Skip to content

NotiOps v1.0.17

Choose a tag to compare

View all tags
@xiuleiyy xiuleiyy released this 29 Aug 05:01
· 2 commits to main since this release
v1.0.17
323be97

NotiOps v1.0.17

This release is about the deployment finishing on its own. Creating an Agent
Space now also enables its operator web app, so nobody has to find the
Configure web app button in the console — and without that button, four
DevOps Agent capabilities used to fail with an error that never mentioned it.
The other half is a one-click fix that mattered more than it looked: in any
account that had ever run setup.sh, the one-click stack failed entirely, in
about nine seconds, over a log group name. Both deployment paths upgrade in
place.

⚠️ Sample/reference code, not a production-ready product. Review it with your
own security, legal, and compliance teams before deploying into an AWS account.

Features

  • The DevOps Agent operator web app is enabled for you. Deploying used to
    leave one manual step behind: open the console, go to Agent Space → Access →
    Operator access → Configure web app    , and click it. Skip it and the Agent
    Space has no https://<spaceId>.aidevops.global.app.aws domain, so
    CreateChat / CreateBacklogTask answer Invalid or unregistered domain and
    four capabilities die together — deep investigation, deep investigation
    (direct), DevOps Chat, and publishing a Skill to your DevOps Agent — while the
    error says nothing about a button you did not press.

    The Agent Space resource now carries the operator app configuration directly,
    along with the role it needs, so all three paths that create a space do
    this at create time:

    • the one-click CloudFormation stack,
    • setup.sh,
    • and the member-account StackSet — the biggest win, because a multi-account
      customer previously had to log into every member account and click it once
      per account.

    Only the iam authentication flow is configured (the BFF connects with
    SigV4); IAM Identity Center and external IdPs are left for you to choose.
    Deleting the stack disables the operator app on the way out. The one-click /
    setup.sh parity test has a new criterion that pins all three paths, so this
    cannot silently regress on one of them.

    Upgrading an existing deployment: if your Agent Space already exists and
    its web app was enabled by hand in the console, this template change asks
    CloudFormation to enable an already-enabled app. That path is not verified —
    it may be a no-op or it may conflict. If it conflicts, run
    aws devops-agent disable-operator-app --agent-space-id <id> and deploy again;
    the domain is derived from the space id, so turning it off and on does not
    change your URL    . New deployments are unaffected.

Fixes

  • One-click deployment failed for the whole stack in any account that had ever
    run setup.sh.     The stack died in about nine seconds with a single line:

    Resource of type 'AWS::Logs::LogGroup' with identifier
'/aws/lambda/notiops-web-notif-handler' already exists.

    (and only aws cloudformation describe-events shows even that much —
    describe-stack-events just says Validation failed with 1 error(s)).

    The name collision was not the whole story: a /aws/lambda/<function> group is
    also created by Lambda itself, and the one Lambda creates belongs to no
    stack — it never expires and it survives stack deletion. So one earlier
    setup.sh run in an account was enough for CloudFormation's
    NAME_CONFLICT_VALIDATION pre-check to reject every later one-click
    deployment, with nothing in the message tying it to notifications.

    The notification handler's log group is no longer named — CloudFormation names
    it and the function points at it through LoggingConfig, the shape the BFF
    already used. That also fixes the thing the hard-coded name was there for: the
    function writes only to this group and no longer creates a second one on first
    invocation. Both deployment paths are fixed, and the release gate now refuses
    to emit a template containing any hard-coded LogGroupName     (names that
    include the stack name are allowed — those are unique per stack).

    Already-deployed setup.sh environments keep the old orphan group after
    upgrading (old logs are still there, still never expiring); delete it by hand
    if you want it gone.

  • The one-click parameter undersold what it controls. The Agent Space that
    EnableDeepInvestigation creates carries four capabilities — deep
    investigation, deep investigation (direct), DevOps Chat, and publishing a Skill
    to your DevOps Agent — but the console label only said "deep investigation".
    Customers chose No expecting to lose one feature and lost DevOps Chat as
    well: greyed out, no error, the hardest kind to diagnose. The label now reads
    Enable AWS DevOps Agent features (deep investigation, DevOps Chat)? and the
    description names all four plus what No costs you. The parameter name is
    deliberately unchanged     — renaming it would drop the value when an existing
    stack is updated.

  • The "Escalate to AWS Support" shortcut button after an investigation is
    hidden.     The capability is untouched: the tool is still registered and still
    routed, so asking in plain language ("open a support case for this") works
    exactly as before.

Docs

  • One-click deployment §6.1 contained a
    promise that does not hold. KeepData was described as leaving your data for
    the next deployment to pick up; it does not, because the table and bucket names
    are fixed and CloudFormation's name-conflict pre-check fails the entire
    stack before creating a single resource. Verified with a two-line probe stack.
    KeepData is for keeping data in place to export or examine, not for
    redeploying on top of it — the stack cannot adopt tables that already exist.
    §6.4 now says plainly that you must delete those tables first if you intend to
    redeploy. §2.7 gains a note on the operator app, §3's resource count moves
    65 → 66, and §6.3 carries measured teardown times for both modes instead of
    claiming they are the same.
  • Which notification sources are on by default was backwards in four
    documents. It is: on — AWS Health, CloudWatch Alarm, Cost Anomaly, Trusted
    Advisor, GuardDuty; off — Backup, EC2 Spot, Auto Scaling, RDS, Config. The
    user guide also now says the two things a reader
    actually needs: three of the on-by-default sources only produce events once you
    enable the corresponding service (until then the rule is enabled but silent —
    harmless, no cost, effective the moment you enable it), and how to turn on the
    off-by-default ones on each path.
  • Deployment has a new §5.3.3 on the operator app,
    including the upgrade caveat above.

Upgrading

setup.sh:

git pull            # or re-clone at tag v1.0.17
./setup.sh          # re-run; existing resources are updated in place

One-click (CloudFormation): download notiops-webchat.template.json from the
assets below and update your stack with it — Replace existing template, then
Use existing value for every parameter. This upgrade replaces the
notification handler's log group with a CloudFormation-named one; it does not
resend the invitation email, change the admin credentials, revert Admin settings,
or clear chat history.

Your data is not touched: the conversation and configuration tables are Retain,
and re-seeding is idempotent.

If your deployment already has an Agent Space whose web app you enabled by hand,
read the upgrade note under Features before updating.

Do not mix assets across releases — the template and the four .zip files are
cryptographically bound (each checksum is baked into the template and the release
tag is part of every object key), and the stack verifies every checksum before
use.

Asset checksums (sha256)

b80f66fd5b73f4524796c1b3e36943f9e25171f13948db92634b280820e9548a  bff.zip
ed74863e3aa1bec38c0a8cf1b0977dd0d358adb624eaae7b0b5bd66ddc4e5109  chat-dist.zip
562440c873bbf88e558ffbf6ef4d8e3ad80204f4404b78a1d996da7167f5ef89  web-notif.zip
727acc3ef34c51635d9dc3797c1edc5054715646a43cd57b5fb804aeafb1bce0  agent-code.zip

Download notiops-webchat.template.json only. The four .zip assets are
pulled into a bucket in your account by the stack itself; you never need to
download them by hand. The template is above CloudFormation's 51,200-byte
--template-body limit — from the CLI, upload it to S3 first and pass
--template-url.

See README for full setup, one-click deployment
for the console walkthrough, and the documentation for architecture
and operations.

Assets 8
Loading