At three in the morning, incident response is mostly archaeology. An on-call engineer opens dashboards, filters logs, lines up deployment timestamps and tries to work out, from thousands of weakly correlated signals, what changed forty minutes ago. AWS is now offering to do the digging with a model.
CloudWatch, the company's monitoring service, is gaining an AI-assisted investigation capability: rather than only raising an alarm, it assembles the surrounding evidence — metrics, logs, traces, resource changes and recent deployments — and proposes hypotheses about what broke and why. The human still decides; the machine does the first pass over the haystack.
It is the same direction nearly every observability vendor has taken. Datadog, Dynatrace, Grafana, Splunk and others have spent two years bolting assistants onto their platforms, because the underlying problem is embarrassingly language-shaped: telemetry was always queryable, but only by people who knew the query language and the system's history. A model that can read both telemetry and runbooks is a genuinely better interface, not just a feature checkbox.
The risk is specific to the domain. An assistant that is confidently wrong is dangerous at the best of times; during an outage it can send a team down a fifteen-minute rabbit hole while the actual fault sits untouched. That is why the credible implementations keep the model read-only, force it to cite the raw telemetry behind each hypothesis and require a human to approve any remediation. Anything that lets an agent restart production on its own inference is a liability with a dashboard.
The quieter question is where the telemetry goes. Enterprises will want to know what leaves their account, how long it is retained, whether it can be used to improve a model, and how the system behaves for a customer whose logs are the sensitive part of the product. Those answers, not the demo, will decide adoption.
