Add aurora-incident-business-context skill

cloudformation/devops-agent-skill-policies/README.md

@@ -51,6 +51,7 @@ Each parameter is `'true'` / `'false'` and defaults to `'true'`. Set a skill to
 | `EnableDmsOperationReview` | `database-migration-service-expertise` | `dms:TestConnection` |
 | `EnableEcsOperationReview` | `ecs-operation-review` | `compute-optimizer:GetECSServiceRecommendations` |
 | `EnableAwsBackupCoverageReview` | `aws-backup-coverage-review` | `backup:GetSupportedResourceTypes`, `config:SelectResourceConfig`, `dsql:ListClusters`, `storagegateway:ListFileShares`, `storagegateway:ListGateways`, `storagegateway:ListVolumes` |
+| `EnableAuroraIncidentBusinessContext` | `aurora-incident-business-context` | `config:GetResourceConfigHistory` |
 | `EnableAgentCoreObservabilitySetup` | `agentcore-observability-setup` | `bedrock-agentcore:GetAgentRuntime`, `bedrock-agentcore:ListAgentRuntimes`, `xray:GetTraceSegmentDestination`, `logs:DescribeDeliveries`, `logs:DescribeDeliverySources`, `logs:DescribeDeliveryDestinations`, `logs:DescribeResourcePolicies`, `lambda:GetFunctionConfiguration`, `ecs:DescribeTaskDefinition`, `ecs:DescribeServices`, `ecs:ListTasks`, `eks:DescribeCluster` |
 | `EnableAgentCoreOpsReview` | `agentcore-ops-review` | `bedrock-agentcore` read-only List/Get for runtimes, memories, gateways, browsers, code interpreters and workload identities; `bedrock-agentcore:ListMemoryRecords`; `ec2:DescribeSubnets` |
 | `EnableSageMakerAIOpsReview` | `sagemaker-ai-ops-review` | `savingsplans:DescribeSavingsPlans` |

cloudformation/devops-agent-skill-policies/devops-agent-skill-policies.yaml

@@ -29,6 +29,7 @@ Metadata:
           - EnableServiceQuotaCheck
           - EnableDmsOperationReview
           - EnableAwsBackupCoverageReview
+          - EnableAuroraIncidentBusinessContext
           - EnableAgentCoreObservabilitySetup
           - EnableAgentCoreOpsReview
           - EnableSageMakerAIOpsReview
@@ -135,6 +136,13 @@ Parameters:
       config:SelectResourceConfig, dsql:ListClusters, storagegateway:List*).
     AllowedValues: ['true', 'false']
     Default: 'true'
+  EnableAuroraIncidentBusinessContext:
+    Type: String
+    Description: >
+      Aurora Incident Business Context skill (adds config:GetResourceConfigHistory
+      for the recent-change check).
+    AllowedValues: ['true', 'false']
+    Default: 'true'
 
   EnableAgentCoreObservabilitySetup:
     Type: String
@@ -213,6 +221,7 @@ Conditions:
   SkillServiceQuotaCheck: !Equals [!Ref EnableServiceQuotaCheck, 'true']
   SkillDmsOperationReview: !Equals [!Ref EnableDmsOperationReview, 'true']
   SkillAwsBackupCoverageReview: !Equals [!Ref EnableAwsBackupCoverageReview, 'true']
+  SkillAuroraIncidentBusinessContext: !Equals [!Ref EnableAuroraIncidentBusinessContext, 'true']
   SkillAgentCoreObservabilitySetup: !Equals [!Ref EnableAgentCoreObservabilitySetup, 'true']
   SkillAgentCoreOpsReview: !Equals [!Ref EnableAgentCoreOpsReview, 'true']
   SkillSageMakerAIOpsReview: !Equals [!Ref EnableSageMakerAIOpsReview, 'true']
@@ -454,6 +463,27 @@ Resources:
               - storagegateway:ListVolumes
             Resource: '*'
 
