Forem: Hafiz Syed Ashir Hassan

Automating CloudWatch Log Analysis with Amazon Strands Agent: Meet the CloudWatch Analyzer

Hafiz Syed Ashir Hassan — Sat, 14 Jun 2025 18:24:54 +0000

📈 The Problem: The Developer Time Drain

Ever wonder how much time do we developers spend debugging, monitoring, and resolving issues, time that could be better spent building?

Developers spend a significant amount of time, ranging from 20% to 75%, on debugging, monitoring, and resolving issues. This includes time spent identifying, understanding, and fixing bugs in code, as well as monitoring application performance and troubleshooting issues.

Debugging: This is a core part of a developer's work, involving finding and fixing errors in code. Studies suggest that developers can spend anywhere from 20% to 75% of their time on debugging.
Monitoring: This involves tracking application performance and behaviour to identify potential issues before they impact users. Monitoring tools and techniques help developers proactively address problems.
Resolving Issues: This encompasses the entire process of addressing bugs, performance issues, and other problems that arise in software. This can include debugging, but also involves communication, collaboration, and potentially working with other teams to resolve complex issues.

🤖 What is Amazon Strands Agent?

Open‑source, model‑first agent framework created by AWS; lives on GitHub and is installable via pip.
Lets you define an agent with three artefacts only: a prompt, a model provider (Bedrock, Anthropic, Ollama, etc.), and a list of tools.
Ships with a deployment toolkit for Lambda, Fargate, containers, or local dev.
Key design goals: minimal boilerplate, production‑ready, pluggable LLMs, clear separation of planning vs. execution.

Strands Agents SDK in 60 seconds

pip install strands-agents-sdk-python gets you started.
Create an agent in ~10 lines of code: import SDK → write prompt → register tools → run.
Out‑of‑the‑box adapters for Bedrock models, Anthropic Claude, Meta Llama, and more.

👨‍💻 Agents for Amazon Bedrock vs. Strands Agents: Key Differences

🖥️ Introducing the CloudWatch Analyzer

A tool build using Amazon Strands Agent, using Amazon Nova model which can be changed as well that fetch, analyze and provide solutions for the issues found in CloudWatch. A easy to use tool that will monitor the logs, debug and provide solutions.

💡 Key Features

Log Source Selection: Pick all or any CloudWatch Log Group.
Time Window: Specify how many hours back to check for the logs.
AI‑Powered Analysis: Strands Agent summarises logs & pin-points root cause.
Resolution Suggestions: Returns fixes with code snippets where applicable.
Knowledge‑Base Add‑on: Optionally hook in internal docs for context aware solutions.

📐 Architecture Walk‑through

1- User selects logs group + time range using UI.
2- Logs are fetched using Boto3 or AWS SDK using tools provided.
3- Amazon Strands Agent processes logs.

4- Agent returns:

Summary
Error insight
Recommended fix

5- (Optional) Knowledge Base is queried for tailored help.

Video Link:

Click here to watch Amazon Cloudwatch Analyzer Walkthrough

❓ Why Strands Agent Was the Perfect Fit

Local prototyping: Iterate without redeploying to the console.
Tool abstraction layer: Let you bolt on the Knowledge Base search later without rewriting prompts.
Multi‑model freedom: You benchmarked Claude‑3, Titan‑Text, and Gemini side‑by‑side.

🛠️ Tech Stack

Python
Boto3 for CloudWatch log access
Amazon Bedrock Strands Agent
Amazon Knowledge Base
Streamlit for UI

⚙️ Code Highlights

Create Agent:

    agent = Agent(
        model=model,
        tools=tools,
        system_prompt=get_system_prompt(use_knowledge_base)
    )

Fetch Logs:

response = self.client.describe_log_streams(
                logGroupName=log_group_name,
                limit=1
            )

Display Result:

prompt = f"""
            Get logs from the CloudWatch log group '{log_group}' for the past {hours} hours
            {f"with filter pattern '{filter_pattern}'" if filter_pattern else ""}.

            Then analyze these logs to identify errors and issues.

