A new architecture (full rebuild)​

We unwound v1's single EC2 host — where build, runtime, and local state were all tangled together — into components that deploy and scale independently.

A refreshed experience​

• In-app login — sign in with email and password on the self-hosted /login form. Unauthenticated requests are sent to the sign-in screen at the edge.
• Three themes — a Cobalt (default) · Teal · Dark picker. Your choice persists, and charts and the brand mark adapt to the theme.
• Mobile responsive — a top bar + 5-tab bottom bar + slide-in drawer bring the full feature set to small screens.
• Command palette — Cmd-K (or Ctrl-K) jumps to any page/resource and switches theme.

AI — faster and smarter​

• AI Assistant — answers stream token-by-token and render as markdown (tables, code, lists). Questions are auto-routed to a domain (network, cost, security, …), and conversations are persisted so the drawer and the full-screen page share one history.
• AI Diagnosis — generate a comprehensive account-health report at Light / Mid / Deep depth and export it as MD · DOCX · PDF, with intended-vs-actual (invariant) checks and change insights vs the previous report.

Broader visibility​

• Topology — a request-flow graph from Route53 → CloudFront → LB → Target Group → target. Click a node for focus mode + a detail panel (ARN copy, ask-AI).
• Resource Inventory — sort, search, and inspect 20+ resource types (EC2, Lambda, RDS, S3, VPC, IAM, …).
• EKS / Kubernetes — a cluster fleet summary plus read-only in-cluster browsing of nodes/pods/deployments, with OpenCost install guidance.
• Cost — per-service breakdown and drill-down, month-end forecast, and Bedrock model usage (tokens, latency, cost, cache savings).
• Datasource Explore — query connected observability datasources read-only in their native language (PromQL/LogQL/TraceQL/SQL).

Read-only operations posture​

AWSops focuses on observing, analyzing, and diagnosing operations and does not change your AWS resources. For actions that require installing or changing something, it provides scripts and guidance you run yourself.

User guides​

See the guide docs for how to use each new screen:

• Introduction to AWSops
• Sign In · Layout & Themes
• Dashboard · AI Assistant · AI Diagnosis

Event Pre-Scaling (ADR-010 Phase 1+2)​

A new admin-only page at /event-scaling lets you warm resources before a large traffic event begins. The flow is four steps from registration to script download:

1. Register the event — name, start/end window, affected resource tags
2. Pull historical metrics — if the same event happened before, GetMetricData batches collect CloudWatch metrics for ASG, RDS, MSK, EBS, and ALB across the prior window
3. Generate an AI warmup plan — Bedrock Sonnet 4.6 produces a multi-phase per-resource scaling plan returned as structured JSON via the PLAN_JSON marker
4. Download bash scripts — safe, resource-typed generators emit KEDA/HPA, Aurora reader, MSK partition expansion, ASG warm pool, and EBS IOPS scripts

Review-Then-Run (mutation-by-review)​

The dashboard never executes mutating actions itself. Scripts are download-only — an operator reviews them and applies them through kubectl / aws cli from a controlled environment. This aligns with ADR-029 (Proposed): every AI-generated mutating action runs only after explicit human approval.

Files​

Aurora Data Layer Foundation (ADR-030 Phase 1)​

The single EC2 host today runs Next.js, embedded Steampipe, the AgentCore Docker build pipeline, and the data/*.json state writer. When Docker builds run, Next.js latency spikes and Steampipe FDW queries time out. ADR-030 splits all four onto ECS Fargate workloads + Aurora app state + dual-tier ECR (Dev=Private, Prod=Public, cosign-signed). v1.9.0 lands only the Phase 1 foundation.

What ships​

Opt-in deploy​

Default off. Activate via context flag:

cd infra-cdk
npx cdk deploy AwsopsDataStack -c enableAurora=true
# or
../scripts/13-deploy-aurora.sh deploy

The gate exists because (1) Aurora Serverless v2's 0.5-ACU floor (~$43/mo) isn't right for every environment, and (2) Phase 1 dual-write hasn't shipped yet, so actual data still lands in data/*.json.