+  # aurora-incident-business-context: AIDevOpsAgentAccessPolicy already grants the
+  # skill's rds:List*, tag:GetResources and cloudtrail:LookupEvents calls. Its AWS
+  # Config grant covers Describe*/List* and the aggregate reads but not the
+  # single-resource history the recent-change check uses. Read-only.
+  PolicyAuroraIncidentBusinessContext:
+    Type: AWS::IAM::Policy
+    Condition: SkillAuroraIncidentBusinessContext
+    Properties:
+      PolicyName: DevOpsAgentSkill-AuroraIncidentBusinessContext
+      Roles:
+        - !If [CreateNewRole, !Ref DevOpsAgentRole, !Ref ExistingRoleName]
+      PolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Sid: AuroraIncidentBusinessContextDelta
+            Effect: Allow
+            Action:
+              # Configuration timeline for the cluster and its parameter group
+              - config:GetResourceConfigHistory
+            Resource: '*'
+
   # agentcore-observability-setup: adds read-only AgentCore control-plane, X-Ray Transaction Search,
   # log-delivery/resource-policy describes, and Lambda/ECS/EKS host-config reads (Tier 2 + Tier 3).
   # Tier 1 (CloudWatch Logs/Metrics telemetry-arrival reads) is covered by AIDevOpsAgentAccessPolicy.
@@ -751,6 +781,7 @@ Outputs:
         - service-quota-check: ${EnableServiceQuotaCheck} (servicequotas:*, cloudwatch:GetMetricData/GetMetricStatistics)
         - database-migration-service-expertise: ${EnableDmsOperationReview} (dms:TestConnection)
         - aws-backup-coverage-review: ${EnableAwsBackupCoverageReview} (backup:GetSupportedResourceTypes, config:SelectResourceConfig, dsql:ListClusters, storagegateway:List*)
+        - aurora-incident-business-context: ${EnableAuroraIncidentBusinessContext} (config:GetResourceConfigHistory)
         - agentcore-observability-setup: ${EnableAgentCoreObservabilitySetup} (bedrock-agentcore:Get/ListAgentRuntime, xray:GetTraceSegmentDestination, logs:DescribeDeliveries/DeliverySources/DeliveryDestinations/ResourcePolicies, lambda:GetFunctionConfiguration, ecs:DescribeTaskDefinition/DescribeServices/ListTasks, eks:DescribeCluster)
         - agentcore-ops-review: ${EnableAgentCoreOpsReview} (bedrock-agentcore read-only List/Get for runtimes/memories/gateways/browsers/code-interpreters/workload-identities, ec2:DescribeSubnets)
         - config-cost-optimization Athena add-on: ${EnableConfigAthenaCiAnalysis} (athena:StartQueryExecution/GetQueryExecution/GetQueryResults, s3:GetObject on the Config data bucket; also needs an Athena-managed-results workgroup. Glue reads and athena:GetWorkGroup are already in the managed policy)

skills/aurora-incident-business-context/CHANGELOG.md

@@ -0,0 +1,31 @@
+# Changelog
+
+## [1.0.0] - 2026-11-09
+### Added
+- Initial release. Adapted from the business-context MCP prototype
+  (Lambda + API Gateway, synthetic example data) in the Aurora MySQL
+  Incident Investigation demo in `aws-samples/sample-aws-genai-ops-demos`.
+- Four evidence categories: dependent services/criticality, cost of
+  downtime, compliance/SLA reporting exposure, recent-change correlation.
+- Evidence-first reasoning framework — reports gaps explicitly rather than
+  fabricating values when tags/config are absent.
+- A "Required behavior" section near the top of `SKILL.md`: the Business
+  Impact section is always returned with all four lines, including when the
+  resource isn't found.
+- A provisional form of the Business Impact section for cases where the
+  incident can't be confirmed, with a `Status` line that says what evidence
+  would confirm it.
+- Pre-output checks that the section is present with all four lines and is
+  marked provisional when the incident is unconfirmed.
+- The SLA result (breached, or minutes remaining) on the Estimated cost
+  line, with `SLAPenaltyUsd` applied when the SLA is breached.
+- The agent never states whether a compliance reporting deadline has started
+  or doesn't apply. It names tagged frameworks and their windows "if assessed
+  as a breach, for the compliance owner to decide".
+- Fallback to CloudTrail when `config:GetResourceConfigHistory` is denied,
+  plus the `EnableAuroraIncidentBusinessContext` parameter in
+  `devops-agent-skill-policies.yaml` that grants it.
+- AWS account IDs are never written in a response, including in sentences
+  and quoted ARNs.
+- In investigations, each unconfirmed business-impact line is also written as
+  an "Investigation gap" item, the form the generated summary keeps.