            For each identified issue:
            1. Provide a clear description of the problem
            2. Assess the severity (Critical, High, Medium, Low)
            3. Recommend solutions to fix the issue
            {"4. Reference relevant knowledge base articles if available" if use_kb else ""}

            Organize your response in a clear, structured format.
            """

response = agent(prompt)
print(response)

🚀 Github Link:

https://github.com/ashirsyed/cloudwatch-logs-analyzer/

🧠 Resources:

https://github.com/strands-agents
https://strandsagents.com/latest/
https://aws.amazon.com/blogs/opensource/introducing-strands-agents-an-open-source-ai-agents-sdk/

🙌 Impact & Use Cases

Save developers' time
Faster incident resolutions
Onboarding support: New devs get guided suggestions
Can be plugged into existing dashboards or tools (Slack, Teams)
Reduced Mean‑Time‑To‑Resolution by 40%

🔚 Conclusion

Wrap up by encouraging other builders to try the Strands Agent and explore how AI can assist developers.

Prompt Engineering with Generative AI

Hafiz Syed Ashir Hassan — Sun, 15 Sep 2024 16:51:25 +0000

See any GenAI model as a genius boy who is dump to answer. He has all the knowledge but don't know what and how to answer. The tool to fetch your answer in most accurate and well structured way is called Prompt Engineering.

Here I will mention 3 techniques for well prompt engineering.

Clear Prompting:
We have a lot in our head which we don't say because it is 'common sense.' As a wise man said: "common sense is not common", thus we need to be clear, direct, well structured and well explained while giving prompts.
The below example shows that when we ask a question, it may get confuse or give details that is more needed. But when we are direct, it give is a better answer.

Indirect Prompt:

Direct Prompt:

Ask to think Step-By-Step:
This method, also referred to as chain of thought (CoT) prompting, can greatly enhance the accuracy and depth of a model.

Now ask to think step by step:

Reduce Hallucination:
To reduce hallucination, can follow the steps:

Ask the model to answer only if it is confident and sure about the response.
Give the model space to think before responding by encouraging step-by-step reasoning.
Ask the model so say "I don't know the answer" if it is not sure or don't have the answer.

From Raw to Refined: Using AWS Glue to Curate Data in S3 for Athena Queries

Hafiz Syed Ashir Hassan — Sun, 15 Sep 2024 15:46:32 +0000

Being a data engineer is fun in own ways. Thinking of a different, easiest and optimised way to solve a problem is 90% of the effort. Few years back, when I and AWS Glue was young, created a whole ETL pipeline where a single trigger (manual or automatic) can fetch the data, curate and ready to use in just few minutes.

Lets start from the Architecture:

Invoke can be manual or automatic schedule which executes a Glue Job named: Driver. The main responsibility of it to see if any other job is running and fetch the requirements and configurations and pass to another Glue job called Controller.
Controller is responsible for the whole execution and taking care if the pipeline end successfully or failed and any retry is needed. It also trigger the worker glue jobs when one is finished.
The Amazon RDS keeps all the records for each steps which in short is our logging database. if retry is needed, the latest data is fetch from RDS so know from where the job will start again.
The 1st worker job called Fetch CSV will fetch the data in CSV format from source that can be RDS, S3, Data Streams or any other and store in S3.
The 2nd worker job called 'Convert to Parquet' gets trigger when 1st is completed and fetch the CSV files from S3 and convert to Parquet format so it is lighter and easier to curate and the size is reduced as well.
The 3rd worker 'Curate Data' is executed after 2nd worker job is finished. It fetches the Data from S3 in Parquet format, curate using the Spark Job and store in final S3 bucket.
Meanwhile the Glue Crawlers are used on S3 to fetch the metadata for Athena.
Lastly, Athena is used to view the data from S3.

This is easy to implement and maintain. It can work on structured or unstructured data.

Reduce ETL Time by Converting Sequential Code to Parallel AWS Lambda Execution

Hafiz Syed Ashir Hassan — Sun, 15 Sep 2024 13:29:52 +0000

Few years back, when I was quite fresh in the cloud world, I was given an ETL problem that the current code is written in Java that executes on linux server and the whole ETL time was more than 8 hours minimum. As a cloud enthusiastic, my challenge was to reduce the ETL time.

So, the code as using Google Adwords API to extract the data and store on servers where the data was send to a data warehouse. The whole process used Pentaho tool to perform the ETL.
For quick resolution, I had 2 options: either to use AWS Lambda or AWS Glue. I choose AWS Lambda because the ETL time per Google Adwords account would never exceed 10 min in worst case.

The architecture is below:

The Pentaho tool would invoke the AWS Lambda function named 'data-sync-automate' with accountID as payload.
The function will execute the 10 other AWS Lambdas, each associated with a metrics of Google-Ads, fetch the records and store in S3.
Once fetched, the AWS Lambda function 'data-sync-automate' will send a message in SQS.
Pentaho will fetch the message and download the data from S3 for that particular accountID.