Steampipe stays​

A subtle but important ADR-030 point: Steampipe is largely stateless. Its FDWs query AWS APIs live and hold results only in-memory — there's no on-disk "data" to lose when a container restarts. Aurora doesn't replace Steampipe; it replaces the JSON files (inventory, cost snapshots, conversation memory, alert records, event-scaling plans, report schedules) that the dashboard itself writes to local disk.

Coming next (Phase 1 dual-write)​

Seven source files will gain an Aurora write path alongside their existing JSON write. Reads continue from JSON until the 7-day parity gate clears:

• resource-inventory.ts, cost-snapshot.ts, agentcore-memory.ts, agentcore-stats.ts, alert-knowledge.ts, event-scaling.ts, report-scheduler.ts

ADR-029: Mutating Action Framework (Proposed)​

Event pre-scaling ships as review-then-run because the gate model for ADR-010 Phase 3 (automatic execution) hasn't been settled. ADR-029 records that gate in Proposed status — under what conditions and authorization model an AI-generated mutating action becomes executable — as a prerequisite for any future Phase 3 work.

AI Code Review Workflow​

A new GitHub Actions workflow (.github/workflows/claude-review.yml) invokes Claude to automatically review pull requests when they are opened or updated. The review prompt is tuned for AWSops conventions (Steampipe pg Pool, basePath, SCP-blocked columns, etc.).

Hardened Zombie Connection Cleanup​

src/lib/steampipe.ts's zombie cleanup no longer borrows a connection from the pool. It opens a dedicated short-lived Client instead, so cleanup keeps running even when Cost Explorer / IAM-summary FDW paths exhaust the pool. The age threshold has been lowered to 90 seconds.

Stats comparison​

References​

• ADR-010: Event-Driven Pre-Scaling (Phase 1+2 Accepted)
• ADR-029: Mutating Action Framework (Proposed)
• ADR-030: ECS Fargate + Aurora + Dual-Tier ECR (Accepted, Phase 1 partial)

Alert-Triggered AI Diagnosis (ADR-009)​

When a critical incident occurs, a scoped AI diagnosis runs automatically.

Pipeline Flow​

[CloudWatch Alarm] → SNS Topic → SQS Queue
                                    ↓
                            [EC2 Poller (15s)]
                                    ↓
[Alertmanager/Grafana/Generic] → POST /api/alert-webhook
                                    ↓
                            [alert-correlation.ts]
                                    ↓
                         [alert-diagnosis.ts (AI)]
                                    ↓
                          [Slack/SNS Dispatch]

Supported Sources​

Correlation Engine​

src/lib/alert-correlation.ts groups individual alerts into incidents:

Scoped Auto-Diagnosis​

Unlike the full 15-section diagnosis, this runs only within the firing alert's scope and completes in 1–2 minutes:

1. AlertContext build — extract affected services/resources/namespaces + since timestamp
2. Scoped collection — CloudWatch metrics filtered to ±10 min around since and matched resources only
3. Section selection — run 3–5 of the 15 sections (Compute / Network / Container)
4. Change detection — compare against recent Terraform state / CloudTrail
5. Bedrock Sonnet analysis — root cause hypothesis + next steps

// src/lib/alert-diagnosis.ts (core interface)
interface AlertContext {
  services: string[];
  resources: string[];
  namespaces: string[];
  since: Date;     // firing time − 10 min
  until: Date;     // firing time + 10 min
}

Slack Notifications (Block Kit)​

Severity drives channel routing and thread updates:

• Initial alert is the main message; follow-ups (merged alerts, AI diagnosis results, resolution) post as replies in the same thread
• Threading works in both Webhook and Bot Token modes (thread_ts is cached)
• CloudWatch OK / Alertmanager resolved → ✅ resolution reply

HMAC Authentication​

Shared secret is stored in alertWebhookSecret in data/config.json:

curl -X POST https://awsops.example.com/awsops/api/alert-webhook \
  -H 'X-Alert-Source: generic' \
  -H "X-Signature-256: sha256=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')" \
  -H 'Content-Type: application/json' \
  -d "$BODY"

Alert Knowledge Base​

Diagnosis records persist under data/alert-diagnosis/:

The UI Knowledge Base tab searches past similar incidents, and new incidents get similarity-based recommendations automatically.

