InvestigationGroup

Source: src/AWS/AIOps/InvestigationGroup.ts

A CloudWatch investigations investigation group — the one-time, per-Region container that configures who can run AI-assisted operational investigations, which IAM role is used to access telemetry, how long investigation data is retained, and how it is encrypted.

You can have at most one investigation group per Region in an account, so replacements are performed delete-first.

Creating an Investigation Group

Basic Investigation Group

import * as AIOps from "alchemy/AWS/AIOps";
import * as IAM from "alchemy/AWS/IAM";

const role = yield* IAM.Role("InvestigationsRole", {
  assumeRolePolicyDocument: {
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Principal: { Service: "aiops.amazonaws.com" },
      Action: ["sts:AssumeRole"],
    }],
  },
  managedPolicyArns: ["arn:aws:iam::aws:policy/AIOpsAssistantPolicy"],
});

const group = yield* AIOps.InvestigationGroup("Investigations", {
  roleArn: role.roleArn,
});

Short Retention and Tag Boundaries

const group = yield* AIOps.InvestigationGroup("Investigations", {
  roleArn: role.roleArn,
  retention: "7 days",
  tagKeyBoundaries: ["Application"],
  tags: { Environment: "test" },
});

Resource Policy

const group = yield* AIOps.InvestigationGroup("Investigations", {
  roleArn: role.roleArn,
  policy: [{
    Effect: "Allow",
    Principal: { Service: "aiops.alarms.cloudwatch.amazonaws.com" },
    Action: ["aiops:CreateInvestigation", "aiops:CreateInvestigationEvent"],
    Resource: "*",
    Condition: {
      StringEquals: { "aws:SourceAccount": "111122223333" },
      ArnLike: { "aws:SourceArn": "arn:aws:cloudwatch:us-east-1:111122223333:alarm:*" },
    },
  }],
});