skills/aurora-incident-business-context/README.md

@@ -0,0 +1,76 @@
+# Aurora/RDS Incident Business Context (Skill)
+
+Enriches an Amazon Aurora or Amazon RDS incident investigation with business
+context — dependent services, estimated cost of downtime, compliance
+reporting exposure, and recent-change correlation — so AWS DevOps Agent's
+technical root-cause findings come with an answer to "who does this affect
+and what does it cost us."
+
+> ⚠️ This skill is sample code, not intended for production use without
+> additional review and testing. Users should validate in a non-production
+> environment first.
+
+## What it does
+
+DevOps Agent's built-in investigation tools (CloudWatch, Performance
+Insights, RDS/Aurora logs) answer *what* is technically wrong. This skill
+adds the *business* half of the incident report: which teams/services are
+affected, a defensible dollar estimate of downtime cost, which compliance
+reporting obligations could apply (for the compliance owner to assess), and
+whether a recent change correlates with the incident.
+
+It is evidence-driven, not generative — it tells the agent **where to look**
+(resource tags, AWS Config history, CloudTrail, customer-supplied
+dependency maps) and **how to reason** about what it finds. It does not
+invent dependency graphs, dollar figures, or compliance frameworks. If the
+evidence isn't tagged or configured in the account, the skill says so and
+asks the operator, rather than guessing.
+
+## Prerequisites
+
+For the skill to find real evidence (rather than reporting gaps), the
+target account should have some of the following in place:
+
+- **IAM permissions** on the DevOps Agent role. All four are read-only.
+  `AIDevOpsAgentAccessPolicy` already covers `rds:ListTagsForResource`,
+  `tag:GetResources` and `cloudtrail:LookupEvents`. It doesn't cover
+  `config:GetResourceConfigHistory`, which the recent-change check uses. Add
+  it with the `EnableAuroraIncidentBusinessContext` parameter of
+  [`devops-agent-skill-policies.yaml`](../../cloudformation/devops-agent-skill-policies/).
+  Without it, the skill falls back to CloudTrail and says that Config
+  history wasn't readable.
+- **Resource tags** on the Aurora/RDS resource, e.g. `DependentServices`,
+  `OnCallTeam`, `RevenuePerMinute`, `SLAThresholdMinutes`,
+  `DataClassification`, `Compliance`. None are required for the skill to
+  activate — it degrades gracefully to "no evidence found" per category.
+
+## How to use it with DevOps Agent
+
+Install the skill in your Agent Space (Investigations and/or Chat
+subagents, depending on where you want business-context enrichment
+available). It activates automatically once DevOps Agent is investigating
+an Aurora/RDS alarm and the reasoning trace calls for business impact.
+
+You can also invoke it on demand in chat, e.g.:
+
+> Investigate the Aurora cluster `example-cluster` — the
+> `example-cluster-connections-high` alarm is firing. Once you've found the
+> technical root cause, tell me who's affected, what this costs us, and
+> whether we have a compliance reporting deadline.
+
+## Origin
+
+Adapted from the business-context enrichment logic prototyped in the
+Aurora MySQL Incident Investigation with AWS DevOps Agent demo (GenAI Ops
+Demo Library), currently proposed in
+[aws-samples/sample-aws-genai-ops-demos#95](https://github.com/aws-samples/sample-aws-genai-ops-demos/pull/95). That demo originally shipped this as a
+Lambda-backed mock MCP server returning synthetic example data
+(fictional dependency graph, a fixed revenue figure, canned compliance
+thresholds) for demonstration purposes. This skill generalizes that same
+reasoning into an evidence-based framework suitable for real accounts,
+with no infrastructure to deploy.
+
+The demo above shows this skill's reasoning in action against a live
+incident (connection storm, CPU spike, deadlock, or failover on a real
+Aurora MySQL cluster) — see its README for a runnable, end-to-end
+walkthrough.