Every Alarm Is a Crime Scene: Meet Poirot, the Read-Only Incident Detective

Short summary

Poirot is a headless Claude Code agent that investigates CloudWatch alarms under read-only IAM permissions, generates root-cause reports, and automates the first 30 minutes of incident response. Security is enforced by explicit IAM denies—the model cannot exfiltrate secrets even if prompt-injected by log content. Built with TypeScript CDK for deployment on shared AWS compute, eliminating on-call drudgery without replacing the engineer.

• •Headless Claude Code agent auto-triggered by CloudWatch alarms, investigates under read-only IAM role
• •Security model uses explicit deny policies to prevent prompt injection and data exfiltration from untrusted logs
• •Generates structured incident reports with root cause, evidence, blast radius, and next steps

Generated with AI, which can make mistakes.