--- title: Closed-loop incident response: connect AWS DevOps Agent... description: A walkthrough shows how to connect AWS DevOps Agent to Amazon OpenSearch Service observability data via the Model Context Protocol, so alerting monitors can... canonical: https://daily.dev/posts/closed-loop-incident-response-connect-aws-devops-agent-to-opensearch-nh4tfn2il twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Closed-loop incident response: connect AWS DevOps Agent to OpenSearch | daily.dev og:description: A walkthrough shows how to connect AWS DevOps Agent to Amazon OpenSearch Service observability data via the Model Context Protocol, so alerting monitors can... og:url: https://daily.dev/posts/closed-loop-incident-response-connect-aws-devops-agent-to-opensearch-nh4tfn2il og:image: https://api.daily.dev/og/posts/Nh4TFN2IL.png og:image:alt: Closed-loop incident response: connect AWS DevOps Agent to OpenSearch og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Closed-loop incident response: connect AWS DevOps Agent to OpenSearch **[AWS](https://daily.dev/sources/aws)** · 14 min read · 0 upvotes · 0 comments ## Summary A walkthrough shows how to connect AWS DevOps Agent to Amazon OpenSearch Service observability data via the Model Context Protocol, so alerting monitors can trigger autonomous root-cause investigation instead of paging a human. It covers three MCP server hosting options (self-managed on ECS/NLB with VPC Lattice, Amazon Bedrock AgentCore, or the built-in OpenSearch 3.3+ MCP endpoint), registering the server as a Capability Provider, mapping IAM roles to OpenSearch fine-grained access control (FGAC) roles, wiring a Lambda webhook forwarder with HMAC signing between SNS alerts and the agent's Event Channel, and verifying the closed loop with a controlled failure injection. Cost adds roughly $70/month for the self-managed path, and security guidance emphasizes private VPC networking, TLS, and least-privilege FGAC scoping. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why do I need a Network Load Balancer instead of an Application Load Balancer for an MCP server using streamable-HTTP transport? Application Load Balancers operate at Layer 7 and can strip the Transfer-Encoding: chunked header, breaking the Server-Sent Events stream that streamable-HTTP MCP servers rely on. Network Load Balancers operate at Layer 4 (TCP) and pass HTTP framing untouched after TLS termination, so a streamable-HTTP MCP server must be deployed behind an NLB with TLS termination, not an ALB. _Developers wiring MCP servers into production networking can save setup time by reading load-balancer gotchas on daily.dev first._ ### How do I fix a 403 Forbidden error when an IAM-authenticated agent tries to query an OpenSearch domain with FGAC enabled? On OpenSearch managed domains with fine-grained access control, IAM only authenticates the caller while the internal security plugin authorizes index access, so an explicit mapping between the IAM role and an OpenSearch backend role is required. Without that mapping, authenticated requests still return 403 Forbidden; create a scoped read-only backend role for the relevant indices and map the IAM role (e.g. the ECS task role, AgentCore role, or DevOps Agent role) to it. _Engineers debugging OpenSearch FGAC permission errors can track authorization fixes like this on daily.dev._ ### What does it cost to run a self-managed MCP server on ECS Fargate for connecting an AI agent to OpenSearch? A self-managed MCP deployment adds roughly $70 per month, broken down as about $15 for the ECS Fargate MCP task, $35 for the NAT gateway, $18 for the Network Load Balancer, $0.40 for Secrets Manager, and under $1 for the Lambda forwarder, with costs varying by AWS Region and usage. Choosing the Bedrock AgentCore path instead removes the NLB and ECS costs but adds AgentCore hosted-endpoint charges. _Teams budgeting AI-agent infrastructure can compare hosting trade-offs like this one on daily.dev before committing._ ## Similar posts on daily.dev - [Amazon OpenSearch Service now supports the Agent Toolkit for AWS with a curated skill](https://daily.dev/posts/amazon-opensearch-service-now-supports-the-agent-toolkit-for-aws-with-a-curated-skill-fmqkgdbmv) · AWS · 1 upvotes · 0 comments - [AWS DevOps Agent — Capabilities, Setup, and What It Actually Does](https://daily.dev/posts/aws-devops-agent-capabilities-setup-and-what-it-actually-does-b16ztfmbs) · AWS Fundamentals · 10 upvotes · 2 comments - [AWS Announces General