AI SRE for AWS
Sherlocks AI on AWS is an AI SRE that picks up your CloudWatch alerts, reads the telemetry you already have, and returns a root cause with the evidence attached, in minutes rather than hours. Sixteen investigation agents run read-only inside your VPC, and your data never leaves your AWS account.
sre@prod-bastion ~ $ sherlocks investigate --source cloudwatchSOURCE SIGNAL CORRELATEDcloudwatch WriteIOPS alarm batch job windowrds p99 100ms -> 1s N+1 after deployeks pod CrashLoopBack env var missingecs TaskFailedToStart placement constraint sre@prod-bastion ~ $ sherlocks explain rds-writeops-alarm
Investigate incidents across your entire AWS stack
Modern AWS environments generate telemetry from everywhere. CloudWatch metrics. Application logs in Elasticsearch or Loki. Kubernetes events on EKS. RDS query stats. Lambda invocation traces. SQS queue depths. When a real incident happens, the signal is almost always there. Finding it takes forty minutes of correlating dashboards, tabs, and Slack threads.
Sherlocks AI compresses that forty minutes into a few. Sixteen specialized investigation agents read your existing AWS telemetry, correlate signals across services and time, and return a root cause with the evidence attached. The Watson data agent runs inside your VPC with read-only access. Nothing gets modified, nothing gets executed, and no raw application data ever leaves your AWS account.
Supported AWS services
(08 Categories)Sherlocks AI integrates natively with the AWS services your production stack actually runs on.
EC2 instance metrics, resource utilization, and state changes.
RDS query performance, connection pools, replication lag, and slow query patterns across MySQL, PostgreSQL, and other engines.
Lambda invocation metrics, error rates, cold start patterns, and function-level tracing.
S3 request metrics, error rates, latency, and access patterns.
CloudWatch metrics, logs, and alarms across your entire AWS footprint.
ECS task health, service metrics, and deployment tracking. EKS support through the full Kubernetes integration (pods, deployments, services, events, resource metrics).
Amazon SQS queue depth, message age, and DLQ stats.
AWS Bedrock as a private LLM deployment option, keeping all AI reasoning within your AWS account.
How Sherlocks AI works on AWS
(04 Steps)- 1Step 1: Deploy Watson to your EKS cluster.
Install via Helm. Most teams finish setup in under thirty minutes. Watson runs as read-only pods inside your existing Kubernetes environment. No new infrastructure to provision.
- 2Step 2: Grant read-only IAM roles.
Create an IAM role your EKS cluster can assume through IRSA and attach the AWS managed ReadOnlyAccess policy. That gives Watson read access to CloudWatch metrics, RDS metadata, Lambda invocation stats, and the other AWS APIs Sherlocks AI integrates with. Cannot modify infrastructure. Cannot execute commands. Cannot access secrets.
- 3Step 3: Connect your existing tools.
Slack for incident channels. Datadog, New Relic, or Prometheus if you use them. GitHub or Jenkins for deployment correlation.
- 4Step 4: First investigation in Slack.
Tag Sherlocks AI in any incident channel or ask it directly. Most teams see their first AI-led investigation within an hour of finishing setup.
Deployment options for AWS
(02 Options)Two ways to run Sherlocks AI on AWS. Pick based on your security posture and compliance requirements.
SaaS
Fastest to startThe agents run in the Sherlocks AI cloud. Watson runs inside your VPC and is the only component that touches your systems.
On-premise
Strict residencyEverything runs inside your VPC, the model included. A deployment choice, not a reduced version of the product.
- Read-only. No write, delete or modify permission is requested anywhere.
- No business data. No table rows, message contents, customer PII or secrets.
- Encrypted. TLS 1.3 in transit, AES-256 at rest, keys separated per customer.
- SOC 2 Type 2. Report available on request.
Security and compliance
Enterprise AWS buyers care about specific things. Sherlocks AI answers each of them directly.
Watson cannot modify infrastructure, databases, or application state. Cannot execute commands or deploy changes. Cannot access secrets or credentials. Even if compromised, Watson cannot modify your systems or exfiltrate application data.
Sherlocks AI collects metadata and metrics. Database connection counts, query execution times, replication lag, error rates. Never table data, message contents, customer PII, API keys, or source code.
Sherlocks AI cloud environment is annually audited against the SOC 2 Type 2 framework.
TLS 1.3 in transit. AES-256 at rest. Separate encryption keys per customer with enforced rotation.
The On-premise option runs with no external dependencies. Compatible with AWS GovCloud environments and other regulated deployments.
With the On-premise option, no telemetry data ever leaves your AWS account.
Telemetry metadata is retained for 90 days by default, configurable to match your policies.
Real AWS scenarios where Sherlocks AI helps
(05 Scenarios)An RDS query that ran in 100ms yesterday now takes 1 second. Sherlocks AI correlates the latency spike with the recent EKS deployment, identifies an N+1 query pattern introduced in a specific commit, and points to the exact code change. MTTR from hours to minutes.
