Forem: Praveen HA

Beyond the CLI: Building an Enterprise Terraform Impact Dashboard

Praveen HA — Fri, 15 May 2026 08:03:27 +0000

Stop Reading Raw JSON: Build an Enterprise Terraform Impact Dashboard

As a Lead DevOps Architect, I often deal with infrastructure plans that touch hundreds of resources. Sifting through a standard terraform plan terminal output to find a single critical "delete" is like looking for a needle in a haystack.

When you are managing complex infrastructure—like a technical cutover from Squid Proxy to Google Secure Web Proxy—the cognitive load is high. The risk of missing a "destroy" on a production database is a real threat to stability.

The Problem: The "Wall of Text"

Standard Terraform output is designed for logs, not for human auditing. In an enterprise environment, we face three main challenges:

Risk Blindness: Critical resources (like RDS instances, S3 buckets, or IAM roles) look exactly like a minor tag update in the terminal.
Scale Issues: Large plans (500+ changes) are impossible to review manually without missing something important.
Stakeholder Gap: It is difficult to share a raw CLI output with a manager or security auditor for quick approval.

The Solution: An Automation-First Dashboard

I developed a Python-based Impact Analyser that transforms a plan.json into a high-fidelity, interactive HTML dashboard. This isn't just a formatter; it’s a risk-assessment engine.

1. The Workflow

The process is simple and integrates directly into any CI/CD pipeline:

Generate the Plan: terraform plan -out=main.tfplan
Convert to JSON: terraform show -json main.tfplan > plan.json
Run the Analyser: python3 tf_impact.py plan.json

2. Enterprise Features

Risk-Level Heuristics: The script automatically flags changes as CRITICAL or HIGH if stateful resources (Databases, Storage, KMS Keys) are marked for deletion or replacement.
Client-Side Filtering: Built with Tailwind CSS and vanilla JavaScript, the dashboard allows you to search 1,000+ resources instantly by address or module path.
Standalone Portability: The output is a single HTML file. No database or server is required, making it perfect for CI/CD artifacts.

The Code: Python Risk Logic

Here is a snippet of how the risk assessment engine identifies dangerous operations before they hit production: we can always modify the risk engine with more critical type resources

class RiskAnalyzer:
    """Identifies dangerous changes based on resource sensitivity"""
    CRITICAL_TYPES = {
        'aws_db_instance', 'google_sql_database_instance',
        'aws_s3_bucket', 'aws_iam_role', 'aws_kms_key'
    }

    @staticmethod
    def assess(resource_type, actions):
        is_delete = 'delete' in actions
        is_replace = 'create' in actions and 'delete' in actions

        if resource_type in RiskAnalyzer.CRITICAL_TYPES:
            return "CRITICAL" if (is_delete or is_replace) else "HIGH"

        if is_delete or is_replace:
            return "HIGH"
        return "LOW"

copy the script below

    #!/usr/bin/env python3
"""
Enterprise Terraform Impact Analyser (v2.0)
High-performance, filter-enabled change detector for large-scale plans.
Provides a dynamic HTML dashboard with client-side filtering.
"""

import json
import argparse
import re
import logging
import sys
from typing import Dict, List, Any, Optional
from collections import defaultdict
from datetime import datetime
from dataclasses import dataclass, asdict

# Configure logging
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(levelname)s - %(message)s',
    stream=sys.stderr
)
logger = logging.getLogger("TF-Impact")

@dataclass
class ResourceChange:
    address: str
    type: str
    name: str
    module: str
    provider: str
    actions: List[str]
    risk_level: str
    change_summary: str

class FilterEngine:
    """Enterprise filtering logic for large-scale infrastructure"""
    def __init__(self, include_types=None, exclude_types=None, 
                 modules=None, providers=None, address_regex=None):
        self.include_types = set(include_types) if include_types else None
        self.exclude_types = set(exclude_types) if exclude_types else None
        self.modules = set(modules) if modules else None
        self.providers = set(providers) if providers else None
        self.address_pattern = re.compile(address_regex) if address_regex else None