Major Documentation Expansion​

18 New ADRs (011–028)​

Design decisions behind features added in v1.8.0 are now formalized:

5 New Runbooks​

Practical troubleshooting/setup guides for operational scenarios:

• alert-pipeline-troubleshoot.md — webhooks not arriving, correlation not forming incidents, Slack silent
• cache-warmer-operations.md — debug cache warmer, add/remove queries
• cognito-auth-troubleshoot.md — Lambda@Edge, HttpOnly cookies, OAuth2 callback issues
• deploy-flow.md — operational manual for the 11-step deployment scripts
• multi-account-setup.md — Aggregator config, cross-account IAM role, verification

11 New Module CLAUDE.md Files​

Each source module now documents its role/rules/key files as Claude context:

Web Guide Expansion​

The Docusaurus guide now reflects v1.8 features:

• monitoring/ai-diagnosis.md — 15-section diagnosis, export formats (DOCX/MD/PDF/PPTX), scheduling, cost control tips
• monitoring/alerts.md — full alert pipeline flow, HMAC, correlation, Slack threading, knowledge base
• intro.md — updated to 40 pages / 18 APIs / 11 AI routes, added "AI Diagnosis & Alert Pipeline" feature block
• faq/troubleshooting.md — Slack alert failure / AI diagnosis partial failure cases
• Both Korean (docs/) and English (i18n/en/docusaurus-plugin-content-docs/current/) versions updated

Bug Fix Highlights​

Key File Changes​

Version Comparison​

References​

• ADR-009: Alert-triggered AI diagnosis
• ADR-012: SNS notification strategy
• ADR-013: Auto-collect investigation agents
• ADR-020: HMAC webhook authentication

External observability integration (7 platforms)​

On top of AWS data, AWSops connects existing observability platforms as datasources.

• /datasources — datasource CRUD · connection test · auth configuration
• /datasources/explore — direct query execution + AI query generation (natural language → PromQL/LogQL/TraceQL/SQL)
• The AI assistant's datasource route auto-classifies external-metric questions (AI routing expanded 10 → 11)

AI comprehensive diagnosis (15 sections)​

• Bedrock Opus analyzes the whole infrastructure across 15 sections — focused on cost/security/reliability
• Export to DOCX · Markdown · browser Print-to-PDF
• Weekly/biweekly/monthly auto-schedule (report scheduler)
• Print-friendly report page /ai-diagnosis/report (A4 page breaks)

Security (SSRF protection)​

• URL validation in datasource-client.ts protects all outbound fetch paths, including the AI route
• Allowlist-based private-network access control + IPv6 private/link-local detection (fc00::/7, fe80::/10)
• Datasource query and AI query generation are admin-only

Also​

• Converse Stream API for multi-route synthesis + typing effect for AgentCore responses
• Automatic zombie PostgreSQL connection cleanup; time-range filters on monitoring queries to prevent pg pool exhaustion
• EKS Access Entry status + kubeconfig registration, EKS service resources tab

AI Diagnosis Renewal​

The route has been renamed from /diagnosis to /ai-diagnosis, and the entire UI has been revamped.

Before / After​

3 Export Formats​

DOCX — Professional A4 report via docx package:

• Cover page (title, health score, account alias, date)
• Table of contents (hyperlinks, Heading 1-3)
• Section-specific accent colors (cost=green, security=red, network/EKS=purple, idle/MSK=orange)
• Markdown parsing (headings, tables, lists, blockquotes, inline code/bold/italic)

Markdown — All sections concatenated into a single .md file.