Worked example: OOMKilled: Unbounded KYC Query (22M Rows)Some services deployed successfully, others failed silently. Sherlocks AI correlates CI/CD pipeline failures with missing services in EKS, identifies the failed build step, and links directly to the problematic commit.
Worked example: ECS Task Placement Failure During AZ RebalanceA pod restarts repeatedly. Sherlocks AI analyzes pod logs, identifies a missing environment variable introduced in the latest deployment, and provides the exact fix.
Worked example: CreateContainerConfigErrorDatabase connection pool saturated, queries timing out. Sherlocks AI detects the saturation, identifies a long-running query holding connections, and correlates with the recent code change that introduced it.
Worked example: DB Connection Pool ExhaustionQueue backlog growing, message processing falling behind. Sherlocks AI identifies that a consumer pod is crash-looping due to OOM, correlates with a recent traffic spike, and suggests scaling.
Worked example: Kafka Consumer LagAWS incidents, worked end to end
(03 Published)Each of these is a real investigation with the evidence trail attached, including the hypotheses that were ruled out along the way.
RDS WriteIOPS alarm: a false alarm from a daily batch job, not an incident
Short-lived write spike from upstream application caused a WriteIOPS alarm. Investigation confirmed no customer impact: transient burst from a batch job.
Postgres replica EBS throughput throttle: how a write burst became a VolumeIOPSExceeded alarm
gp3 data volume hit transient storage throttling after write throughput exceeded provisioned 750 MB/s (peaked 862.8 MB/s). Queue depth rose from ~11 to 17.89 and read latency doubled to 1,042 ms. Average IOPS stayed at 21% of provisioned 30,000, ruling out IOPS exhaustion.
ElastiCache HPA Connection Burst: transient Redis connection fan-out
HPA-driven pod churn on eaze-channels pushed CurrConnections from ~280 to 1,788 on Redis for one 5-minute bucket. Cache health stayed normal; transient connection fan-out from scaling, not a deploy or resource saturation.
The full examples section has 20 investigations across AWS, Kubernetes, databases and Linux VMs. The AWS RCA guides cover the failure classes behind them.
Frequently asked questions
(08 Questions)Does Sherlocks AI work with EKS?
Yes. Watson agent deploys via Helm directly into your EKS cluster. Sherlocks AI reads pod status, deployment events, service dependencies, and resource metrics across your EKS environment. EKS is one of the most common deployment targets for Sherlocks AI customers running on AWS.
How does the Watson agent authenticate to AWS?
Watson uses an IAM role that your EKS cluster assumes through IAM Roles for Service Accounts (IRSA), with the AWS managed ReadOnlyAccess policy attached. No access keys are stored in the cluster. The role can read CloudWatch, RDS metadata, Lambda invocation stats, and the other AWS APIs Sherlocks AI integrates with, and nothing else.
What IAM permissions does Sherlocks AI need?
The AWS managed ReadOnlyAccess policy on a dedicated role. That covers CloudWatch metrics and logs, RDS metadata (INFORMATION_SCHEMA and metadata queries only, no application data), Lambda invocation stats, EC2 metadata, S3 request metrics, ECS task health, and SQS queue attributes. Sherlocks AI never requests write, modify, or execute permissions on any AWS service.
Can I deploy Sherlocks AI in AWS GovCloud or air-gapped environments?
Yes. The On-premise option supports AWS GovCloud and other air-gapped environments. All Sherlocks AI components, the model included, run inside your AWS account with no external dependencies. Best suited for regulated industries requiring complete data isolation.
Does Sherlocks AI work with AWS Bedrock as the LLM?
Yes. AWS Bedrock is one of the supported private LLM deployment options. When you use Bedrock, LLM reasoning runs fully managed inside your AWS account, keeping all AI inference within your cloud environment.
Is any data transmitted outside my AWS account?
Depends on the option. On-premise, nothing leaves your AWS account: agents, knowledge graph, model inference and Watson all run inside your network. SaaS, only encrypted metadata and metrics are transmitted to Sherlocks AI cloud, with PII redacted by Watson before it leaves, never raw application data.
Does Sherlocks AI integrate with CloudWatch alarms?
Yes. Sherlocks AI reads CloudWatch metrics, logs, and alarms as part of its investigation. When a CloudWatch alarm fires and creates an incident channel in Slack, Sherlocks AI begins investigating automatically.
Can Sherlocks AI read from RDS without accessing application data?
Yes. RDS integration uses read-only access to INFORMATION_SCHEMA and metadata queries only. Sherlocks AI reads query performance stats, replication status, connection pool metrics, and slow query patterns. Never table contents, PII, or application records.
Get started with Sherlocks AI on AWS
Try Sherlocks AI free with 30 investigations per month, no credit card required. Most teams have Watson running on EKS in under thirty minutes.
The docs cover the Helm install and the IAM policy in full.