Automating Root Cause Analysis Using Amazon Bedrock Agents

bmw · Automotive · 2025 · source Agentic: yes · promotional bias: med · source-backed · extracted with prompt 0.5.4 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Cloud incident root-cause analysis

BMW needed to speed up root-cause analysis for connected-vehicle digital services spanning many components, teams, regions, and AWS observability sources.

Constraints:

BMW connected services serve more than 23 million vehicles
incidents can involve interdependent mobile apps, backend-for-frontend services, internal APIs, MQTT, and networking
engineers must inspect architecture, logs, metrics, and control-plane changes
the agent must propose hypotheses while keeping an on-call engineer in control
root causes need enough evidence for junior engineers to act

Architecture

BMW built an Amazon Bedrock ReAct agent for RCA. An on-call engineer provides an incident description. The agent uses custom Lambda-backed tools over C4/Structurizr architecture diagrams, CloudWatch Logs Insights, CloudWatch metrics, and CloudTrail control-plane events. Guided by ReAct reasoning, it gathers evidence, revises hypotheses, correlates logs/metrics/configuration changes, and presents likely root causes and follow-up investigation paths to the engineer.

Diagram confidence: explicit (topology described by the source).

flowchart LR
  on-call-engineer-interface[On-call engineer interface] --> amazon-bedrock-react-agent[Amazon Bedrock ReAct agent]
  amazon-bedrock-react-agent --> architecture-tool[Architecture tool]
  amazon-bedrock-react-agent --> logs-tool[Logs tool]
  amazon-bedrock-react-agent --> metrics-tool[Metrics tool]
  amazon-bedrock-react-agent --> infrastructure-tool[Infrastructure tool]
  architecture-tool --> amazon-bedrock-react-agent
  logs-tool --> amazon-bedrock-react-agent
  metrics-tool --> amazon-bedrock-react-agent
  infrastructure-tool --> amazon-bedrock-react-agent

Drag to pan · scroll or use +/− to zoom · reconstructed from the source's described component topology

Components

Component	Role	Interacts with
`On-call engineer interface`	Provides the incident description and directs follow-up investigation.	`Amazon Bedrock ReAct agent`
`Amazon Bedrock ReAct agent`	Iteratively reasons about incidents, selects tools, and ranks root-cause hypotheses.	`On-call engineer interface`, `Architecture tool`, `Logs tool`, `Metrics tool`, `Infrastructure tool`
`Architecture tool`	Uses C4/Structurizr diagrams to understand component relationships and dependencies.	`Amazon Bedrock ReAct agent`
`Logs tool`	Uses CloudWatch Logs Insights to find errors, patterns, and anomalies.	`Amazon Bedrock ReAct agent`
`Metrics tool`	Uses CloudWatch metrics to identify anomalies in latency, error rates, resource use, and invocations.	`Amazon Bedrock ReAct agent`
`Infrastructure tool`	Uses CloudTrail to detect control-plane changes and misconfigurations.	`Amazon Bedrock ReAct agent`

Data flow

The incident description enters the Bedrock ReAct agent. The agent queries architecture diagrams to identify impacted components, calls log/metric/infrastructure tools against relevant systems, reevaluates evidence after each tool call, ranks hypotheses, and returns likely causes to the on-call engineer for resolution or further direction.

4 supporting quotes

“When an incident occurs, an on-call engineer gives a description of the issue at hand to the Amazon Bedrock agent.”article, stated

“This agent has several custom-built tools at its disposal to do its job. These tools, implemented by [AWS Lambda](https://aws.”article, stated

“Guided by the ReAct framework’s iterative reasoning, the agent then gathers evidence by calling specialized tools, using data centrally aggregated in a [cross-account observability setup](https://aws.”article, stated

“Based on those findings, the agent infers and defines several hypotheses and presents these to the user, ordered by their likelihood.”article, stated

Why this architecture

RCA is a tool-selection and hypothesis-revision problem, so ReAct fits better than a static workflow. The architecture tool narrows the search space, logs/metrics/infrastructure tools collect concrete evidence, and the engineer-facing interface keeps humans in the decision loop. Tool modularity lets BMW adapt RCA to its multi-regional connected-vehicle infrastructure.

3 supporting quotes

“Unlike traditional methods, which rely on predefined workflows, ReAct agents use real-time inputs and iterative decision-making”article, stated

“The modular nature of the tools allows for flexibility and customization, making sure that RCA is tailored to the unique needs of BMW’s complex, multi-regional cloud infrastructure.”article, stated

“The engineer can then resolve the issue, or give pointers to the agent to direct the investigation further. In the following section, we take a closer look at the tools the agent uses.”article, stated

