omnara-ai/omnara/sre-agent

Deploy the SRE Agent

You are setting up an Omnara agent for the user from agent.yaml in this folder. The goal: an agent profile the user has watched run once, reachable wherever the user wants it.

The steps below are the usual path, with the exact commands. Skip anything that's already done (for example, the secrets and profile exist and the user only wants to add code access), and follow the user's lead if they want a different order.

• Start from agent.yaml as written. If the user wants something different

(the instruction, data sources, model, or how they reach the agent), change it and tell them what you changed.

• If a command fails, npx omnara <command> --help and

docs.omnara.com have the details.

• Stop only where a step says to ask the user. Ask in a sentence or two of

plain language, together with the next step's question if one comes right after, then end your turn and wait for the reply.

• Where a step gives a default, use it without asking and say in a line what

you picked, so the user can change it.

• When a step needs a token, the user can paste it in the chat or add it to a

.env file in the current directory, whichever they prefer; offer both. If they paste it, write it to .env yourself so the commands work as written.

The commands use the Omnara CLI (npx omnara); add --json to read IDs. They're a reference, not a requirement: the Omnara MCP tools, the REST API, and the SDK work too, and the flags map directly to API fields.

1. Connect to Omnara

Run npx omnara whoami. If you aren't logged in, run npx omnara login without piping its output, and keep it running: it waits until the user approves. It opens the approval page in the user's browser and prints the page's link and a code. Show the user both right away, since you may be on a different machine than their browser, and ask them to approve once the code matches. If the request expires, run it again. If login says the account has no organization yet, have the user create one at the link it prints. Then npx omnara whoami should succeed.

Pick the org and project (npx omnara whoami --json lists orgs, npx omnara projects list --org <org-id> --json their projects): use them if there's one of each, otherwise the defaults from npx omnara config or the project named Default; ask only if there's still no clear choice. Save the choice with npx omnara config --org <org-id> --project <project-id>; later steps need the project ID.

2. Describe the system

Ask what product the agent is for (suggest the org name) and whether you may draft the rest from their AWS account with read-only calls. If they agree, work out AWS_REGION and SYSTEM_CONTEXT from aws configure get region, aws ecs list-services, aws lambda list-functions, and similar calls; otherwise ask for the region, the main services, and where logs live.

• COMPANY_NAME: the company or product name, for example Acme.
• AWS_REGION: the region production runs in, for example us-west-2.
• SYSTEM_CONTEXT: what it is, its main services and how they run on AWS

(ECS, Lambda, EKS, EC2), and where logs live, in two to four sentences on a single line, for example Acme is a checkout API for online stores. It runs an API and a worker on ECS Fargate behind an ALB, with RDS Postgres and SQS, primarily on AWS. Logs go to CloudWatch Logs under /ecs/acme-*.

Show SYSTEM_CONTEXT to the user and adjust until they're happy. If they can say more about their logs or metrics (for example, every request writes one structured log line with its errors and database queries), add a short section for each under # Available Data in step 6, like the ## AWS one.

3. Create read-only AWS credentials

The agent reaches AWS through the AWS MCP Server, which signs each call with these credentials, so their IAM policy is what keeps the agent read-only. Use a dedicated IAM user with only the AWS managed policies ViewOnlyAccess and CloudWatchReadOnlyAccess. They cover describing resources, metrics, alarms, and reading logs, but not S3 object contents or secret values.

If a secret named sre-agent-aws already exists (npx omnara secrets list --owner-kind project --owner-project-id <project-id> --name sre-agent-aws --json), reuse it and note its id. Otherwise:

1. Create the IAM user, either way:

• You do it, if the user has the AWS CLI signed in to the production

account with IAM permissions and says go ahead. This writes the keys straight to .env without showing them:

```sh aws iam create-user --user-name omnara-sre-agent aws iam attach-user-policy --user-name omnara-sre-agent \ --policy-arn arn:aws:iam::aws:policy/job-function/ViewOnlyAccess aws iam attach-user-policy --user-name omnara-sre-agent \ --policy-arn arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess aws iam create-access-key --user-name omnara-sre-agent \ --query 'AccessKey.[AccessKeyId,SecretAccessKey]' --output text \

```

• The user does it in the IAM console: Users → Create user →

Attach policies directly (ViewOnlyAccess, CloudWatchReadOnlyAccess), then on the user's Security credentials tab, Create access key. Get the keys from the user as:

``sh AGENT_AWS_ACCESS_KEY_ID=... AGENT_AWS_SECRET_ACCESS_KEY=... ``

1. Create the secret:

``sh set -a && . ./.env && set +a npx omnara secrets create --owner-kind project --owner-project-id <project-id> \ --name sre-agent-aws --material-kind aws_credentials \ --material-access-key-id "$AGENT_AWS_ACCESS_KEY_ID" \ --material-secret-access-key "$AGENT_AWS_SECRET_ACCESS_KEY" --json ``

Note the id (sec_…) as AWS_SECRET_ID. If the user prefers a role, add --material-role-arn (and --material-external-id if the role's trust policy requires one); Omnara assumes it with these keys.

