                    │      aws-cloud-ops Power         │
                    │                                 │
                    │  Keywords trigger activation:   │
                    │  "incident" "outage" "deploy"   │
                    │  "blast-radius" "chaos" "cost"  │
                    │  "guardduty" "fis" "sre" ...    │
                    └──────────────┬──────────────────┘
                                   │
           ┌───────────────────────┼───────────────────────┐
           ▼                       ▼                       ▼
   ┌───────────────┐      ┌────────────────┐      ┌───────────────┐
   │  aws-api MCP  │      │ aws-pricing MCP│      │ aws-iac MCP   │
   │               │      │                │      │               │
   │ 100+ AWS APIs │      │ Cost lookups   │      │ CDK / CFn     │
   │ CloudWatch    │      │ RI savings     │      │ Best practice │
   │ CloudTrail    │      │ Rightsizing    │      │ Validation    │
   │ X-Ray, FIS    │      │ SP analysis    │      │               │
   └───────────────┘      └────────────────┘      └───────────────┘
           │
           ▼
   ┌─────────────────────────────────────────────────────────────┐
   │               aws-knowledge MCP (HTTP)                      │
   │         AWS Documentation · Best Practices · Guides         │
   └─────────────────────────────────────────────────────────────┘

---

🚀 The 8 Superpowers

---

📁 Repository Structure

aws-cloud-ops-power/
│
├── aws-cloud-ops/                          ← The Kiro Power
│   ├── POWER.md                            ← Orchestrator: capability map,
│   │                                           MCP tool catalog, activation rules
│   ├── mcp.json                            ← 4 MCP servers, 100+ auto-approved
│   │                                           read-only AWS API tools
│   │
│   └── steering/                           ← On-demand expert workflows
│       ├── incident-investigator.md        ← 6-phase root cause analysis
│       ├── blast-radius-analyzer.md        ← 7 resource type dependency maps
│       ├── resiliency-scorecard.md         ← 15-check A–F graded assessment
│       ├── deployment-safety-gate.md       ← 7-check GO/NO-GO pre-deploy gate
│       ├── chaos-engineering.md            ← 6 AWS FIS experiment templates
│       ├── cost-anomaly-detective.md       ← 10 zombie types + rightsizing
│       ├── security-posture.md             ← 6 security domain aggregation
│       └── multi-account-ops.md            ← Org / SCP / Control Tower
│
└── .kiro/hooks/                            ← IDE event-driven automations
    ├── aws-deployment-safety.kiro.hook     ← Fires on .tf/.yaml/CDK changes
    ├── aws-incident-investigation.kiro.hook← Fires on incident/runbook files
    ├── aws-cost-sentinel.kiro.hook         ← Fires on billing CSV/JSON files
    └── aws-chaos-game-day.kiro.hook        ← Fires on FIS/chaos files

---

🔧 Installation

Prerequisites

• Kiro IDE installed
• AWS CLI configured (aws configure or aws sso login)
• Python uvx available (pip install uv)

Step 1 — Add the Power

# Clone this repo
git clone https://github.com/nirmal84/aws-cloud-ops-power.git

In Kiro IDE:

1. Open the Powers panel (sidebar)
2. Click Add Power → Local Directory
3. Paste the path to aws-cloud-ops/ folder
4. Click Add

Step 2 — Configure AWS Credentials

Edit aws-cloud-ops/mcp.json and update:

{
  "mcpServers": {
    "aws-api": {
      "env": {
        "AWS_PROFILE": "your-profile-name",   ← change this
        "AWS_REGION": "us-east-1"              ← change this
      }
    }
  }
}

# Verify credentials work
aws sts get-caller-identity

Step 3 — Install Hooks (Optional but Recommended)

Copy the hooks into your workspace:

cp .kiro/hooks/*.kiro.hook /path/to/your/workspace/.kiro/hooks/

Step 4 — Test the Power

Open a Kiro agent chat and try:

"My Lambda function started timing out 30 minutes ago. What happened?"

