AWS Ops

Point-in-time snapshot exporter and interactive architecture navigator for AWS infrastructure.

aws-ops/
  export-infra-snapshot.sh     # full snapshot export orchestrator
  derive-topology.sh           # rebuild derived/ files from existing raw/ data
  export-scripts/              # per-resource export modules
    _common.sh                 # shared boilerplate (sourced by every module)
    export-ecs.sh              # ECS clusters, services, tasks
    export-eks.sh              # EKS clusters, node groups, Fargate profiles
    export-ecr.sh              # ECR repositories and images
    export-elb.sh              # ALB/NLB, ACM, WAFv2, CloudFront
    export-vpc.sh              # VPC, subnets, SGs, TGW, Direct Connect
    export-databases.sh        # RDS, Redshift, DocumentDB, DynamoDB
    export-storage.sh          # EFS, S3
    export-cache.sh            # ElastiCache, MemoryDB, OpenSearch
    export-route53.sh          # Route53 zones/records + Route53 Resolver
    export-iam.sh              # IAM roles, users, groups, policies
    export-lambda.sh           # Lambda, API Gateway, Cognito
    export-observability.sh    # CloudWatch logs, alarms, dashboards
    export-secrets.sh          # Secrets Manager, SSM Parameters
    export-messaging.sh        # SQS, SNS, EventBridge, Step Functions, MSK, Kinesis
    export-cicd.sh             # CodeBuild, CodePipeline, CodeDeploy, CodeStar
    export-security.sh         # KMS, CloudTrail, GuardDuty, Organizations
    export-cloudmap.sh         # Cloud Map / Service Discovery
    export-autoscaling.sh      # Auto Scaling groups and launch templates
    export-inventory.sh        # Resource Explorer, tagging API
  snapshots/
    latest.json                # points to the active snapshot folder (gitignored locally)
    2020-06-03T10-00-00Z-us-east-2/   # demo snapshot — included in repo
    2020-06-02T08-00-00Z-us-east-2/   # older demo snapshot — for diff testing
  navigator/                   # React/Vite architecture navigator app

Real snapshots generated by the export script are excluded from the repo via .gitignore. The two demo snapshots are committed so the navigator works immediately after cloning. latest.json is committed pointing at the demo snapshot. When you run a real export, the script overwrites latest.json locally — run the command below once after cloning so that change never shows up in git status:

git update-index --skip-worktree snapshots/latest.json

• AWS CLI v2
• jq
• python3
• Read-only AWS credentials for the target account

# Export a single region
./export-infra-snapshot.sh --region eu-west-1 --profile prod

# Export all opted-in regions (global services captured once in the first region)
./export-infra-snapshot.sh --all-regions --profile prod

# Also export Secrets Manager and SSM Parameter values (sensitive — off by default)
./export-infra-snapshot.sh --region eu-west-1 --profile prod --with-secret-values

The script writes a timestamped snapshot folder under snapshots/ and updates latest.json to point at it. Progress is printed to stderr with timestamps.

Each resource class has its own standalone script in export-scripts/. Run one to refresh just that class inside an existing snapshot folder without re-running the full export:

# Re-export only ECS data into the demo snapshot
OUT_DIR=snapshots/2020-06-03T10-00-00Z-us-east-2 \
  ./export-scripts/export-ecs.sh --region us-east-2

# Re-export only databases
OUT_DIR=snapshots/2020-06-03T10-00-00Z-us-east-2 \
  ./export-scripts/export-databases.sh --region us-east-2

# Re-export EKS clusters (common after adding a new cluster)
OUT_DIR=snapshots/2020-06-03T10-00-00Z-us-east-2 \
  ./export-scripts/export-eks.sh --region us-east-2 --profile prod

After any incremental re-export, rebuild the derived topology files:

OUT_DIR=snapshots/2020-06-03T10-00-00Z-us-east-2 ./derive-topology.sh

Scripts that capture global services (IAM, Route53, S3, CloudFront, Organizations) accept --skip-globals — the main orchestrator passes this automatically when running --all-regions so those services are only captured once.