PDF — Dedicated print page at /ai-diagnosis/report:

• White background A4 layout with CSS @media print page breaks
• "Print / Save as PDF" button triggers browser Print-to-PDF

// src/lib/report-docx.ts (key structure)
const doc = new Document({
  sections: [
    coverPage(title, healthScore, accountAlias, date),
    tableOfContents(),
    ...sections.map(s => sectionPage(s, accentColor)),
  ],
});
const buffer = await Packer.toBuffer(doc);

Scheduled Reports​

// src/lib/report-scheduler.ts
type Schedule = {
  enabled: boolean;
  frequency: 'weekly' | 'biweekly' | 'monthly';
  dayOfWeek?: number;   // 0=Sun ~ 6=Sat
  dayOfMonth?: number;  // 1~28
  hour: number;         // KST
  language: 'ko' | 'en';
};

Toggle ON/OFF in the UI, set frequency/day/hour/language, and reports are automatically generated and uploaded to S3.

6 Auto-Collect Agents​

Dedicated agents that automate data collection for the AI Diagnosis report. Each agent collects data from multiple sources in parallel and streams live status updates.

// src/lib/collectors/types.ts
export interface Collector {
  collect(send: SendFn, accountId?: string, isEn?: boolean): Promise<CollectorResult>;
  formatContext(data: CollectorResult): string;
  analysisPrompt: string;
  displayName: string;
}

FinOps MCP Lambda​

5 FinOps tools added to the Cost Gateway.

All tools support cross-account queries via the target_account_id parameter.

EKS/K8s Major UX Improvements​

Cluster Access Management​

New Features​

Bug Fixes​

• external_ip → external_ips column name fix (services 0/0 bug)
• EC2 IAM Role ARN truncation fix (SQL || operator filter conflict)
• Prevent cluster filter toggle on Register click (stopPropagation)
• Post-registration polling for connection verification (5 attempts × 3s)

Benchmark: Powerpipe Exit Code 2 Handling​

Powerpipe exits with exit code 2 when benchmark controls have alarms. This is expected behavior, but the previous code treated it as an error.

# Ignore exit code, validate by output file
powerpipe benchmark run ... > "${tmpFile}" 2>"${errorFile}"; \
if [ -s "${tmpFile}" ]; then
  mv "${tmpFile}" "${resultFile}" && echo "done" > "${statusFile}";
else
  echo "error" > "${statusFile}";
fi

Infrastructure: S3 Report Upload + update-infra Script​

S3 Policy​

S3 permissions added to the EC2 role in the CDK stack:

// infra-cdk/lib/awsops-stack.ts
ec2Role.addToPolicy(new iam.PolicyStatement({
  actions: ['s3:PutObject', 's3:GetObject'],
  resources: [`arn:aws:s3:::awsops-deploy-${this.account}/reports/*`],
}));

update-infra Script​

00-update-infra.sh script for safe CDK stack updates without EC2 replacement:

1. Read existing stack parameters — Preserve current CloudFormation values
2. Reconstruct CDK context — Re-derive from live infrastructure (VPC, TGW, domain)
3. cdk diff preview — Warn if EC2 would be replaced
4. Deploy — Safe deployment with --no-rollback

Version Comparison​

Key File Changes​

External Datasource Management​

Connect and query external observability tools directly from AWSops, similar to Grafana's datasource management.

7 Supported Datasource Types​

Feature Details​

config.json Datasource Configuration​

Datasources are managed via a datasources array in data/config.json:

{
  "costEnabled": true,
  "agentRuntimeArn": "arn:aws:bedrock-agentcore:...",
  "datasources": [
    {
      "id": "prom-1",
      "name": "Production Prometheus",
      "type": "prometheus",
      "url": "https://prometheus.example.com:9090",
      "authType": "bearer",
      "authConfig": { "token": "***" },
      "isDefault": true
    }
  ]
}

Security: SSRF Defense​

A validation layer prevents SSRF (Server-Side Request Forgery) attacks before sending requests to external URLs.