The whole ETL time was reduced from 8 hours to less than 50 minutes.

Below is an example how to fetch Google Adwords Keyword Report:

import os
import boto3
import json
from google.ads.google_ads.client import GoogleAdsClient
from google.ads.google_ads.errors import GoogleAdsException

# Initialize S3 client
s3_client = boto3.client('s3')

def lambda_handler(event, context):
    # Environment variables for configuration
    developer_token = os.environ['GOOGLE_ADS_DEVELOPER_TOKEN']
    client_id = os.environ['GOOGLE_ADS_CLIENT_ID']
    client_secret = os.environ['GOOGLE_ADS_CLIENT_SECRET']
    refresh_token = os.environ['GOOGLE_ADS_REFRESH_TOKEN']
    login_customer_id = os.environ['GOOGLE_ADS_LOGIN_CUSTOMER_ID']
    s3_bucket_name = os.environ['S3_BUCKET_NAME']

    # Initialize Google Ads client
    client = GoogleAdsClient.load_from_dict({
        'developer_token': developer_token,
        'client_id': client_id,
        'client_secret': client_secret,
        'refresh_token': refresh_token,
        'login_customer_id': login_customer_id,
        'use_proto_plus': True
    })

    # Define the customer ID
    customer_id = 'YOUR_CUSTOMER_ID'  # Replace with the correct customer ID

    # Define the Google Ads Query Language (GAQL) query for keywords report
    query = """
        SELECT
          campaign.id,
          ad_group.id,
          ad_group_criterion.keyword.text,
          ad_group_criterion.keyword.match_type,
          metrics.impressions,
          metrics.clicks,
          metrics.cost_micros
        FROM
          keyword_view
        WHERE
          segments.date DURING LAST_30_DAYS
        LIMIT 100
    """

    try:
        # Fetch the keywords report data
        response_data = fetch_keywords_report(client, customer_id, query)

        # Upload the data to S3
        upload_to_s3(s3_bucket_name, 'google_ads_keywords_report.json', json.dumps(response_data))

        return {
            'statusCode': 200,
            'body': json.dumps('Keywords report fetched and stored in S3 successfully!')
        }
    except GoogleAdsException as ex:
        return {
            'statusCode': 500,
            'body': f"An error occurred: {ex}"
        }

def fetch_keywords_report(client, customer_id, query):
    ga_service = client.get_service("GoogleAdsService")
    response = ga_service.search(customer_id=customer_id, query=query)
    results = []

    # Process the response
    for row in response:
        results.append({
            'campaign_id': row.campaign.id,
            'ad_group_id': row.ad_group.id,
            'keyword_text': row.ad_group_criterion.keyword.text,
            'match_type': row.ad_group_criterion.keyword.match_type.name,
            'impressions': row.metrics.impressions,
            'clicks': row.metrics.clicks,
            'cost_micros': row.metrics.cost_micros
        })

    return results

def upload_to_s3(bucket_name, file_name, data):
    s3_client.put_object(
        Bucket=bucket_name,
        Key=file_name,
        Body=data
    )

Amazon Bedrock: Anthropic’s model, Claude 2.1 - The Key Difference

Hafiz Syed Ashir Hassan — Tue, 30 Jan 2024 19:55:00 +0000

Anthropic’s model, Claude 2.1 was introduced in November 2023. It targets the enterprise level applications that can be used commercially.

Key Differences and enhancements:

Supports 200,000 tokens, roughly 150,000 words or around 500 pages of documents where Claude 2.0 supports 100,000 tokens
Helps to summarise, doing Q&A, forecast trends on various factors and did stats and comparison for multiple documents better than before
50% fewer hallucinations
30% reduction in incorrect answers
3–4 times lower rate of mistakes in comparison of the documents
Can integrate different APIs

The model is available in AWS Bedrock in the US East (N. Virginia) and US West (Oregon) Regions.

Making a requests using AWS Bedrock:

import anthropic_bedrock
from anthropic_bedrock import AnthropicBedrock

client = AnthropicBedrock(
    aws_access_key="<aws access key>",
    aws_secret_key="<aws secret key>",
    aws_session_token="<aws_session_token>",
    aws_region="us-east-2",
)

prompt_completion = client.completions.create(
    model="anthropic.claude-v2:1",
    max_tokens_to_sample=256,
    prompt=f"{anthropic_bedrock.HUMAN_PROMPT} Tell me top 10 happenings on 10th January in the history of the world! {anthropic_bedrock.AI_PROMPT}",
)
print(prompt_completion.completion)