ConvOps
ConvOps
Documentation
What ConvOps monitors, how investigation works, and exactly what gets deployed in your AWS account.
ConvOps
ConvOps
What ConvOps monitors, how investigation works, and exactly what gets deployed in your AWS account.
ConvOps connects to your AWS account via a read-only IAM role and monitors CloudWatch Alarms in real time — across CPU, memory, error rate, latency, and any custom metric you've configured.
Threshold alarms on EC2, ECS tasks, RDS, Lambda concurrency.
Container-level and instance-level memory alarms.
5xx rates, Lambda errors, application error metrics.
API Gateway response times, Lambda duration, ALB target response time.
Any CloudWatch alarm you've created — ConvOps handles it automatically.
Choose one or both. Alerts land wherever your team already is — no new tools.
Reply 4 to any alert to trigger a deep investigation. ConvOps pulls data from multiple AWS sources simultaneously, correlates everything, and delivers an AI root cause analysis — within seconds, without opening AWS console.
End-to-end: from CloudWatch alarm to resolved incident.
ConvOps deploys a single CloudFormation stack into your AWS account. Here is exactly what it creates — no surprises.
ConvOpsAccessRole009001720832 — only ConvOps can assume this role.arn:aws:iam::aws:policy/ReadOnlyAccess — AWS-managed read-only access to all services. ConvOps can read metrics, logs, and resource state but cannot modify anything.✅ What you get: Real-time alerts + AI root cause analysis + full investigation. No write permissions.
On Pro/Enterprise plans, you select which resources ConvOps can act on during onboarding. We generate a custom IAM policy scoped to only those resources. You review and approve before deployment.
How it works:
Sample policy (EC2, ECS, RDS, Redis selected):
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ConvOpsEC2Actions",
"Effect": "Allow",
"Action": ["ec2:RebootInstances", "ec2:StopInstances", "ec2:StartInstances"],
"Resource": "arn:aws:ec2:*:*:instance/*"
},
{
"Sid": "ConvOpsECSActions",
"Effect": "Allow",
"Action": ["ecs:UpdateService", "ecs:DescribeServices"],
"Resource": ["arn:aws:ecs:*:*:service/*/*", "arn:aws:ecs:*:*:task-definition/*"]
},
{
"Sid": "ConvOpsRDSActions",
"Effect": "Allow",
"Action": ["rds:RebootDBInstance", "rds:ModifyDBInstance"],
"Resource": "arn:aws:rds:*:*:db:*"
},
{
"Sid": "ConvOpsElastiCacheActions",
"Effect": "Allow",
"Action": ["elasticache:RebootCacheCluster", "elasticache:ModifyCacheCluster"],
"Resource": "arn:aws:elasticache:*:*:cluster:*"
}
]
}Tag-based scoping (optional):
{
"Sid": "ConvOpsECSActionsProductionOnly",
"Effect": "Allow",
"Action": ["ecs:UpdateService"],
"Resource": "arn:aws:ecs:*:*:service/*/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/Environment": "production"
}
}
}↑ This limits ConvOps to only act on ECS services tagged Environment=production.
ConvOpsAlertTopichttps://ewvdzp6c79.execute-api.eu-central-1.amazonaws.com/prod/ingest{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::009001720832:root"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "<your-unique-registration-token>"
}
}
}
]
}ConvOps has cross-account access to your AWS environment. Here's exactly what that means — no vague claims.
ConvOps never stores your AWS credentials. Access works via STS AssumeRole — short-lived tokens with a 15-minute TTL. Tokens expire automatically.
Your IAM role requires a unique ExternalId (generated per customer, stored in Secrets Manager). Prevents confused-deputy attacks — nobody else can assume your role.
The ReadOnlyAccess managed policy covers all reads. Write actions (ecs:UpdateService, ec2:RebootInstances, rds:RebootDBInstance) require your explicit confirmation for every individual action.
Only the person who received the alert on their registered number/Slack account can confirm actions. Confirmation expires after 5 minutes.
Every investigation and action is logged: timestamp, resource ARN, who approved, outcome. Exportable on request. 90-day retention.
We store only operational metadata: alarm events, conversation state. Never raw application logs, log content, secrets, or business data.
All ConvOps infrastructure runs in eu-central-1 (Frankfurt). Data does not leave the EU. GDPR compliant — see convops.io/privacy.
Delete the ConvOpsAccessRole from your AWS console. ConvOps loses all access immediately — no support ticket, no waiting period.
When you confirm an action (reply 1 + YES), ConvOps can execute the following remediation actions on your behalf. Every action requires two-step confirmation and is logged.
Adjust ConvOps behaviour per workspace from the app dashboard.
Connect your AWS account in 2 minutes. Free plan includes alerts + full AI investigation. No credit card.
Get Started — Free →or email info@convops.io with questions