4. Let the agent read the code (optional)

Recommended: with the repository cloned on a machine, the agent can trace an error to the code behind it and cite the exact lines. Ask which repository (GITHUB_REPO, as owner/name). One repository is supported as written.

• Public repository: nothing to store.
• Private repository: the user creates a

fine-grained token with read-only Contents access to that repository and gives it to you as AGENT_GITHUB_TOKEN. Check for an existing secret named sre-agent-github as in step 3, otherwise create it:

``sh set -a && . ./.env && set +a npx omnara secrets create --owner-kind project --owner-project-id <project-id> \ --name sre-agent-github --material-kind generic \ --material-value "$AGENT_GITHUB_TOKEN" --json ``

Note the id as GITHUB_TOKEN_SECRET_ID.

5. Pick the model (and machine pool)

1. npx omnara grant models list --json: each item has model.provider_config

and model.name. Use openai/gpt-6-astra on omnara-openrouter if it's granted (the instruction was tested with it), otherwise the strongest reasoning model on the list. The choice gives MODEL_PROVIDER_CONFIG and MODEL_NAME.

1. Only if the agent reads the code (step 4):

npx omnara grant pools list --json; each grant's machine_pool.name is a candidate MACHINE_POOL. Use default-pool if it's granted: its machines come with git. Otherwise use the only one, or ask if there are several. If there are none, tell the user the project needs a machine pool for code access, and continue without it if they prefer.

6. Create the agent

1. Copy agent.yaml from this folder to ./sre-agent.yaml in the current

directory. If this folder isn't available locally, download https://raw.githubusercontent.com/omnara-ai/omnara/main/examples/sre-agent/agent.yaml instead.

1. Remove what the user isn't using:

• No code access: delete the ## Source Code section of the instruction,

machine_sources, and the tools: block at the end.

• Public repository: delete the secret_env_overlay block.

1. Replace every remaining placeholder:

Then confirm nothing is left: grep -n '{{' sre-agent.yaml must print nothing.

1. Check for an existing profile: npx omnara profiles list --name sre-agent --json.

• None: npx omnara profiles create --name sre-agent --file ./sre-agent.yaml --json
• Exists: npx omnara profiles update <agent-profile-id> --file ./sre-agent.yaml --json

Note the profile's id and current_config_id from the output.

7. Run a first health check

npx omnara agents launch --profile <agent-profile-id> --config <current-config-id> \
  --message "Run a production health check." --json

Give the user the link to watch it work: https://app.omnara.com/projects/<project-id>/agents/<agent-id>. It takes a few minutes, longer with code access while the machine clones the repository. The user can reply in the console with a real question, such as a recent alert or "why was checkout slow yesterday at 3pm?". If the agent reports an AWS call as denied, that's the read-only policy working; only widen it if the user wants that data.

8. Choose where to use it

Right after sharing the link, ask where the user wants to talk to the agent. Wait for the reply; don't assume the console. Any combination works:

• Their own app (recommended): inside their product or internal tool, or a

small UI built for it.

• Slack or Discord: the team mentions the bot, and replies in the thread go

to the same agent. An incidents or alerts channel works well.

• Only the Omnara console: nothing to set up; every agent launched from the

profile shows up there.

Set up whichever the user picks with `integrations.md` (read it from https://raw.githubusercontent.com/omnara-ai/omnara/main/examples/integrations.md if you don't have the repo). For this agent, name the integrations sre-agent-slack and sre-agent-discord, call the bot "SRE Agent", and have the user try it with "@SRE Agent why are checkout requests failing?"

If the user asks for a daily health check, create it with --cron and --timezone for the time they want:

npx omnara crons create --name sre-agent-daily \
  --target-type profile --target-agent-profile-id <agent-profile-id> \
  --cron '0 9 * * 1-5' --timezone America/Los_Angeles \
  --message-template 'Run the daily production health check.' --json

If npx omnara crons list --name sre-agent-daily --json already shows a trigger, change it with npx omnara crons update <cron-trigger-id> (same flags) instead of creating a second one.

Each firing launches a fresh agent from the profile. It shows up in the console, and the user's app can pick it up through Omnara's SDK or API. To post every check in one Slack or Discord thread instead, see "Scheduled runs in a channel" in integrations.md.

9. Wrap up

Summarize what you created: the secrets, the IAM user if you made it, the profile, and any integrations or cron trigger. Remind the user to delete .env or move the keys somewhere safe. Then tell them: