A move from on-premises systems to Amazon EKS works best when release checks and production evidence move with it. AWS DevOps Agent can review changes before release and investigate incidents using connected telemetry, code and deployment context. Its view depends on the integrations and permissions configured for the Agent Space; it is not universal access to every host or service. A practical migration workflow is to connect the systems that hold operational context, validate changes before deployment, grant the agent bounded EKS access, and turn incident findings into future release checks.
What crosses the boundary from on-premises systems to EKS?
The migration boundary is not just a change in compute. Teams also need useful context about dependencies, deployments and symptoms to cross it. AWS DevOps Agent obtains that context through connected integrations and infrastructure tools, rather than through assumed, universal access to on-premises hosts.
As an Amazon Associate I earn from qualifying purchases.
Connect the sources that explain the service
AWS lists CloudWatch, Datadog, Dynatrace, Grafana, New Relic and Splunk among telemetry options, and ServiceNow, PagerDuty and Slack among ticketing and chat integrations. Webhooks and private MCP servers can extend the integration model. Which signals the agent can use depends on the sources actually connected and their permissions; a topology built from connected accounts and integrations is not proof that every dependency is visible. See AWS’s integration and knowledge configuration guide and DevOps Agent FAQs.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Inventory context before relying on an investigation
Before a cutover, identify where the team keeps metrics, logs, traces, alerts, tickets, source changes and deployment history. Connect the relevant systems and verify that the Agent Space can access the intended data. This makes the on-premises-to-EKS transition a connected operational view, not a promise that the agent can directly inspect every legacy machine.
#1 Best Overall
How do I validate an EKS release before it reaches production?
Put release readiness checks in the delivery flow developers already use, such as an IDE, pull or merge request, CI/CD pipeline, or chat workflow. AWS labels release management a preview capability in its Working with DevOps Agent guide.
What the documented checks cover
- Review code changes for dependency risks and alignment with standards and practices.
- Run builds and tests in a verification environment.
- Run QA tests in an integration environment.
The checks depend on the configured workflow and environments. The documentation does not establish a fixed test depth or guarantee compatibility with every CI/CD system, so treat the result as part of your release process rather than a substitute for defining and maintaining the checks your service needs.
Can AWS DevOps Agent investigate a private EKS cluster?
Yes. AWS documents connections to public and private EKS clusters, and says any number of EKS clusters can be connected to the same Agent Space. Investigation access is read-only: the agent can use kubectl to inspect resources, pod logs, events and node health, but it cannot create, modify or delete cluster resources. The exact setup and required permissions are described in AWS’s EKS access setup guide.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsConfigure access with a deliberate scope
- Configure the cluster’s authentication mode to include the EKS API.
- Create an IAM access entry for the Agent Space role. AWS’s setup guide references the managed
AmazonAIOpsAssistantPolicyfor this access entry. - Choose cluster-wide or namespace-scoped access according to the investigation needs. Namespace scope can limit what the agent is permitted to inspect.
- Review the role and cluster permissions against your organization’s access policy before enabling the connection.
The agent’s read-only boundary applies to cluster resources; it does not by itself determine what it can access in connected telemetry, code, ticketing or other systems. Review those integration permissions separately.
Rank #3
- AWS Certified DevOps Engineer Professional Certification and Beyond: Pass the DOP C01 exam and prepare for the real world using case studies and real life examples
- ABIS BOOK
- Packt Publishing
Why might Kubernetes API throttling be hard to spot?
Throttling can present as slow investigations, delayed control-plane operations, or application errors rather than a clear message that says “throttled.” Treat “invisible throttling” as a diagnostic problem: determine which layer is limiting requests, then correlate its evidence with the observed symptom. Do not assume that every delay is throttling or that the agent will always identify it.
Separate the three mechanisms
- DevOps Agent service concurrency: AWS sets limits on concurrent work per Agent Space. These are service quotas, not Kubernetes API-server limits.
- Kubernetes API server behavior: API request handling, including API Priority and Fairness, can affect control-plane throughput. Relevant cluster state and audit evidence can help distinguish this from other causes.
- Application or dependency throttling: An application or a service it calls may return rate-limit errors. That evidence belongs in the affected application and dependency telemetry, not in the Agent Space concurrency quota.
AWS’s quotas page lists the following defaults per Agent Space. Unless AWS specifies otherwise, quotas are Region-specific; check the current quotas for the Region you plan to use.
| Work type | Default concurrency per Agent Space |
|---|---|
| Incident investigations | 3 concurrent investigations |
| On-demand chat invocations | 10 concurrent invocations |
| Release readiness reviews | 4 concurrent reviews |
These figures are service concurrency limits, not performance measurements. Some quotas can be adjusted, but AWS says an increase may take hours to days and is not granted immediately. See the AWS DevOps Agent quotas page; its listed defaults were accessed on 2026-10-05.
Use correlated evidence, not a single symptom
An AWS Containers Blog walkthrough dated 2026-07-02 demonstrates an EKS control-plane investigation that correlated CloudWatch metrics, EKS audit logs, CloudTrail, pod logs and cluster state. In that example, request load and priority-level concurrency saturation were implicated in a performance issue. It is an illustrative investigation, not a benchmark or evidence that the same cause explains other clusters. The walkthrough is Diagnose Kubernetes Control Plane Performance Issues with AWS DevOps Agent.
Best Value
How do I capture an EKS incident before the evidence disappears?
Configure production operations around the alert sources and context the team actually uses. AWS describes investigations triggered from connected alerting sources, webhooks or manual requests. The agent can correlate available metrics, logs, traces, code changes and deployment history through an application topology, helping assemble an investigation from evidence across configured systems.
Make the investigation useful and bounded
- Connect the relevant alerting and observability systems, and make sure the agent’s permissions cover the intended evidence.
- Include code and deployment context where it is available, so an alert can be assessed alongside recent changes.
- Use the EKS read-only connection for cluster inspection; use the appropriate operational process and permissions for any remediation.
“Autonomous incident capture” here means that configured triggers can initiate evidence collection and investigation. It does not mean every incident will be detected, that every system is automatically visible, or that the agent can make cluster changes. AWS’s production operations guide explains the connected workflow.
How can production findings become future release guardrails?
Use incident investigation as input to the next release cycle. AWS describes a feedback loop in which recurring production patterns can inform recommendations, recommendations can be turned into agent-ready implementation specifications, and the application topology can inform dependency analysis. Later release reviews can then account for relevant operational experience rather than treating production and pre-production as separate processes.
Recommended Free Tools
Close the loop in four stages
- Investigate incidents using the connected telemetry, code and deployment evidence.
- Identify recurring patterns that warrant a prevention recommendation.
- Convert a useful recommendation into an agent-ready implementation specification for the team to assess and apply.
- Use the resulting code, standards or test changes in subsequent release readiness reviews.
AWS says its production-prevention evaluations run weekly by default and may also be run manually. Recommendations cover observability, infrastructure, governance and code optimization. See Proactive incident prevention for how that capability is described.
Quick Recap
What should teams verify before rollout?
- Confirm that release management is suitable for your use while AWS labels the capability preview.
- Connect and test the telemetry, ticketing, code and delivery sources needed for the intended workflows.
- Configure EKS API authentication and an access entry for the Agent Space role, with cluster-wide or namespace scope selected intentionally.
- Review the Region-specific concurrency quotas against expected simultaneous investigations, chats and release reviews.
- Keep a clear distinction between agent service quotas, Kubernetes API behavior and application or dependency rate limits when triaging symptoms.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
