AWS.AIOps reference

GetInvestigationGroup

Source: src/AWS/AIOps/GetInvestigationGroup.ts

Runtime binding for aiops:GetInvestigationGroup.

Reads the bound InvestigationGroup’s full configuration — the telemetry-access role, retention period, encryption, tag key boundaries, chatbot notification channels, and cross-account configurations — so an ops function can audit or report on the Region’s investigation setup. The group’s ARN is injected from the binding. Provide the implementation with Effect.provide(AWS.AIOps.GetInvestigationGroupHttp).

GetInvestigationGroup: Reading the Investigation Group

// init — grants aiops:GetInvestigationGroup on the group
const getInvestigationGroup = yield* AWS.AIOps.GetInvestigationGroup(group);

// runtime
const detail = yield* getInvestigationGroup();
yield* Effect.log(
  `${detail.name} retains investigations for ${detail.retentionInDays} days`,
);

GetInvestigationGroupPolicy

Source: src/AWS/AIOps/GetInvestigationGroupPolicy.ts

Runtime binding for aiops:GetInvestigationGroupPolicy.

Reads the IAM resource policy attached to the bound InvestigationGroup (the policy that lets principals like aiops.alarms.cloudwatch.amazonaws.com create investigations), returned as a JSON string. Fails with the typed ResourceNotFoundException when no policy is attached. The group’s ARN is injected from the binding. Provide the implementation with Effect.provide(AWS.AIOps.GetInvestigationGroupPolicyHttp).

GetInvestigationGroupPolicy: Reading the Resource Policy

// init — grants aiops:GetInvestigationGroupPolicy on the group
const getInvestigationGroupPolicy =
  yield* AWS.AIOps.GetInvestigationGroupPolicy(group);

// runtime — no policy attached surfaces as a typed error
const attached = yield* getInvestigationGroupPolicy().pipe(
  Effect.map((r) => r.policy),
  Effect.catchTag("ResourceNotFoundException", () =>
    Effect.succeed(undefined),
  ),
);

InvestigationGroup

Source: src/AWS/AIOps/InvestigationGroup.ts

A CloudWatch investigations investigation group — the one-time, per-Region container that configures who can run AI-assisted operational investigations, which IAM role is used to access telemetry, how long investigation data is retained, and how it is encrypted.

You can have at most one investigation group per Region in an account, so replacements are performed delete-first.

InvestigationGroup: Creating an Investigation Group

Basic Investigation Group

import * as AIOps from "alchemy/AWS/AIOps";
import * as IAM from "alchemy/AWS/IAM";

const role = yield* IAM.Role("InvestigationsRole", {
  assumeRolePolicyDocument: {
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Principal: { Service: "aiops.amazonaws.com" },
      Action: ["sts:AssumeRole"],
    }],
  },
  managedPolicyArns: ["arn:aws:iam::aws:policy/AIOpsAssistantPolicy"],
});

const group = yield* AIOps.InvestigationGroup("Investigations", {
  roleArn: role.roleArn,
});

Short Retention and Tag Boundaries

const group = yield* AIOps.InvestigationGroup("Investigations", {
  roleArn: role.roleArn,
  retention: "7 days",
  tagKeyBoundaries: ["Application"],
  tags: { Environment: "test" },
});

InvestigationGroup: Resource Policy

const group = yield* AIOps.InvestigationGroup("Investigations", {
  roleArn: role.roleArn,
  policy: [{
    Effect: "Allow",
    Principal: { Service: "aiops.alarms.cloudwatch.amazonaws.com" },
    Action: ["aiops:CreateInvestigation", "aiops:CreateInvestigationEvent"],
    Resource: "*",
    Condition: {
      StringEquals: { "aws:SourceAccount": "111122223333" },
      ArnLike: { "aws:SourceArn": "arn:aws:cloudwatch:us-east-1:111122223333:alarm:*" },
    },
  }],
});

ListInvestigationGroups

Source: src/AWS/AIOps/ListInvestigationGroups.ts

Runtime binding for aiops:ListInvestigationGroups.

Enumerates the Region’s investigation groups (each item carries the group’s name and ARN). An account holds at most one investigation group per Region, so this doubles as an existence probe. Provide the implementation with Effect.provide(AWS.AIOps.ListInvestigationGroupsHttp).

ListInvestigationGroups: Listing Investigation Groups

// init — account-level binding, no resource argument
const listInvestigationGroups = yield* AWS.AIOps.ListInvestigationGroups();

// runtime
const { investigationGroups } = yield* listInvestigationGroups();
for (const group of investigationGroups ?? []) {
  yield* Effect.log(`${group.name}: ${group.arn}`);
}

ListTagsForResource

Source: src/AWS/AIOps/ListTagsForResource.ts

Runtime binding for aiops:ListTagsForResource.

Reads the tags on the bound InvestigationGroup — useful for ownership/audit reporting from an ops function. The group’s ARN is injected from the binding. Provide the implementation with Effect.provide(AWS.AIOps.ListTagsForResourceHttp).

ListTagsForResource: Reading Tags

// init — grants aiops:ListTagsForResource on the group
const listTagsForResource = yield* AWS.AIOps.ListTagsForResource(group);

// runtime
const { tags } = yield* listTagsForResource();
yield* Effect.log(`owned by team ${tags?.Team}`);