Availability of DevOps Agent for Automated Incident Investigation](https://daily.dev/posts/aws-announces-general-availability-of-devops-agent-for-automated-incident-investigation-o3foudjfb) · InfoQ · 0 upvotes · 0 comments - [Scaling Autonomous Operations with AWS DevOps Agent and ServiceNow](https://daily.dev/posts/scaling-autonomous-operations-with-aws-devops-agent-and-servicenow-yzlsdwmdl) · AWS · 1 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#mcp](https://daily.dev/tags/mcp), [#aws-lambda](https://daily.dev/tags/aws-lambda), [#opensearch](https://daily.dev/tags/opensearch) [View this post on daily.dev](https://daily.dev/posts/closed-loop-incident-response-connect-aws-devops-agent-to-opensearch-nh4tfn2il) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Closed-loop incident response: connect AWS DevOps Agent to OpenSearch","url":"https://daily.dev/posts/closed-loop-incident-response-connect-aws-devops-agent-to-opensearch-nh4tfn2il","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/closed-loop-incident-response-connect-aws-devops-agent-to-opensearch-nh4tfn2il"},"datePublished":"2026-10-02T15:29:44.572Z","dateModified":"2026-10-02T15:32:33.595Z","description":"A walkthrough shows how to connect AWS DevOps Agent to Amazon OpenSearch Service observability data via the Model Context Protocol, so alerting monitors can...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bc8058aa02b3cb44000212d5359b2ec4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bc8058aa02b3cb44000212d5359b2ec4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"AWS","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"AWS","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/aws","url":"https://daily.dev/sources/aws"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/closed-loop-incident-response-connect-aws-devops-agent-to-opensearch-nh4tfn2il","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,mcp,aws-lambda,opensearch","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"AWS","item":"https://daily.dev/sources/aws"},{"@type":"ListItem","position":3,"name":"Closed-loop incident response: connect AWS DevOps Agent to OpenSearch"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/closed-loop-incident-response-connect-aws-devops-agent-to-opensearch-nh4tfn2il#faq","mainEntity":[{"@type":"Question","name":"Why do I need a Network Load Balancer instead of an Application Load Balancer for an MCP server using streamable-HTTP transport?","acceptedAnswer":{"@type":"Answer","text":"Application Load Balancers operate at Layer 7 and can strip the Transfer-Encoding: chunked header, breaking the Server-Sent Events stream that streamable-HTTP MCP servers rely on. Network Load Balancers operate at Layer 4 (TCP) and pass HTTP framing untouched after TLS termination, so a streamable-HTTP MCP server must be deployed behind an NLB with TLS termination, not an ALB. Developers wiring MCP servers into production networking can save setup time by reading load-balancer gotchas on daily.dev first."}},{"@type":"Question","name":"How do I fix a 403 Forbidden error when an IAM-authenticated agent tries to query an OpenSearch domain with FGAC enabled?","acceptedAnswer":{"@type":"Answer","text":"On OpenSearch managed domains with fine-grained access control, IAM only authenticates the caller while the internal security plugin authorizes index access, so an explicit mapping between the IAM role and an OpenSearch backend role is required. Without that mapping, authenticated requests still return 403 Forbidden; create a scoped read-only backend role for the relevant indices and map the IAM role (e.g. the ECS task role, AgentCore role, or DevOps Agent role) to it. Engineers debugging OpenSearch FGAC permission errors can track authorization fixes like this on daily.dev."}},{"@type":"Question","name":"What does it cost to run a self-managed MCP server on ECS Fargate for connecting an AI agent to OpenSearch?","acceptedAnswer":{"@type":"Answer","text":"A self-managed MCP deployment adds roughly $70 per month, broken down as about $15 for the ECS Fargate MCP task, $35 for the NAT gateway, $18 for the Network Load Balancer, $0.40 for Secrets Manager, and under $1 for the Lambda forwarder, with costs varying by AWS Region and usage. Choosing the Bedrock AgentCore path instead removes the NLB and ECS costs but adds AgentCore hosted-endpoint charges. Teams budgeting AI-agent infrastructure can compare hosting trade-offs like this one on daily.dev before committing."}}]} ```