Architecture Overview

High-Level Design

OpsWorker is a cloud-native, serverless platform built on AWS. It consists of three main components:

graph TB
    subgraph "Your Infrastructure"
        Mon[Monitoring Systems<br/>Prometheus, Grafana Alerting, Datadog]
        K8s[Kubernetes Clusters]
        Agent[OpsWorker Agent<br/>in-cluster, read-only]
    end

    subgraph "OpsWorker Cloud (AWS)"
        API[API Gateway<br/>Bearer auth]
        Queue[SQS]
        Norm[Alert Normalizer Lambda]
        Inv[Invocation Lambda<br/>filters via AlertRules]
        AI[AI Investigation Engine<br/>Strands agent graph]
        DB[(DynamoDB + S3)]
        Notify[Notification Service]
    end

    subgraph "Team Tools"
        Slack[Slack]
        Portal[OpsWorker Portal]
    end

    Mon -->|Webhook| API
    API --> Queue --> Norm --> DB
    DB --> Inv --> AI
    AI <-->|SQS| Agent
    Agent -->|read-only API queries| K8s
    AI -->|Bedrock| DB
    DB --> Notify
    Notify --> Slack
    DB --> Portal

Components

OpsWorker Cloud

The serverless backend running on AWS:

Component	Technology	Purpose
API Gateway	AWS API Gateway (Bearer auth)	Receives alert webhooks
Alert Normalizer	AWS Lambda	Converts alerts to a common format and stores them in DynamoDB
Invocation Lambda	AWS Lambda	Filters normalized alerts against AlertRules and triggers investigations
Investigation Engine	AWS Lambda + Strands	Multi-agent AI investigation
Data Store	DynamoDB + S3	Investigation data and results
Notification Service	SNS + Lambda	Slack notifications and daily digests
Customer Portal	Next.js (CloudFront)	Web interface for users

There is no separate "rule engine" component: alert filtering happens inside the Invocation Lambda, which evaluates each normalized alert against the organization's AlertRules before starting an investigation.

Kubernetes Agent

A lightweight Go binary deployed in customer clusters via Helm:

• Communicates outbound-only via AWS SQS
• Performs read-only Kubernetes API queries (built-in view ClusterRole)
• Returns gathered data to the investigation engine

Customer Integrations

External services connected to OpsWorker:

• Alert sources: Prometheus Alertmanager and Datadog (Grafana Alerting arrives in Alertmanager format)
• Notifications: Slack
• Code: GitHub, GitLab
• Observability queries: Grafana MCP (PromQL, LogQL, dashboards), Kubernetes MCP
• AI: AWS Bedrock (Amazon Nova and Claude) and the direct Anthropic API

Design Principles

Principle	Implementation
Security-first	Read-only cluster access, outbound-only communication, no stored cluster credentials
Serverless	No servers to manage, automatic scaling, pay-per-use
Multi-tenant	Logical, application-layer data isolation by organization on shared DynamoDB tables
Event-driven	Alerts trigger investigations asynchronously via message queues
Multi-model AI	Different AI models optimized for each investigation stage

Next Steps

• Investigation Flow: Detailed data flow
• Security & Compliance: Security architecture
• Deployment Options: Available deployment models