The power will activate automatically and begin the investigation. 🎉

---

🎯 Example Conversations

You:  My payments service Lambda is timing out since 3:42 PM UTC.
      Error rate went from 0.1% to 100%. What happened?

Kiro: Loading incident-investigator...

      📊 Phase 1: CloudWatch Timeline
      → Lambda Errors: 0% → 100% starting 15:42:03 UTC
      → Duration: spiking to max timeout (15,000ms)
      → Throttles: 0 (not the cause)

      📋 Phase 2: CloudTrail — "What Changed?"
      → Found: DeleteRolePolicy at 15:38:47 UTC
        Actor: arn:aws:iam::123456789:user/ci-terraform-user
        Policy: payments-lambda-dynamodb-access

      📝 Phase 3: Application Logs
      → Error: AccessDeniedException: User is not authorized
        to perform: dynamodb:GetItem on resource payments-table

      🎯 ROOT CAUSE FOUND:

      A Terraform apply at 15:38 UTC removed the DynamoDB
      access policy from the Lambda execution role.
      The Lambda cannot read from DynamoDB → 100% errors.

      ✅ Immediate Fix:
      aws iam put-role-policy \
        --role-name payments-lambda-role \
        --policy-name payments-lambda-dynamodb-access \
        --policy-document file://policy.json

      📋 Follow-up:
      • Add Terraform plan review gate for IAM changes
      • Add CloudWatch alarm for AccessDeniedException errors

You:  I want to terminate EC2 instance i-0abc12345. What breaks?

Kiro: Loading blast-radius-analyzer...

      🗺️  Mapping dependencies for i-0abc12345 (payments-worker)...

      ┌─────────────────────────────────────────────────────┐
      │  BLAST RADIUS REPORT                               │
      │  Risk Score: 🔴 CRITICAL                           │
      ├─────────────────────────────────────────────────────┤
      │  Resource              Impact                       │
      │  ─────────────────────────────────────────────     │
      │  tg-payments (ALB)     LAST healthy target → OUTAGE│
      │  asg-payments          Will replace in ~3 min       │
      │  eip-52.x.x.x          Released → DNS updates needed│
      │  hc-payments-prod      Route53 failover triggers    │
      └─────────────────────────────────────────────────────┘

      ⚠️  DO NOT terminate now — this is the last healthy
         target in your production load balancer.

      ✅ Safe Sequence:
      1. Drain ALB target group connections (30 sec)
      2. Terminate instance
      3. Reassociate EIP to new ASG instance
      4. Verify new target is healthy

      Proceed with safe sequence? (yes/no)

You:  Score my production VPC for resiliency.

Kiro: Loading resiliency-scorecard... Running 15 checks...

      ╔══════════════════════════════════════════╗
      ║   AWS RESILIENCY SCORECARD               ║
      ║   Account: 123456789012  Region: us-east-1║
      ╠══════════════════════════════════════════╣
      ║   Overall Grade:  B  (78/100)            ║
      ╠══════════════════╦═══════╦══════════════╣
      ║ Domain           ║ Score ║ Grade        ║
      ╠══════════════════╬═══════╬══════════════╣
      ║ Compute          ║ 19/25 ║ B            ║
      ║ Data Durability  ║ 22/25 ║ A            ║
      ║ Network          ║ 14/20 ║ C            ║
      ║ Observability    ║ 12/15 ║ B            ║
      ║ Deployment Safety║ 11/15 ║ B            ║
      ╚══════════════════╩═══════╩══════════════╝

      🔴 CRITICAL: Single NAT Gateway (AZ-level SPOF)
         Fix: Add NAT GW to 1b and 1c (+$65/month)
         Risk: Prevents $50,000+ outage cost

      🔴 CRITICAL: RDS Multi-AZ disabled on payments-db
         Fix: Enable Multi-AZ (+$180/month)
         Risk: 10-30 min manual recovery on failure

      🟡 HIGH: No CloudWatch alarm on Lambda Throttles
      🟡 HIGH: ECS Deployment Circuit Breaker disabled

You:  My AWS bill jumped $4,200 last month. What happened?

