sisu — Monte les ressources AWS comme un système de fichiers local pour l'exploration d'infrastructure, l'audit de sécurité et l'analyse de configuration en utilisant des outils Unix standard comme grep, diff et cat. | Kitploit

sisu ⚡

Votre AWS, comme un système de fichiers.

Demo

Ceci :

grep -l "AdministratorAccess" iam/users/*/policies.json

Au lieu de ceci :

aws iam list-users --query 'Users[].UserName' --output text | \
  xargs -I{} sh -c 'aws iam list-attached-user-policies --user-name {} --query "AttachedPolicies[].PolicyArn" --output text' | \
  grep AdministratorAccess

Table des matières

Qu'est-ce que c'est ?
Installation
Démarrage rapide
Les trucs sympas
Options
Ce qui est pris en charge
Comment fonctionne la diffusion des logs CloudWatch
Logs intégrés
Explorateur ECS
Explorateur CloudFront
Métadonnées des buckets S3

~/.sisu/mnt/
├── default/              # AWS profile
│   ├── global/           # IAM, S3, Route 53 (region-independent)
│   │   ├── iam/
│   │   ├── route53/
│   │   └── s3/
│   ├── us-east-1/        # Regional services
│   │   ├── cloudfront/
│   │   ├── ec2/
│   │   ├── ecs/
│   │   ├── lambda/
│   │   ├── logs/
│   │   ├── secrets/
│   │   ├── ssm/
│   │   └── vpc/
│   └── eu-west-1/
│       └── ...
├── prod/                 # Other profiles from ~/.aws/credentials
└── staging/

# Who has admin access?
grep -l "AdministratorAccess" */global/iam/users/*/policies.json

# Security groups with SSH open
grep -r '"FromPort": 22' */us-east-1/vpc/*/security-groups/

# Roles that Lambda can assume
grep -l "lambda.amazonaws.com" */global/iam/roles/*/info.json

# Secrets in SSM?
grep -r "password" */us-east-1/ssm/

# Lambda functions with secrets in env vars
grep -r "PASSWORD\|SECRET\|API_KEY" */us-east-1/lambda/*/env.json

# Functions using deprecated runtimes
grep -r "python3.8\|nodejs16" */*/lambda/*/config.json

# EC2 instances with public IPs
grep -r "PublicIpAddress" */*/ec2/*/info.json

# Find stopped instances (wasting money?)
grep -r '"Name": "stopped"' */*/ec2/*/info.json

# Connect to an EC2 instance via SSM (no SSH keys needed!)
./default/us-east-1/ec2/i-abc123/connect

# View EC2 boot logs and kernel messages
cat default/us-east-1/ec2/i-abc123/console.log

# View all secrets
ls */us-east-1/secrets/

# Read a secret value
cat default/us-east-1/secrets/myapp/database/value

# List all DNS zones
ls */global/route53/

# View DNS records for a zone
cat default/global/route53/example.com/records.json

# Find all CNAME records
grep -r '"Type": "CNAME"' */global/route53/*/records.json

# Grep recent logs for errors
grep -i "error" default/us-east-1/logs/aws/lambda/my-function/latest.log

# View all log groups
ls */us-east-1/logs/

# List log streams (shows 20 most recent)
ls default/us-east-1/logs/aws/lambda/my-function/

# View events from a specific stream
cat default/us-east-1/logs/aws/lambda/my-function/2024_01_15_abc123/events.log

# ECS: Browse clusters, services, and tasks
ls default/us-east-1/ecs/my-cluster/my-service/
cat default/us-east-1/ecs/my-cluster/my-service/logs/latest.log

# CloudFront: View distributions and functions
ls default/us-east-1/cloudfront/distributions/
cat default/us-east-1/cloudfront/functions/my-auth/code.js

# S3: Check bucket policies and access settings
cat default/global/s3/my-bucket/.meta/policy.json
cat default/global/s3/my-bucket/.meta/public-access-block.json

# Compare IAM roles between accounts
diff prod/global/iam/roles/api/info.json staging/global/iam/roles/api/info.json

# Security group drift between regions
diff default/us-east-1/vpc/vpc-xxx/security-groups/sg-xxx.json default/eu-west-1/vpc/vpc-yyy/security-groups/sg-yyy.json

# Lambda config differences
diff prod/us-east-1/lambda/my-func/config.json staging/us-east-1/lambda/my-func/config.json

# Pretty print with jq
cat default/global/iam/roles/my-role/info.json | jq '.AssumeRolePolicyDocument'

# Count your roles
ls default/global/iam/roles/ | wc -l

# Find untagged resources
cat default/us-east-1/vpc/vpc-xxx/info.json | jq 'select(.Tags == null)'

# List all Lambda runtimes in use
grep -h "Runtime" */*/lambda/*/config.json | sort | uniq -c

cat default/us-east-1/ssm/myapp/database-url          # read
echo "postgres://prod:5432" > default/us-east-1/ssm/database-url  # write
vim default/us-east-1/ssm/myapp/config                # edit

sisu                                    # Start at root
sisu --profile prod                     # Start in prod/
sisu --profile prod --region us-east-1  # Start in prod/us-east-1/
sisu stop                               # Unmount
sisu --debug                            # Debug logging

