AWS DevOps Agent emits events to the Amazon EventBridge default event bus whenever an investigation lifecycle state changes. This pattern captures 'Investigation Failed' and 'Investigation Timed Out' events using an EventBridge rule.

The EventBridge rule routes matching events to a Lambda durable function that orchestrates the escalation workflow: parsing the DevOps Agent event, creating an incident ticket in DynamoDB, and paging on-call personnel via SNS.

The durable function pauses execution using create_callback(), incurring no compute charges while waiting for human acknowledgment. On-call responders acknowledge by clicking a link in the notification email.

If no acknowledgment is received within a configurable timeout (default 15 minutes), the incident is marked as unacknowledged and the workflow completes.

The incident ticket creation and notification steps are designed as extensible integration points, allowing customers to replace DynamoDB and SNS with external services such as Jira, ServiceNow, PagerDuty, or Opsgenie.