    def should_include(self, resource_addr: str, r_type: str, 
                       module: str, provider: str) -> bool:
        if self.include_types and r_type not in self.include_types: return False
        if self.exclude_types and r_type in self.exclude_types: return False
        if self.modules and not any(module.startswith(m) for m in self.modules): return False
        if self.providers and provider not in self.providers: return False
        if self.address_pattern and not self.address_pattern.search(resource_addr): return False
        return True

class RiskAnalyzer:
    """Identifies dangerous changes based on resource sensitivity"""
    CRITICAL_TYPES = {
        'aws_db_instance', 'aws_rds_cluster', 'google_sql_database_instance',
        'azurerm_postgresql_server', 'aws_s3_bucket', 'google_storage_bucket',
        'aws_iam_role', 'aws_kms_key', 'kubernetes_namespace', 'aws_route53_zone'
    }

    @staticmethod
    def assess(resource_type: str, actions: List[str]) -> str:
        is_delete = 'delete' in actions
        is_replace = 'create' in actions and 'delete' in actions

        if resource_type in RiskAnalyzer.CRITICAL_TYPES:
            return "CRITICAL" if (is_delete or is_replace) else "HIGH"

        if is_delete or is_replace:
            return "HIGH"
        if 'update' in actions:
            return "MEDIUM"
        return "LOW"

class EnterpriseTFDetector:
    def __init__(self, plan_file: str, filter_engine: FilterEngine):
        self.plan_file = plan_file
        self.filter_engine = filter_engine
        self.risk_analyzer = RiskAnalyzer()
        self.data = self._load_plan(plan_file)

    def _load_plan(self, filepath: str) -> Dict:
        try:
            with open(filepath, 'r') as f:
                return json.load(f)
        except Exception as e:
            logger.error(f"Failed to load plan file: {e}")
            sys.exit(1)

    def _detect_provider(self, resource_type: str) -> str:
        parts = resource_type.split('_', 1)
        return parts[0] if len(parts) > 1 else 'other'

    def analyze(self) -> Dict[str, Any]:
        logger.info(f"Analyzing {self.plan_file}...")

        results = {
            'metadata': {
                'timestamp': datetime.now().isoformat(),
                'tf_version': self.data.get('terraform_version', 'Unknown'),
                'plan_id': self.data.get('format_version', 'N/A')
            },
            'changes': [],
            'stats': defaultdict(int),
            'risk_summary': defaultdict(int),
            'by_module': defaultdict(lambda: defaultdict(int))
        }

        resource_changes = self.data.get('resource_changes', [])

        for change in resource_changes:
            addr = change.get('address')
            r_type = change.get('type')
            module = change.get('module_address', 'root')
            provider = self._detect_provider(r_type)
            actions = change.get('change', {}).get('actions', [])

            if 'no-op' in actions or not actions or actions == ['read']:
                continue

            if not self.filter_engine.should_include(addr, r_type, module, provider):
                continue

            risk = self.risk_analyzer.assess(r_type, actions)
            primary_action = "replace" if ('create' in actions and 'delete' in actions) else actions[0]

            res_obj = ResourceChange(
                address=addr,
                type=r_type,
                name=change.get('name'),
                module=module,
                provider=provider,
                actions=actions,
                risk_level=risk,
                change_summary=" -> ".join(actions)
            )

            results['changes'].append(asdict(res_obj))
            results['stats'][primary_action] += 1
            results['risk_summary'][risk] += 1
            results['by_module'][module][primary_action] += 1

        return results

class EnterpriseVisualizer:
    def __init__(self, analysis_results: Dict):
        self.results = analysis_results

    def generate_html(self, output_file: str):
        """Generates a standalone HTML dashboard with client-side filtering"""
        json_data = json.dumps(self.results)