Service	Lecture	Écriture	Suppression
S3 (objects, bucket policies, access settings)	✓	✓	✓
SSM Parameter Store	✓	✓	✓
IAM (users, roles, policies, groups)	✓	-	-
VPC (subnets, security groups, routes)	✓	-	-
Lambda (config, policy, env vars, logs)	✓	-	-
EC2 (instances, security groups, tags, logs, remote fs)	✓	-	-
ECS (clusters, services, tasks, logs)	✓	-	-
CloudFront (distributions, functions, logs)	✓	-	-
Secrets Manager	✓	-	-
Route 53 (zones, records)	✓	-	-
CloudWatch Logs	✓	-	-

# Fetches only enough batches to find the match
grep "ERROR" .../my-stream/events.log

# Fetches just the first batch
head -50 .../my-stream/events.log

# Scroll through with on-demand loading
less .../my-stream/events.log

# Will fetch all events
cat .../my-stream/events.log | wc -l

# Lambda function logs
cat default/us-east-1/lambda/my-function/logs/latest.log

# EC2 instance logs (searches for log groups containing instance ID)
cat default/us-east-1/ec2/i-abc123/logs/latest.log

# ECS service logs
cat default/us-east-1/ecs/my-cluster/my-service/logs/latest.log

# CloudFront function logs
cat default/us-east-1/cloudfront/functions/my-auth/logs/latest.log

ecs/
├── my-cluster/
│   ├── web-service/
│   │   ├── info.json          # Service configuration
│   │   ├── logs/
│   │   │   └── latest.log     # Streaming service logs
│   │   └── tasks/
│   │       └── abc123/
│   │           └── info.json  # Task details
│   └── api-service/
│       └── ...

# List all ECS clusters
ls default/us-east-1/ecs/

# View service configuration
cat default/us-east-1/ecs/my-cluster/web-service/info.json

# Stream service logs
cat default/us-east-1/ecs/my-cluster/web-service/logs/latest.log

# List running tasks
ls default/us-east-1/ecs/my-cluster/web-service/tasks/

cloudfront/
├── distributions/
│   └── E1ABC123/
│       ├── info.json          # Distribution config
│       └── origins.json       # Origins with OAC/OAI info
└── functions/
    └── my-auth/
        ├── code.js            # Function source code
        ├── config.json        # Function configuration
        └── logs/
            └── latest.log     # Function execution logs

# List distributions
ls default/us-east-1/cloudfront/distributions/

# Check origin access configuration (debug S3 access issues!)
cat default/us-east-1/cloudfront/distributions/E1ABC123/origins.json

# View and edit CloudFront function code
cat default/us-east-1/cloudfront/functions/my-auth/code.js

# Debug function execution
cat default/us-east-1/cloudfront/functions/my-auth/logs/latest.log

# List files on the instance
ls default/us-east-1/ec2/i-abc123/fs/etc/

# Read remote files
cat default/us-east-1/ec2/i-abc123/fs/etc/hostname

# Grep across remote logs
grep ERROR default/us-east-1/ec2/i-abc123/fs/var/log/syslog

# Compare configs between instances
diff prod/us-east-1/ec2/i-111/fs/etc/nginx/nginx.conf \
     prod/us-east-1/ec2/i-222/fs/etc/nginx/nginx.conf

# Browse and preview any resource interactively
find */global/iam/roles -name "info.json" | fzf --preview 'jq . {}'

# Find Lambda functions with high memory
jq -r 'select(.MemorySize > 512) | .FunctionName' */us-east-1/lambda/*/config.json

# Compare prod vs staging config
difft prod/us-east-1/lambda/api/config.json staging/us-east-1/lambda/api/config.json

# Check cluster status - no instances registered
cat ecs/jobdeck-cluster/info.json | jq '.RegisteredContainerInstancesCount'
# → 0

# Check service config - using EC2 launch type
cat ecs/jobdeck-cluster/jobdeck-api/info.json | jq '.LaunchType, .FailedTasks'
# → "EC2", 136

# EC2 instance exists - check its ECS config
cat ec2/i-xxx/fs/etc/ecs/ecs.config
# → ECS_CLUSTER=jobdeck-cluster ✓

# Check ECS agent logs - no agent log!
ls ec2/i-xxx/fs/var/log/ecs/
# → ecs-volume-plugin.log (missing ecs-agent.log!)

# Check what AMI is running
cat ec2/i-xxx/fs/etc/image-id
# → image_name="amzn2-ami-minimal-hvm"  ← NOT ECS-optimized!

Outil	Ce qu'il fait
fzf	Recherche floue avec aperçu
jq	Interrogation/transformation JSON
difftastic	Diff structurel (comprend le JSON)

sisu

Populaires

Qu'est-ce que c'est ? 🤔

Installation 📦

Démarrage rapide 🚀

Les trucs sympas 🔥

Explorez votre infrastructure

Comparez vos environnements

Envoyez vers n'importe quoi

Modifiez SSM comme un fichier

S3, façon Unix

Options ⚙️

Ce qui est pris en charge ✅

Comment fonctionne la diffusion des logs CloudWatch 📜

Logs intégrés 📋

Explorateur ECS 🐳

Explorateur CloudFront 🌐

Métadonnées des buckets S3 🪣

Connexion EC2, Console et Système de fichiers distant 🖥️

Outils qui s'associent bien 🔧

Interrogez l'IA sur votre infrastructure 🤖

Exemple de débogage concret 🔍

Astuces 💡

Licence 📄