Hire an AI AWS incident investigation planner

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• CloudWatch evidence
• Health and recovery findings
• Incident report with unknowns

How it does the job well

• Read the existing code, its conventions and its tests before changing anything. Match the project's patterns.
• Make the smallest change that fully solves the request. Keep unrelated refactors out.
• Reproduce a bug before fixing it, and add a test that fails without the fix.
• Treat input from users, files and networks as untrusted. Validate it at the boundary.

Mistakes it avoids

• Claiming code works without running it or its tests.
• Inventing APIs, package versions or settings instead of checking the installed ones.
• Changing behaviour outside the request, such as reformatting whole files or renaming public interfaces.

What a good result looks like

An example, not your task: You want the result described above from the files and facts you already have.

• Step 1: CloudWatch evidence. A timeline, the blast radius, any deploy link rated strong, weak or none, and every query that was run.
• Step 2: Health and recovery findings. The resource's health status, issues ranked by severity with likely causes, and a recovery plan in phases.
• Step 3: Incident report. A blameless report with impact, timeline, root cause, contributing factors, action items with owners and unresolved facts.
• Source coverage. What was read, what could not be read, and every MISSING fact.

How the work is checked

• The changed files build, and the relevant tests and linters pass. The commands and results are shown.
• Each change is explained in one line with its reason, and risky areas are named.
• Any check that could not run is reported as NOT_RUN with what it needs.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• CloudWatch incident evidence collector. Share an AWS incident and time window. Get useful log queries, deployment links and the likely affected services.
• AWS service health investigator. Share your AWS resources and symptoms. Get health findings, log evidence and a recovery plan.
• Incident learning report writer. Share an outage timeline and evidence. Get a blameless report with causes, follow-up owners and unresolved facts.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id investigate-an-aws-service-incident only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/investigate-an-aws-service-incident/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• The source files, notes or product facts for this job
• Your goal, deadline and limits
• Relevant earlier work, if available

Tools and access

• Claude Code: It can run the AWS command line and show each query before it runs.
• Any good chat AI: Works if you paste in query results from the AWS console one by one.

Functions and deliverables

• AWS incident investigation planner: Share the incident time, AWS resources and logs or access. Get findings tied to evidence, a recovery plan and an incident report.
  • CloudWatch evidence
  • Health and recovery findings
  • Incident report with unknowns
• CloudWatch incident evidence collector: Find out what broke and when. Get an AWS incident timeline, ready-to-run CloudWatch log queries and the deploy that may have caused it.
  • A timeline of the first change, first error and alarm, each with its source
  • Log queries ready to paste into CloudWatch Logs Insights
  • A link between the alarm and any deploy before it, rated strong, weak or none
  • The blast radius, narrowed from account down to one resource
  • The likely first cause, or a plain note that none was found
  Source: GitHub Copilot community.
• AWS service health investigator: Check an AWS resource's health from its CloudWatch logs and metrics. Get the issues found, their causes and a step-by-step fix plan.
  • A health status for the resource: healthy, warning or critical
  • Log and metric evidence for each problem
  • Issues rated by severity, each with a likely cause
  • A phased fix plan with commands, a validation checklist and rollback steps
  Source: GitHub Copilot community.
• Incident learning report writer: Write a blameless incident post-mortem from your outage timeline and evidence. Get root causes, action items with owners and open questions.
  • A blameless post-mortem in one document, ready to share
  • A timeline with gaps in the record flagged
  • A root cause and a list of contributing factors
  • Action items with owners, due dates and priorities
  Source: GitHub Copilot community.
• AI project context organiser: Share your project and next task. Get a short rules file, a focused file list and a clear handoff for later sessions.
  • A ready rules file for your project
  • A list of which files to load for each task
  • Rules for when to reset or trim the session
  • A checklist for spotting drifting answers
  Source: Addy Osmani.

Tasks you can use it for

• You want the result described above from the files and facts you already have.
• You need a repeatable process and a clear next action.

Limits to check before starting

• Your AWS bill is the problem, not an outage: use the AWS cost waste finder or the AWS resource cost reviewer.
• You want a health check on one resource with no incident to chase: use the AWS service health investigator on its own.
• The incident is over and you only need the write-up: use the Incident learning report writer or the Incident postmortem writer.
• Your service did not record logs or metrics at the time: nothing here can recover data that was never kept.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Add the complete skill pack to your AI.
• Share your goal and the files listed above.
• Ask it to follow the steps and mark any missing facts.
• Review the result before approving external actions.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/investigate-an-aws-service-incident for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.