        html_template = f"""
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>TF Impact Dashboard</title>
    <script src="https://cdn.tailwindcss.com"></script>
    <style>
        .risk-CRITICAL {{ border-left: 5px solid #ef4444; background: rgba(239, 68, 68, 0.05); }}
        .risk-HIGH {{ border-left: 5px solid #f97316; background: rgba(249, 115, 22, 0.05); }}
        .risk-MEDIUM {{ border-left: 5px solid #f59e0b; }}
        .risk-LOW {{ border-left: 5px solid #10b981; }}
    </style>
</head>
<body class="bg-slate-900 text-slate-100 min-h-screen pb-20">
    <div class="max-w-7xl mx-auto px-6 py-10">
        <header class="flex justify-between items-center mb-10 border-b border-slate-700 pb-8">
            <div>
                <h1 class="text-4xl font-extrabold text-white tracking-tight">Terraform Impact Dashboard</h1>
                <p class="text-slate-400 mt-2 font-medium">Enterprise Infrastructure Change Analysis</p>
            </div>
            <div class="text-right">
                <div class="text-xs uppercase tracking-widest text-slate-500 font-bold">Report Generated</div>
                <div class="text-slate-300 font-mono">{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}</div>
            </div>
        </header>

        <div class="grid grid-cols-2 md:grid-cols-4 gap-6 mb-10">
            <div class="bg-slate-800 p-6 rounded-2xl border border-slate-700 shadow-lg">
                <div class="text-slate-500 text-xs font-bold uppercase mb-1">Create</div>
                <div class="text-3xl font-bold text-emerald-500">{self.results['stats']['create']}</div>
            </div>
            <div class="bg-slate-800 p-6 rounded-2xl border border-slate-700 shadow-lg">
                <div class="text-slate-500 text-xs font-bold uppercase mb-1">Update</div>
                <div class="text-3xl font-bold text-amber-500">{self.results['stats']['update']}</div>
            </div>
            <div class="bg-slate-800 p-6 rounded-2xl border border-slate-700 shadow-lg">
                <div class="text-slate-500 text-xs font-bold uppercase mb-1">Replace</div>
                <div class="text-3xl font-bold text-violet-500">{self.results['stats']['replace']}</div>
            </div>
            <div class="bg-slate-800 p-6 rounded-2xl border border-slate-700 shadow-lg">
                <div class="text-slate-500 text-xs font-bold uppercase mb-1">Delete</div>
                <div class="text-3xl font-bold text-red-500">{self.results['stats']['delete']}</div>
            </div>
        </div>

        <div class="bg-slate-800 p-8 rounded-2xl mb-10 border border-slate-700 shadow-2xl">
            <h3 class="text-sm font-bold text-slate-400 uppercase tracking-widest mb-6">Interactive Filters</h3>
            <div class="grid grid-cols-1 md:grid-cols-3 gap-8">
                <div class="space-y-2">
                    <label class="text-xs font-bold text-slate-500 uppercase">Search Resources</label>
                    <input type="text" id="searchBox" placeholder="Search address, type, or module..." 
                           class="w-full bg-slate-900 border-slate-700 border rounded-xl p-3 text-sm focus:ring-2 focus:ring-blue-500 outline-none transition-all">
                </div>
                <div class="space-y-2">
                    <label class="text-xs font-bold text-slate-500 uppercase">Risk Threshold</label>
                    <select id="riskFilter" class="w-full bg-slate-900 border-slate-700 border rounded-xl p-3 text-sm outline-none">
                        <option value="ALL">Show All Risks</option>
                        <option value="CRITICAL">Critical Only</option>
                        <option value="HIGH">High & Above</option>
                    </select>
                </div>
                <div class="space-y-2">
                    <label class="text-xs font-bold text-slate-500 uppercase">Filter Action</label>
                    <select id="actionFilter" class="w-full bg-slate-900 border-slate-700 border rounded-xl p-3 text-sm outline-none">
                        <option value="ALL">All Actions</option>
                        <option value="create">Create</option>
                        <option value="update">Update</option>
                        <option value="replace">Replace</option>
                        <option value="delete">Delete</option>
                    </select>
                </div>
            </div>
        </div>

        <div class="bg-slate-800 rounded-2xl border border-slate-700 overflow-hidden shadow-2xl">
            <div id="resource-list" class="divide-y divide-slate-700">
                </div>
        </div>
    </div>