Kiro: Loading cost-anomaly-detective...

      🔍 Analyzing Cost Explorer anomalies...
      🔍 Hunting zombie resources...
      🔍 Checking rightsizing opportunities...

      ═══════════════════════════════════════════
      💀 COST KILL LIST  (Ranked by Savings)
      ═══════════════════════════════════════════

      1. 5× EC2 m5.4xlarge (load-test env)
         Owner: john.doe (created Feb 3 per CloudTrail)
         Monthly cost: $1,680 → Terminate immediately ✅

      2. 12 unattached EBS volumes
         Monthly cost: $240 → Delete (snapshots exist) ✅

      3. rds-analytics-dev (db.r5.2xlarge, 0 connections)
         Monthly cost: $580 → Verify with team, then delete

      4. 3 idle NAT Gateways (0 bytes for 30 days)
         Monthly cost: $96 → Delete ✅

      ─────────────────────────────────────────
      💰 Total immediate savings: $2,596/month
      💰 Annual savings: $31,152/year
      ═══════════════════════════════════════════

---

🔌 MCP Servers Included

Server	Transport	Purpose
aws-api	uvx (stdio)	Direct access to 100+ AWS service APIs — EC2, RDS, Lambda, CloudWatch, CloudTrail, X-Ray, FIS, GuardDuty, Security Hub, Cost Explorer, Organizations
aws-pricing	uvx (stdio)	Real-time AWS pricing lookups, Reserved Instance analysis, Savings Plans recommendations
aws-knowledge	HTTP	AWS documentation, Well-Architected best practices, service limits
aws-iac	uvx (stdio)	CDK + CloudFormation documentation, template validation, IaC best practices

Safety: All 100+ read-only operations (describe_*, list_*, get_*) are auto-approved. All write/delete/destructive operations require explicit user confirmation.

---

🪝 Hooks — Automatic Activation

Hook	Triggers When	What It Does
aws-deployment-safety	.tf, *.yaml, CDK files edited	Runs pre-deployment safety gate automatically
aws-incident-investigation	Runbook/incident/postmortem files edited	Offers RCA or postmortem writing assistance
aws-cost-sentinel	Billing CSV/JSON files added	Runs cost anomaly investigation automatically
aws-chaos-game-day	FIS experiment/chaos files created	Guides safe experiment design with stop conditions

---

🛡️ Security & Safety Model

┌──────────────────────────────────────────────────────────────────┐
│                     SAFETY ARCHITECTURE                          │
│                                                                  │
│  ✅ AUTO-APPROVED (no confirmation needed)                       │
│  ┌────────────────────────────────────────┐                      │
│  │ describe_* · list_* · get_*            │                      │
│  │ CloudWatch reads · CloudTrail lookups  │                      │
│  │ Cost Explorer queries · X-Ray traces   │                      │
│  └────────────────────────────────────────┘                      │
│                                                                  │
│  ⚠️  REQUIRES EXPLICIT CONFIRMATION                              │
│  ┌────────────────────────────────────────┐                      │
│  │ ec2:TerminateInstances                 │                      │
│  │ rds:DeleteDBInstance                   │                      │
│  │ fis:StartExperiment                    │                      │
│  │ ssm:SendCommand                        │                      │
│  │ Any write / delete / modify operation  │                      │
│  └────────────────────────────────────────┘                      │
│                                                                  │
│  🚨 PRODUCTION CHAOS EXPERIMENTS                                 │
│  ┌────────────────────────────────────────┐                      │
│  │ Require: hypothesis + stop conditions  │                      │
│  │ Require: blast radius analysis first   │                      │
│  │ Require: typed confirmation phrase     │                      │
│  │ Require: on-call engineer available    │                      │
│  └────────────────────────────────────────┘                      │
└──────────────────────────────────────────────────────────────────┘