// src/lib/datasource-client.ts (simplified)
function validateUrl(url: string): void {
  const parsed = new URL(url);
  const hostname = parsed.hostname;

  // Block private IP ranges
  const privatePatterns = [
    /^10\./, /^172\.(1[6-9]|2\d|3[01])\./,
    /^192\.168\./, /^127\./, /^169\.254\./, /^0\./,
  ];

  // Block cloud metadata endpoint
  if (hostname === '169.254.169.254') {
    throw new Error('SSRF blocked: cloud metadata endpoint');
  }
}

Security: ClickHouse SQL Injection Prevention​

ClickHouse queries use parameterized queries instead of string interpolation:

// Safe: parameterized query
const response = await fetch(`${url}/?param_service=${encodeURIComponent(service)}`, {
  method: 'POST',
  body: `SELECT * FROM logs WHERE service = {service:String}`,
});

Dynamic VPC CIDR​

VPC CIDR can now be set via CDK context parameters.

cdk deploy -c newVpcCidr=10.20.0.0/16 \
  -c tgwRouteCidrs=10.10.0.0/16,10.30.0.0/16,172.16.0.0/12

Datasource Diagnostics Agent​

A dedicated agent for systematically diagnosing external datasource connection issues. A new datasource route (priority 11) is added to AI routing.

Diagnostic areas: Network (host reachability, firewall/SG), Authentication (credential validity, token expiry), SSL/TLS (certificate chain), DNS (resolution, propagation).

Version Comparison​

Real-time Synthesis with Converse Stream API​

Multi-route response synthesis has transitioned from fake chunking to real token streaming.

Before / After​

Code Changes​

Before — synthesizeResponses() + simulateStreaming():

// src/app/api/ai/route.ts (v1.7.0)
const synthesized = await synthesizeResponses(
  lastMsg, successful, modelKey, clientLang
);
// Split completed text into 50-char chunks for fake streaming
await simulateStreaming(synthesized, send);

After — synthesizeResponsesStreaming() + ConverseStreamCommand:

// src/app/api/ai/route.ts (v1.7.1)
const synthesized = await synthesizeResponsesStreaming(
  lastMsg, successful, send, modelKey, clientLang
);
// send() callback transmits chunk immediately on each contentBlockDelta

synthesizeResponsesStreaming() core logic:

const response = await bedrockClient.send(new ConverseStreamCommand({
  modelId,
  system: [{ text: systemPrompt }],
  messages: [{ role: 'user', content: [{ text: synthesisPrompt }] }],
  inferenceConfig: { maxTokens: 4096 },
}));

for await (const event of response.stream) {
  if (event.contentBlockDelta?.delta?.text) {
    const text = event.contentBlockDelta.delta.text;
    fullContent += text;
    send('chunk', { delta: text });  // Immediate token delivery
  }
}

Typing Effect (simulateStreaming)​

Since AgentCore Gateway returns completed text all at once, a typing effect is simulated.

// src/app/api/ai/route.ts
const CHUNK_SIZE = 50;     // 50 chars per chunk
const CHUNK_DELAY_MS = 15; // 15ms delay between chunks

async function simulateStreaming(
  text: string,
  send: (event: string, data: any) => void,
): Promise<void> {
  for (let i = 0; i < text.length; i += CHUNK_SIZE) {
    const chunk = text.slice(i, i + CHUNK_SIZE);
    send('chunk', { delta: chunk });
    if (i + CHUNK_SIZE < text.length) {
      await new Promise(r => setTimeout(r, CHUNK_DELAY_MS));
    }
  }
}

Applied to (3 locations):

1. Single AgentCore Gateway response — Typing effect on completed text
2. Multi-route synthesis (v1.7.0) — Applied to synthesizeResponses() result (replaced by Converse Stream in v1.7.1)
3. Multi-route single success — When only 1 Gateway succeeds

Chat Bubble Width Stabilization (PR #8)​

Fixed an issue where chat bubble width would suddenly change during SSE streaming.

Before — Width jump:

<div class="max-w-5xl rounded-lg px-4 py-3 ...">
  <!-- Narrow when content is short, suddenly widens when longer -->
</div>

After — Stable width:

<div class="w-full max-w-5xl rounded-lg px-4 py-3 ...">
  <!-- w-full ensures max width from start, max-w-5xl caps the upper limit -->
</div>

Monitoring Query Time Range Filters​

Fixed an issue where monitoring queries without time range limits were fetching full historical data via the Steampipe API, occupying all 5 pg pool connections.

Summary of 3 Streaming Modes​

In v1.7.1, AWSops AI responses use 3 streaming modes depending on the situation.