    <script>
        const data = {json_data};
        const listContainer = document.getElementById('resource-list');

        function updateUI() {{
            const searchTerm = document.getElementById('searchBox').value.toLowerCase();
            const riskLevel = document.getElementById('riskFilter').value;
            const actionType = document.getElementById('actionFilter').value;

            const filtered = data.changes.filter(item => {{
                const matchesSearch = item.address.toLowerCase().includes(searchTerm) || 
                                    item.type.toLowerCase().includes(searchTerm);

                const matchesRisk = riskLevel === 'ALL' || 
                                   (riskLevel === 'HIGH' ? (item.risk_level === 'HIGH' || item.risk_level === 'CRITICAL') : item.risk_level === riskLevel);

                const matchesAction = actionType === 'ALL' || item.actions.includes(actionType);

                return matchesSearch && matchesRisk && matchesAction;
            }});

            if (filtered.length === 0) {{
                listContainer.innerHTML = '<div class="p-20 text-center text-slate-500 font-medium">No resources match your filters</div>';
                return;
            }}

            listContainer.innerHTML = filtered.map(item => `
                <div class="p-6 hover:bg-slate-700/20 transition-all risk-${{item.risk_level}} flex flex-col md:flex-row justify-between items-start md:items-center gap-4">
                    <div class="flex-1">
                        <div class="flex items-center gap-3 mb-1">
                            <span class="text-xs font-mono font-bold text-slate-500 bg-slate-900 px-2 py-0.5 rounded border border-slate-700">${{item.type}}</span>
                            <span class="text-xs font-bold uppercase tracking-tighter ${{item.risk_level === 'CRITICAL' ? 'text-red-500' : (item.risk_level === 'HIGH' ? 'text-orange-500' : 'text-slate-400')}}">
                                ${{item.risk_level}} RISK
                            </span>
                        </div>
                        <h4 class="text-blue-400 font-mono text-sm font-semibold mb-1 truncate"># ${{item.address}}</h4>
                        <div class="text-xs text-slate-500">Module Path: <span class="text-slate-400">${{item.module}}</span></div>
                    </div>
                    <div class="flex flex-col items-end gap-2">
                        <div class="flex gap-1">
                            ${{item.actions.map(a => `
                                <span class="px-3 py-1 rounded-full text-[10px] font-black uppercase tracking-widest border
                                    ${{a === 'create' ? 'bg-emerald-500/10 text-emerald-500 border-emerald-500/20' : 
                                      a === 'delete' ? 'bg-red-500/10 text-red-500 border-red-500/20' : 
                                      'bg-blue-500/10 text-blue-400 border-blue-500/20'}}">
                                    ${{a}}
                                </span>
                            `).join('')}}
                        </div>
                        <div class="text-[10px] font-bold text-slate-600 uppercase tracking-widest">Provider: ${{item.provider}}</div>
                    </div>
                </div>
            `).join('');
        }}

        document.getElementById('searchBox').addEventListener('input', updateUI);
        document.getElementById('riskFilter').addEventListener('change', updateUI);
        document.getElementById('actionFilter').addEventListener('change', updateUI);

        // Initial render
        updateUI();
    </script>
</body>
</html>
        """
        with open(output_file, 'w') as f:
            f.write(html_template)
        print(f"Dashboard generated: {output_file}")

def main():
    parser = argparse.ArgumentParser(description='Enterprise TF Impact Dashboard Generator')
    parser.add_argument('plan', help='Terraform plan JSON file')
    parser.add_argument('--output', default='tf_report.html', help='Output HTML filename')
    parser.add_argument('--provider', nargs='+', help='Initial filter by provider')
    parser.add_argument('--module', nargs='+', help='Initial filter by module prefix')

    args = parser.parse_args()

    # Pre-filtering engine (CLI level)
    engine = FilterEngine(providers=args.provider, modules=args.module)

    detector = EnterpriseTFDetector(args.plan, engine)
    results = detector.analyze()

    visualizer = EnterpriseVisualizer(results)
    visualizer.generate_html(args.output)

    print("\nSummary:")
    print(f"  - Total Changes detected: {sum(results['stats'].values())}")
    print(f"  - Critical Risks: {results['risk_summary']['CRITICAL']}")
    print(f"  - High Risks: {results['risk_summary']['HIGH']}")

if __name__ == "__main__":
    main()

Streamline Your AWS Asset Inventory with Automated Discovery and Reporting

Praveen HA — Mon, 03 Jun 2024 07:23:41 +0000

Managing resources across multiple AWS accounts and regions can be a daunting task, especially as your cloud infrastructure grows. To simplify this process, I have developed an AWS Inventory Discovery tool that scans all your AWS accounts across all regions and compiles a comprehensive, searchable HTML report. In this blog, I'll walk you through the features, benefits, and technical details of this solution.