Minimum IAM permissions required (read-only baseline for most features):

{
  "Effect": "Allow",
  "Action": [
    "cloudwatch:GetMetricData", "cloudwatch:DescribeAlarms",
    "logs:FilterLogEvents", "logs:StartQuery",
    "cloudtrail:LookupEvents",
    "xray:GetServiceGraph", "xray:GetTraceSummaries",
    "ec2:Describe*", "rds:Describe*",
    "lambda:Get*", "lambda:List*",
    "elasticloadbalancing:Describe*",
    "ce:GetCostAndUsage", "ce:GetAnomalies",
    "guardduty:List*", "guardduty:Get*",
    "securityhub:GetFindings",
    "iam:List*", "iam:Get*",
    "sts:GetCallerIdentity"
  ],
  "Resource": "*"
}

---

🗺️ Steering File Architecture

POWER.md (Orchestrator)
│  Detects user intent → routes to correct steering file
│
├─── "production is down"           → incident-investigator.md
│         6-phase investigation:
│         Metrics → CloudTrail → Logs → X-Ray → Infra → AWS Health
│
├─── "what breaks if I..."          → blast-radius-analyzer.md
│         7 resource types mapped:
│         EC2 · SG · RDS · Lambda · VPC · IAM · S3
│
├─── "score my architecture"        → resiliency-scorecard.md
│         5 domains, 15 checks, A–F grade:
│         Compute · Data · Network · Observability · Deployments
│
├─── "chaos experiment / game day"  → chaos-engineering.md
│         6 experiment templates:
│         AZ failure · Latency · CPU · RDS failover · Throttle · Spot
│
├─── "safe to deploy?"              → deployment-safety-gate.md
│         7-check pre-flight gate:
│         Errors · Alarms · Dependencies · Traffic · History · Rollback · Health
│
├─── "why did my bill spike?"       → cost-anomaly-detective.md
│         4-phase investigation:
│         Anomaly · Zombie hunt · Rightsizing · Data transfer
│
├─── "security findings / posture"  → security-posture.md
│         6 security domains:
│         GuardDuty · Security Hub · Access Analyzer · Config · IAM · Network
│
└─── "cross-account / org"          → multi-account-ops.md
          Enterprise ops:
          Org map · SCP analysis · Control Tower · Cross-account RCA

---

📊 What Gets Loaded and When

One of the key innovations of Kiro Powers: zero context bloat. Only the relevant expert workflow loads when needed.

Without Powers:                    With aws-cloud-ops Power:
────────────────                   ─────────────────────────
Always loaded:                     On activation (keywords):
• 5+ MCP servers                   • POWER.md capability map
• 50,000+ tokens wasted            • ~2,000 tokens
• 40% context window gone
                                   On-demand (per conversation):
                                   • 1 steering file (~400 lines)
                                   • Only the expert workflow needed
                                   • 95% context window preserved

---

🤝 Contributing

Pull requests welcome! Areas to contribute:

• 🆕 New steering files (EKS operations, API Gateway debugging, EventBridge patterns)
• 🔧 Additional MCP server integrations (Datadog, PagerDuty, Jira)
• 🧪 Real-world example conversations
• 📖 Additional runbook patterns
• 🪝 More hook automations

Adding a New Steering File

1. Create aws-cloud-ops/steering/your-capability.md
2. Add an entry to the capability table in POWER.md
3. Add keywords to the keywords array in POWER.md frontmatter
4. Submit a PR!

---

📖 Learn More

• Kiro Powers Documentation
• Kiro Powers Marketplace
• AWS Well-Architected Framework
• AWS Fault Injection Service
• AWS MCP Servers (awslabs)

---

Built with ❤️ for the AWS community

Turning reactive firefighting into proactive resilience engineering