Multi-Account Architecture (PR #6)​

Manage multiple AWS accounts from a single dashboard using the Steampipe Aggregator pattern. Add accounts by simply changing the accounts[] array in data/config.json with no code changes required.

config.json Structure​

{
  "accounts": [
    {
      "accountId": "111111111111",
      "alias": "Host",
      "connectionName": "aws_111111111111",
      "region": "ap-northeast-2",
      "isHost": true,
      "features": {
        "costEnabled": true,
        "eksEnabled": true,
        "k8sEnabled": true
      }
    },
    {
      "accountId": "222222222222",
      "alias": "Staging",
      "connectionName": "aws_222222222222",
      "region": "ap-northeast-2",
      "isHost": false,
      "features": {
        "costEnabled": false,
        "eksEnabled": false,
        "k8sEnabled": false
      }
    }
  ]
}

Security Fixes (25 Items)​

25 security issues were fixed, classified into 3 severity levels.

CRITICAL Details:

HIGH Details:

Real-time Bedrock Streaming​

Bedrock responses are transmitted in real time, chunk by chunk.

Cache Pre-warming​

Background cache pre-warming introduced to improve dashboard loading speed.

Customer Logo Customization​

Set a customer logo in data/config.json and it reflects within 1 minute without server restart.

{
  "customerLogo": "/logos/customer-logo.png",
  "customerName": "Customer Corp",
  "customerLogoBg": "#ffffff"
}

• Place logo files in the public/logos/ directory
• Brand switching via config change only — no code changes required

Version Comparison​

Internationalization (i18n)​

Language switching is based on React Context + localStorage without URL routing. This design avoids conflicts with Next.js basePath: '/awsops'.

Translation Coverage:

• All 35 page texts
• Header, Sidebar menu labels
• AI status messages (Analyzing, Connecting to Gateway, Complete, etc.)
• DataTable column headers
• StatsCard labels

Bedrock Monitoring (/bedrock)​

Monitors per-model Bedrock usage through CloudWatch metrics and AWSops app token tracking.

Docusaurus User Guide​

Built a Docusaurus-based user guide site in the web/ directory.

Version Comparison​

AgentCore Memory Store​

Introduced a Memory Store that retains per-user conversation history for 365 days. Storage/search logic is managed in src/lib/agentcore-memory.ts.

AgentCore Page Integration:

• 6 StatsCards: total calls, average response time, per-gateway call ratio, per-model token usage
• Conversation history search: keyword, date range, per-route filters

AI Page Integration:

• Bottom toggle panel for viewing conversation history
• Ability to reference previous question/response context

New Pages (4)​

Container Cost Analysis​

Added 2 pages and APIs for analyzing ECS and EKS container costs.

AI Routing Improvements​

Security Enhancements​

AgentCore Dashboard (/agentcore)​

A dedicated dashboard for monitoring the status of Bedrock AgentCore Runtime and all 8 Gateways at a glance.

• Runtime Status: Queries status using agentRuntimeArn from data/config.json
• 8 Gateway Cards: Shows each Gateway's status, tool count, and key features
• Full 125 Tool List: Supports search and per-Gateway filtering
• Architecture Diagram: Visualizes Runtime → Gateway → Lambda relationships

Sign Out​

Added a logout button to the Header for safely terminating Cognito sessions.

CloudWatch Metrics Tables (4 Services)​

Added dedicated API routes and CloudWatch metrics tables for 4 services. All follow the same pattern (cloudwatch get-metric-data → progress bar + numeric values).

Resource Inventory (PR #1)​

Monitor quantity trends for 18 resource types on the /inventory page.

• Multi-line Chart: Time series of resource quantity changes
• Cost Impact Estimation: Estimated cost based on resource changes
• src/lib/resource-inventory.ts: Snapshot-based (data/inventory/), zero additional queries
• Cost Explorer Availability: Automatic MSP Payer detection via checkCostAvailability()

S3 / RDS / ElastiCache Enhancements​

Monitoring Enhancements​

• Instance Detailed Metrics View: Date Range selection (1h ~ 30d)
• Resource Topology: Graph/Map View toggle (React Flow)

Multi-Route AI Architecture​

Complex queries are analyzed and up to 3 Gateways are called simultaneously, with Bedrock synthesizing the responses.