Introduction
As organizations scale their use of AWS, keeping track of resources scattered across various accounts and regions becomes increasingly challenging. Manual inventory management is not only time-consuming but also prone to errors. This is where the AWS Inventory Discovery tool comes in.

Features
Comprehensive Scanning: The tool scans all your AWS accounts across all regions, ensuring no resource is left unaccounted for.
Detailed Reporting: Generates a detailed HTML report that lists all discovered resources, including their ARNs and regions.
Searchable Interface: The HTML report includes a search functionality, making it easy to find specific resources quickly.
Visual Representation: Includes pie charts to provide a visual summary of your resources, helping you quickly understand the distribution of resources across various dimensions.
User-Friendly: The generated report is easy to navigate, allowing users to drill down into resource details with just a few clicks.
Benefits
Improved Visibility: Gain a clear overview of all your AWS resources across accounts and regions.
Time Savings: Automate the discovery process, freeing up time for your team to focus on more critical tasks.
Error Reduction: Minimize the risk of overlooking resources or making mistakes in manual inventories.
Enhanced Security: Quickly identify and manage resources to ensure compliance with security policies and best practices.
How It Works
Prerequisites
Before you begin, ensure you have the following set up:

AWS CLI: Install the AWS Command Line Interface (CLI).

pip install awscli
AWS Credentials: Export your AWS profile or access keys and secrets, and specify the region.
export AWS_PROFILE=your-aws-profile

export AWS_ACCESS_KEY_ID=your-access-key-id
export AWS_SECRET_ACCESS_KEY=your-secret-access-key
export AWS_DEFAULT_REGION=your-default-region`

#!/bin/bash

AccountID="<YOUR_AWS_ACCOUNT>"
regions=$(aws ec2 describe-regions --query "Regions[].RegionName" --output text)
#regions=(ap-south-1 eu-north-1  eu-west-3  eu-west-1  ap-northeast-3  ap-northeast-2  ap-northeast-1  ca-central-1  sa-east-1   ap-southeast-1  ap-southeast-2  eu-central-1  us-east-1  us-east-2  us-west-1  us-west-2 )

# Initialize arrays to store data
declare -a summary_data=()
declare -a detailed_data=()

# Fetch resources from all regions
for region in $regions; do
    # Fetch resource ARNs and process them
    data=$(aws --region $region resourcegroupstaggingapi get-resources | jq -r '.ResourceTagMappingList[].ResourceARN' | \
    awk -v region=$region -F '[:/]' '
        {
            resourceType = "unknown"
            if ($3 == "s3") {
                resourceType = "bucket"
            } else if ($3 == "sns") {
                resourceType = "topic"
            } else {
                resourceType = $6  
            }

            # Construct a unique key for each service-resource pair
            pair = $3 ":" resourceType
            count[pair]++
        }
        END {
            for (pair in count) {
                split(pair, s, ":")  # Split the pair back into service and resource
                service = s[1]
                resource = s[2]
                print "{\"service\":\"" service "\", \"resource\":\"" resource "\", \"count\":" count[pair] "}"
            }
        }
    ')

    # Append to summary_data
    summary_data+=($data)

    # Fetch detailed resource information
    detailed_info=$(aws resourcegroupstaggingapi get-resources --region $region | jq -r --arg region $region '.ResourceTagMappingList[] | {Resource_Arn: .ResourceARN, Region: ($region // "Global"), Detailed_Service: (.ResourceARN | split(":")[2])}')

    # Append to detailed_data
    detailed_data+=($detailed_info)
done

# Process summary data
summary_json=$(printf "%s\n" "${summary_data[@]}" | jq -s 'group_by(.service, .resource) | map({service: .[0].service, resource: .[0].resource, count: map(.count) | add})')
total_resources=$(echo "$summary_json" | jq 'map(.count) | add')

