AWS Action 应用程序可观测性

创建 IAM 身份提供者

首先，在 AWS 管理控制台中创建一个信任 GitHub 的 OIDC 端点的 IAM 身份提供者：

创建 IAM 策略

创建具有执行此操作所需权限的 IAM 策略。有关详细信息，请参阅所需权限一节。

创建 IAM 角色

使用以下信任策略模板，在 AWS 管理控制台中创建 IAM 角色（例如 AWS_IAM_ROLE_ARN），以允许授权的 GitHub 存储库担任该角色：

{
  "Version": "2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
        },
        "StringLike": {
          "token.actions.githubusercontent.com:sub": "repo:<GITHUB_ORG>/<GITHUB_REPOSITORY>:ref:refs/heads/<GITHUB_BRANCH>"
        }
      }
    }
  ]
}

替换模板中的以下占位符：

附加 IAM 策略

在该角色的“权限”选项卡中，附加您在步骤 2 中创建的 IAM 策略。

配置存储库密钥

前往您的存储库 →“设置”→“密钥和变量”→“操作”。

添加工作流文件

以下是演示如何在 Amazon Bedrock 模型中使用此操作的工作流示例。在 GitHub 存储库目录 .github/workflows 中从此模板创建应用程序可观测性调查工作流。

name: Application observability for AWS

on:
  issue_comment:
    types: [created, edited]
  issues:
    types: [opened, assigned, edited]

jobs:
  awsapm-investigation:
    if: |
      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@awsapm')) ||
      (github.event_name == 'issues' && (contains(github.event.issue.body, '@awsapm') || contains(github.event.issue.title, '@awsapm')))
    runs-on: ubuntu-latest

    permissions:
      contents: write        # To create branches for PRs
      pull-requests: write   # To post comments on PRs
      issues: write          # To post comments on issues
      id-token: write        # Required for AWS OIDC authentication

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_IAM_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION || 'us-east-1' }}

      # Step 1: Prepare AWS MCP configuration and investigation prompt
      - name: Prepare Investigation Context
        id: prepare
        uses: aws-actions/application-observability-for-aws@v1
        with:
          bot_name: "@awsapm"
          cli_tool: "claude_code"

      # Step 2: Execute investigation with Claude Code
      - name: Run Claude Investigation
        id: claude
        uses: anthropics/claude-code-base-action@beta
        with:
          use_bedrock: "true"
          # Set to any Bedrock Model ID
          model: "us.anthropic.claude-sonnet-4-5-20250929-v1:0"
          prompt_file: ${{ steps.prepare.outputs.prompt_file }}
          mcp_config: ${{ steps.prepare.outputs.mcp_config_file }}
          allowed_tools: ${{ steps.prepare.outputs.allowed_tools }}

      # Step 3: Post results back to GitHub issue/PR (reuse the same action)
      - name: Post Investigation Results
        if: always()
        uses: aws-actions/application-observability-for-aws@v1
        with:
          cli_tool: "claude_code"
          comment_id: ${{ steps.prepare.outputs.awsapm_comment_id }}
          output_file: ${{ steps.claude.outputs.execution_file }}
          output_status: ${{ steps.claude.outputs.conclusion }}

配置备注：

调查性能问题并发布和修复：

@awsapm, can you help me investigate availability issues in my appointment service?

@awsapm, can you post a fix?

启用埋点：

@awsapm, please enable Application Signals for lambda-audit-service and create a PR with the required changes.

查询遥测数据：

@awsapm, how many GenAI tokens have been consumed by my services in the past 24 hours?

工作流会检测到提及 @awsapm 并触发调查

人工智能代理通过配置的 MCP 服务器访问您的实时 AWS 遥测数据

该代理会分析问题，然后：

您可以通过再次提及 @awsapm 并提出后续问题来查看结果并继续对话