AWS 動作的應用程式可觀測性

建立 IAM 身分提供者

首先，在 AWS 管理主控台中建立信任 GitHub OIDC 端點的 IAM 身分提供者：

建立 IAM 政策

建立具有此動作所需許可的 IAM 政策。如需詳細資訊，請參閱以下所需的許可章節。

建立 IAM 角色

使用下列信任政策範本在 AWS 管理主控台中建立 IAM 角色 （例如 AWS_IAM_ROLE_ARN)。這可讓授權的 GitHub 儲存庫擔任該角色：

{
  "Version": "2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
        },
        "StringLike": {
          "token.actions.githubusercontent.com:sub": "repo:<GITHUB_ORG>/<GITHUB_REPOSITORY>:ref:refs/heads/<GITHUB_BRANCH>"
        }
      }
    }
  ]
}

取代範本中的下列預留位置：

連接 IAM 政策

在角色的許可索引標籤中，連接您在步驟 2 中建立的 IAM 政策。

設定儲存庫秘密

前往您的儲存庫 → 設定 → 秘密和變數 → 動作。

新增工作流程檔案

以下是示範將此動作與 Amazon Bedrock 模型搭配使用的範例工作流程。在 GitHub 儲存庫目錄 中，從此範本建立應用程式可觀測性調查工作流程.github/workflows。

name: Application observability for AWS

on:
  issue_comment:
    types: [created, edited]
  issues:
    types: [opened, assigned, edited]

jobs:
  awsapm-investigation:
    if: |
      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@awsapm')) ||
      (github.event_name == 'issues' && (contains(github.event.issue.body, '@awsapm') || contains(github.event.issue.title, '@awsapm')))
    runs-on: ubuntu-latest

    permissions:
      contents: write        # To create branches for PRs
      pull-requests: write   # To post comments on PRs
      issues: write          # To post comments on issues
      id-token: write        # Required for AWS OIDC authentication

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_IAM_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION || 'us-east-1' }}

      # Step 1: Prepare AWS MCP configuration and investigation prompt
      - name: Prepare Investigation Context
        id: prepare
        uses: aws-actions/application-observability-for-aws@v1
        with:
          bot_name: "@awsapm"
          cli_tool: "claude_code"

      # Step 2: Execute investigation with Claude Code
      - name: Run Claude Investigation
        id: claude
        uses: anthropics/claude-code-base-action@beta
        with:
          use_bedrock: "true"
          # Set to any Bedrock Model ID
          model: "us.anthropic.claude-sonnet-4-5-20250929-v1:0"
          prompt_file: ${{ steps.prepare.outputs.prompt_file }}
          mcp_config: ${{ steps.prepare.outputs.mcp_config_file }}
          allowed_tools: ${{ steps.prepare.outputs.allowed_tools }}

      # Step 3: Post results back to GitHub issue/PR (reuse the same action)
      - name: Post Investigation Results
        if: always()
        uses: aws-actions/application-observability-for-aws@v1
        with:
          cli_tool: "claude_code"
          comment_id: ${{ steps.prepare.outputs.awsapm_comment_id }}
          output_file: ${{ steps.claude.outputs.execution_file }}
          output_status: ${{ steps.claude.outputs.conclusion }}

組態備註：

調查效能問題並發佈和修正：

@awsapm, can you help me investigate availability issues in my appointment service?

@awsapm, can you post a fix?

啟用檢測：

@awsapm, please enable Application Signals for lambda-audit-service and create a PR with the required changes.

查詢遙測資料：

@awsapm, how many GenAI tokens have been consumed by my services in the past 24 hours?

工作流程會偵測@awsapm提及項目並觸發調查

AI 代理器會透過設定的 MCP 伺服器存取您的即時 AWS 遙測資料

代理程式會分析問題，並：

您可以使用後續問題再次提及 @awsapm，來檢閱結果並繼續對話