# Process detailed data
detailed_json=$(printf "%s\n" "${detailed_data[@]}" | jq -s .)

# Generate HTML
cat <<EOF > index.html
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>AWS Resources</title>
    <style>
        body {
            font-family: Arial, sans-serif;
            background-color: #f4f4f9;
            margin: 0;
            padding: 20px;
        }
        h1 {
            color: #333;
        }
        #searchBox, #searchBox2 {
            width: 100%;
            padding: 10px;
            margin-bottom: 20px;
            box-sizing: border-box;
            font-size: 16px;
        }
        table {
            width: 100%;
            border-collapse: collapse;
        }
        th, td {
            border: 1px solid #ddd;
            padding: 8px;
            text-align: left;
        }
        th {
            background-color: #4CAF50;
            color: white;
        }
        tr:nth-child(even) {
            background-color: #f2f2f2;
        }
        tr:hover {
            background-color: #ddd;
        }
        .total-count {
            font-size: 18px;
            margin: 20px 0;
        }
        #chartContainer {
            width: 50%;
            margin: 0 auto;
        }
    </style>
</head>
<body>
    <h1>AWS Resources for Account ID: $AccountID</h1>
    <div class="total-count">Total Resources: $total_resources</div>
    <input type="text" id="searchBox" onkeyup="filterTable()" placeholder="Search for services..">
    <table id="resourcesTable">
        <thead>
            <tr>
                <th>Service</th>
                <th>Resource</th>
                <th>Count</th>
            </tr>
        </thead>
        <tbody>
        </tbody>
    </table>

    <h1>Detailed AWS Resources</h1>
    <input type="text" id="searchBox2" onkeyup="filterTable2()" placeholder="Search for resources..">
    <table id="detailedResourcesTable">
        <thead>
            <tr>
                <th>Resource ARN</th>
                <th>Region</th>
                <th>Detailed Service</th>
            </tr>
        </thead>
        <tbody>
        </tbody>
    </table>

    <div id="chartContainer">
        <canvas id="resourceChart"></canvas>
    </div>

    <script src="https://cdn.jsdelivr.net/npm/chart.js"></script>
    <script>
        const data = $summary_json;
        const resourceData = $detailed_json;

        function loadTableData(data) {
            const tableBody = document.getElementById('resourcesTable').getElementsByTagName('tbody')[0];
            tableBody.innerHTML = "";

            data.forEach(item => {
                let row = tableBody.insertRow();
                let cellService = row.insertCell(0);
                let cellResource = row.insertCell(1);
                let cellCount = row.insertCell(2);

                cellService.innerHTML = item.service;
                cellResource.innerHTML = item.resource;
                cellCount.innerHTML = item.count;
            });

            updateChart(data);
        }

        function loadDetailedTableData(resourceData) {
            const tableBody = document.getElementById('detailedResourcesTable').getElementsByTagName('tbody')[0];
            tableBody.innerHTML = "";

            resourceData.forEach(item => {
                let row = tableBody.insertRow();
                let cellArn = row.insertCell(0);
                let cellRegion = row.insertCell(1);
                let cellService = row.insertCell(2);

                cellArn.innerHTML = item.Resource_Arn;
                cellRegion.innerHTML = item.Region;
                cellService.innerHTML = item.Detailed_Service;
            });
        }

        function filterTable() {
            const searchValue = document.getElementById('searchBox').value.toLowerCase();
            const filteredData = data.filter(item => item.service && item.service.toLowerCase().includes(searchValue));
            loadTableData(filteredData);
        }

        function filterTable2() {
            const searchValue = document.getElementById('searchBox2').value.toLowerCase();
            const filteredResourceData = resourceData.filter(item => 
                item.Resource_Arn.toLowerCase().includes(searchValue) ||
                item.Region.toLowerCase().includes(searchValue) ||
                item.Detailed_Service.toLowerCase().includes(searchValue)
            );
            loadDetailedTableData(filteredResourceData);
        }

        function updateChart(data) {
            const services = data.reduce((acc, item) => {
                acc[item.service] = (acc[item.service] || 0) + item.count;
                return acc;
            }, {});

            const labels = Object.keys(services);
            const counts = Object.values(services);

