I kept running into the same problem with AWS. The alert usually isn’t the hard part. The investigation is.
An IAM policy changes, a security group gets opened, or a role suddenly has permissions it didn’t have before. AWS gives you the event, but then you still need to figure out the story behind it. You check CloudTrail to see who made the change, IAM to understand the permissions, Terraform to see what should have been there, and GitHub to check whether it came from a normal deployment.
That context switching is what started bothering me. One change can be simple, but understanding whether it was expected, risky, or just part of a deployment can take much longer than the alert itself.
That’s one of the problems I started working on with Kultarr. The idea is to bring that context together: who made the change, what changed, what existed before, what was affected, and whether there’s related Terraform or GitHub activity.
I’m still working through a lot of the IAM edge cases, especially around understanding effective access without making assumptions.
For people working with AWS: when you investigate an unexpected change, which part usually takes you the most time?
Top comments (0)