Models used: Amazon Bedrock Agents · ReAct agent framework

Scale

BMW has more than 154,000 employees.
“The BMW Group—headquartered in Munich, Germany—is a vehicle manufacturer with more than 154,000 employees, and 30 production and assembly facilities worldwide as well as research and development locations across 17 countries.”article, stated
BMW has 30 production and assembly facilities and R&D locations across 17 countries.
“30 production and assembly facilities worldwide as well as research and development locations across 17 countries.”article, stated
BMW Connected Company operates digital services for more than 23 million connected vehicles.
“BMW Connected Company is a division within BMW responsible for developing and operating premium digital services for BMW’s connected fleet, which currently numbers more than 23 million vehicles worldwide.”article, stated
The agent identified root causes in 85% of test cases.
“The solution has demonstrated measurable success, with the agent identifying root causes in 85% of test cases and providing detailed insights in the remainder, greatly expediting engineers’ investigations.”article, stated
The example investigation took minutes instead of hours.
“The entire process—from incident detection to resolution—took minutes, compared to the hours it could have taken with traditional RCA methods.”article, stated

Alternatives considered (roads not taken)

Manual RCA by engineers

Rejected because: Manual RCA requires checking many systems, teams, logs, and hypotheses across interdependent services.

“It requires checking many systems and teams, many of which might be failing, because they’re interdependent. Developers need to reason about the system architecture, form hypotheses, and follow the chain of components until they have located the one that is the culprit.”article, stated

Predefined RCA workflows

Rejected because: ReAct can adapt to the specific incident using real-time inputs and iterative tool calls.

“Unlike traditional methods, which rely on predefined workflows, ReAct agents use real-time inputs and iterative decision-making”article, stated

Blind log/metric search

Rejected because: Architecture diagrams help the agent target relevant dependencies before querying telemetry.

“enabling the agent to reason contextually about the architecture instead of blindly searching through logs or metrics.”article, stated

Patterns

`tool-use-orchestration` (agent-architecture)

The Bedrock agent chooses among architecture, log, metric, and infrastructure tools during RCA.

“The agent uses the other tools at its disposal in a targeted way”article, stated

`observability-tracing` (operations)

The agent queries CloudWatch logs/metrics, CloudTrail events, and cross-account observability data.

“using data centrally aggregated in a cross-account observability setup”article, stated

`human-in-the-loop-gate` (workflow)

The agent proposes hypotheses to an on-call engineer, who resolves the incident or directs further investigation.

“The engineer can then resolve the issue, or give pointers to the agent to direct the investigation further.”article, stated

`agent-memory` (context)

Architecture diagrams give the agent a reusable model of component dependencies and workflows.

“give the agent a hierarchical understanding of component relationships, dependencies, and workflows.”article, stated

Tradeoffs

Use ReAct rather than fixed workflows

Chose iterative reasoning and tool invocation over predefined RCA runbooks only.

Rationale: Incidents differ enough that the agent needs to adapt its investigation path.

“ReAct agents use real-time inputs and iterative decision-making to adapt to the specific circumstances of an incident.”article, stated

Keep engineers in control

Chose hypothesis proposal plus engineer follow-up over fully autonomous remediation.

Rationale: The article describes the agent helping diagnosis while engineers resolve or redirect.

“Based on the clues it uncovers, the agent proposes several likely hypotheses to the on-call engineer.”article, stated

Use modular Lambda tools

Chose specialized architecture/log/metric/infrastructure tools over one monolithic RCA prompt.

Rationale: Tool modules make RCA precise and tailored to BMW's infrastructure.

“By organizing its capabilities into specialized tools, the Amazon Bedrock agent makes sure that RCA is both efficient and precise.”article, stated

Gotchas (what bit them)

RCA across interdependent services requires backtracking.

Root cause: Multiple teams and components can fail together, so initial hypotheses may be wrong.

Resolution: The ReAct agent iteratively gathers evidence and reevaluates hypotheses.

“They often have to backtrack and reassess their hypotheses, and pursue the investigation in another chain of components.”article, stated

“By continuously reevaluating the results of each tool invocation”article, stated

A root cause can sit in control-plane changes rather than app code.

Root cause: The example incident was caused by a security group change blocking network traffic.

Resolution: The infrastructure tool uses CloudTrail data to catch configuration changes.

“a security group was inadvertently changed in the central networking account”article, stated

“The Infrastructure Tool uses CloudTrail data to analyze critical control-plane events”article, stated

Evaluation

BMW evaluated the RCA agent on representative proof-of-concept use cases and measured root-cause identification accuracy and diagnosis-time reduction.

Metrics: root-cause identification rate · diagnosis time · detailed insights in non-right-root-cause cases · junior engineer enablement

“correctly identifies the right root cause for most cases (measured at 85%)”article, stated

“performance was further validated during the proof of concept”article, stated

Outcomes

The agent identified root causes in 85% of test cases.
The example diagnosis took minutes rather than hours.
BMW reports that junior engineers can diagnose issues more effectively.
The agent improves system understanding with real-time insights.

BMW Connected Company operates digital services for over 23 million connected vehicles across complex, multi-regional infrastructure.

“The solution has demonstrated measurable success, with the agent identifying root causes in 85% of test cases”article, stated

“By lowering the barrier to entry for junior engineers, it has enabled less-experienced team members to diagnose issues effectively”article, stated