            const ctx = document.getElementById('resourceChart').getContext('2d');
            new Chart(ctx, {
                type: 'pie',
                data: {
                    labels: labels,
                    datasets: [{
                        data: counts,
                        backgroundColor: [
                            '#FF6384', '#36A2EB', '#FFCE56', '#4CAF50', '#FF9800', '#9C27B0', '#00BCD4'
                        ]
                    }]
                },
                options: {
                    responsive: true,
                    plugins: {
                        legend: {
                            position: 'top',
                        },
                        title: {
                            display: true,
                            text: 'Resource Distribution by Service'
                        }
                    }
                }
            });
        }

        document.addEventListener('DOMContentLoaded', () => {
            loadTableData(data);
            loadDetailedTableData(resourceData);
        });
    </script>
</body>
</html>
EOF

AMI Age Calculator of Running AWS EC2 Instances and Generate CSV Report

Praveen HA — Sun, 01 Oct 2023 10:32:51 +0000

Instances running on outdated AMIs pose a security risk. Keeping our infrastructure secure requires us to regularly update these instances with the latest AMIs. Manually identifying and updating instances can be a time-consuming process, especially in large AWS accounts.

How does the automation work?

Our automation script leverages AWS CLI and the power of scripting to identify instances using older AMIs automatically.
Account and Region Selection: We can specify the AWS account ID and region you want to scan when executing the Jenkins Job.

AMI Age Assessment: The script checks every instance in the selected account and region and determines the age of the associated AMI based on its creation date.

Automated Reporting: It generates a CSV report with details of instances using AMIs that are 4 months or older. This report includes the Account ID, Region, Instance ID, AMI ID, and AMI Age (Months).

Actionable Insights: With this report, we can easily identify which instances require updates. This information can be used to patch instances with the latest AMIs, ensuring they remain secure and optimized.

How can we use it?

Running this automation is simple. we can execute the script filling the AWS account ID and region as parameters. script will do the rest providing us with a detailed report.

What are the benefits?

Enhanced Security: We can proactively identify and patch instances with older AMIs, reducing security vulnerabilities.

Efficiency: Manual instance assessment is time-consuming, but this automation speeds up the process, allowing us to focus on other critical tasks.

Consistency: By automating this process, we ensure that all instances are assessed uniformly and regularly.

`#!/bin/bash

Initialize variables with default values

ACCOUNTID=""
REGION=""

OUTPUT_CSV="$ACCOUNTID-$REGION-ami_age_report.csv" # Define the CSV file name
rm -rf $OUTPUT_CSV

Parse command line options

while getopts "a🅱️" option; do
case $option in
a) ACCOUNTID=${OPTARG} ;;
b) REGION=${OPTARG} ;;
*) echo "usage: $0 [-a ACCOUNTID] [-b REGION]" >&2
exit 1 ;;
esac
done

List instances and AMI IDs in the specified region

instances_json=$(aws ec2 describe-instances --region "$REGION" --query 'Reservations[].Instances[].[InstanceId,ImageId]' --output json) # For local

Get the current timestamp

current_time=$(date -u +%s)

Initialize the CSV file with headers

echo "AccountID,Region,InstanceID,AMIID,AMIAge (months)" > "$OUTPUT_CSV"

Iterate through instances and append to the CSV file

for row in $(echo "$instances_json" | jq -r '.[][] | @base64'); do
_jq() {
echo "$row" | base64 --decode | jq -r "$1"
}

instance_id=$(_jq '.[0]')
ami_id=$(_jq '.[1]')

# Get the creation date of the AMI in the specified region
ami_create_time=$(aws ec2 describe-images --region "$REGION" --image-ids "$ami_id" --query 'Images[0].CreationDate' --output text) # For local

# Calculate the age in months based on the AMI creation time
ami_create_timestamp=$(date -u -d "$ami_create_time" +%s)
months_diff=$(( (current_time - ami_create_timestamp) / 60 / 60 / 24 / 30 ))

# Check if the AMI is older than 4 months
if [ "$months_diff" -ge 4 ]; then
# Append to the CSV file
echo "$ACCOUNTID,$REGION,$instance_id,$ami_id,$months_diff" >> "$OUTPUT_CSV"
fi
done

echo "CSV report saved to $OUTPUT_CSV"
cat $OUTPUT_CSV`