The scripts capture metadata only — no secret values by default. Coverage:

Compute & containers: ECS (clusters, services, tasks, task definitions, container instances), EKS (clusters, node groups, Fargate profiles), EC2 instances (ECS-tagged), Lambda, ECR

Networking: VPC, subnets, route tables, security groups, NACLs, internet/egress-only gateways, NAT gateways, VPC endpoints, transit gateways, VPN, Direct Connect, peering, Elastic IPs, Route53 (zones, records, health checks, traffic policies), Route53 Resolver, Cloud Map

Load balancing & edge: ALB/NLB (listeners, rules, target health, attributes), API Gateway (REST v1 + HTTP/WebSocket v2), CloudFront (distributions + configs), WAFv2 (regional + CloudFront-scoped), ACM certificates, Shield

Data: RDS instances and clusters (Aurora + standard), RDS Proxy, Redshift (provisioned

• Serverless), DocumentDB, DynamoDB, ElastiCache, MemoryDB, EFS, S3, OpenSearch

Messaging: SQS, SNS, EventBridge (buses, rules, targets, Scheduler), Kinesis, Firehose, MSK, Amazon MQ, Step Functions

IAM & security: IAM (roles, users, groups, local policies, instance profiles, OIDC providers), KMS, Secrets Manager, SSM Parameters, CloudTrail, GuardDuty, Security Hub, AWS Config, Access Analyzer, Organizations/SCPs, Cognito

CI/CD: CodeBuild, CodePipeline, CodeDeploy, CodeStar Connections

Observability: CloudWatch (alarms, dashboards, anomaly detectors), CloudWatch Logs

Inventory: Resource Explorer, Resource Groups Tagging API

snapshots/
  latest.json                              ← points to the most recent snapshot folder
  2020-06-03T10-00-00Z-us-east-2/          ← example: demo snapshot
    manifest.json                          ← region, timestamp, profile, flags used
    raw/                                   ← AWS API responses (JSON + NDJSON files)
    derived/
      summary.json                         ← resource counts across all categories
      README.md                            ← human-readable count summary
      service_topology.json                ← ECS services: containers, EFS, Cloud Map, subnets
      alb_to_service.json                  ← ALB → target group → ECS service (pre-joined)
      sg_connectivity.json                 ← SG-to-SG inbound edge graph
      sg_members.json                      ← SG → member resources (inverse map)
      subnet_classification.json           ← public/private classification per subnet
      nat_gateway_eips.json                ← NAT gateway → Elastic IP details
      vpc_endpoint_routes.json             ← VPC endpoint → subnets routed through it
      iam_role_resource_access.json        ← role → service_access map (from policy analysis)
      iam_role_trust_analysis.json         ← role → trusted services / accounts / roles
      cloudwatch_alarm_targets.json        ← alarm → monitored resource + SNS actions
      kms_usage.json                       ← KMS key → encrypted resources
      secret_consumers.json                ← secret ARN → ECS task definitions that use it
      param_consumers.json                 ← SSM parameter → ECS task definitions that use it
      pipeline_chains.json                 ← CodePipeline source→build→deploy chain
      dynamodb_stream_consumers.json       ← DynamoDB stream → Lambda consumers
      apigw_auth_chain.json                ← API Gateway authorizer → Cognito pool
      sqs_dlq_chains.json                  ← SQS queue → dead-letter queue
      task_eni_map.json                    ← running ECS task → ENI → IP/subnet/SGs
      stepfunctions_resource_refs.json     ← Step Functions state machine → resource refs
      codebuild_role_access.json           ← CodeBuild project → service role access
      ec2_instance_roles.json              ← EC2 ECS instance → IAM roles

If you need to re-run topology derivation against existing raw data (e.g., after a code fix) without re-running the full AWS export:

OUT_DIR=snapshots/2020-06-03T10-00-00Z-us-east-2 ./derive-topology.sh

All API calls are read-only (list-*, describe-*, get-*). A read-only IAM policy is sufficient. --with-secret-values additionally requires secretsmanager:GetSecretValue and ssm:GetParameter.

The navigator is a React application in the navigator/ subdirectory. See navigator/README.md for full usage.

cd navigator
npm install
npm run dev          # http://localhost:5173

The dev server automatically serves the parent snapshots/ directory. The two demo snapshots are included in the repo — the navigator loads 2020-06-03T10-00-00Z-us-east-2 by default and works immediately after cloning with no export step needed.

• Empty canvas, intent-driven: start blank, search for any resource by name or ID to pin it on canvas, then expand its connections to explore the surrounding architecture
• 20+ node types: ECS, EKS, Lambda, ALB, CloudFront, RDS, DynamoDB, SQS, IAM, KMS, ECR, Step Functions, EventBridge, VPC, subnet, and more — all colour-coded by category
• 9 edge types: Deployment, Data Flow, Network, IAM, Observability, Auth, Encryption, DNS, Logging — toggle any combination simultaneously
• Snapshot diff: select a second snapshot to compare; the canvas shows only added and modified resources with visual badges
• AI handoff: every node produces a structured copy-paste brief with all AWS identifiers an AI agent needs to generate correct CLI commands

• Snapshots are static and point-in-time — they do not reflect live AWS state.
• --with-secret-values exports sensitive data; handle the output with care.
• The navigator never makes live AWS API calls.
• See the repository layout section above for the git update-index --skip-worktree note on latest.json.