Dashboard Redesign​

18 cards arranged in a 6x3 layout, mapped 1:1 with sidebar menu items.

• Card sub-metrics: Key figures in 18 running · 4 stopped format
• CIS Compliance Pass Rate: Overall benchmark pass rate gauge
• Monthly Cost: Current month cost + MoM change rate
• Resource Distribution + K8s Pod Status: Visualized with Recharts charts

SSE Streaming AI Responses​

Improved UX by streaming AI responses in real time.

• status event: Displays stages — Analyzing → Gateway connection → Tool calls
• chunk event: Real-time response text delivery
• done event: Final result + tools used + response time + token count
• Added response time display, clipboard copy, and related question suggestions

New Pages (3)​

VPC & Network Enhancements​

• VPC Resource Map: AWS Console-style 4-column layout

  VPC → Subnets → Route Tables → Connections (IGW/NAT/TGW/VPN)
  

• Route Table Tab: Subnet associations, routing rules table
• TGW Route Tables: Transit Gateway route table details
• Resource Topology: React Flow-based Graph View / Map View toggle

EKS & Cost Enhancements​

EKS Improvements:

• K8s Overview node cards: CPU/Memory progress bars
• Node details: ENI card + per-ENI traffic + Pods table
• EKS Explorer: Status/Node filters, pagination

Cost Explorer Improvements:

• Period/Service filters, Projected end-of-month cost, MoM Change
• Monthly Trend line, Cost by Service pie chart

Gateway Split: Infra → Network + Container​

The v1.1.0 Infra Gateway (41 tools) contained too many tools, so it was split into Network and Container domains.

Deployment Stability Improvements​

Added error handling and automatic detection logic to deployment scripts.

Test Results: 104/104 Passed​

Key Bug Fixes​

Before / After: Gateway Architecture​

7 Role-Based Gateways​

Each Gateway provides a tool set optimized for a specific domain. Gateway URLs are managed in the GATEWAYS dictionary in agent.py.

19 Lambda Functions​

Managed in the agent/lambda/ directory, with create_targets.py for bulk Gateway Target creation.

Dynamic Routing System​

9-level priority keyword-based routing in src/app/api/ai/route.ts.

• agent.py: Gateway selection via payload.gateway parameter
• route.ts: 9-level priority keyword-based routing
• Sonnet intent classifier introduced (c56f557) — Selects optimal Gateway via natural language analysis when no keyword match

AI Test Results​

104-question test conducted to verify the effectiveness of Gateway separation.

Architecture Overview​

User requests arrive at CloudFront, pass through the ALB, and reach the Next.js app running on EC2, which queries AWS APIs in real time via Steampipe using SQL.

CDK Infrastructure Migration​

Transitioned from CloudFormation YAML templates to AWS CDK TypeScript for infrastructure-as-code management.

Cognito Authentication​

Built a user authentication system using AWS Cognito.

• Lambda@Edge (Python 3.12, us-east-1) — JWT verification at CloudFront viewer-request
• OAuth2 Authorization Code flow for secure authentication
• 07-setup-cloudfront-auth.sh script for automatic setup

AgentCore Runtime + Gateway​

AI agent system leveraging Amazon Bedrock AgentCore.

Initial Dashboard​

• Recharts metrics visualization — CPU, Memory, Network trends
• React Flow network topology — VPC, Subnet, Route Table relationships
• CIS Compliance — v1.5 ~ v4.0 benchmark automated checks (Steampipe aws_compliance tables)
• AI Routing — Code Interpreter → AgentCore → Steampipe+Bedrock → Bedrock Direct

Claude Code Scaffolding​

Claude Code integration environment configured for improved development productivity.

• Module CLAUDE.md — Context documents for each directory (src/lib/CLAUDE.md, src/app/CLAUDE.md, etc.)
• Auto-Sync Rules — Automatic documentation sync rules on code changes
• .claude/hooks/check-doc-sync.sh — Documentation sync verification hook