semonte/sisuMonta le risorse AWS come filesystem locale per l'esplorazione dell'infrastruttura, l'audit di sicurezza e l'analisi della configurazione utilizzando strumenti Unix standard come grep, diff e cat.
Il tuo AWS, come file system.
Questo:
grep -l "AdministratorAccess" iam/users/*/policies.json
Invece di questo:
aws iam list-users --query 'Users[].UserName' --output text | \
xargs -I{} sh -c 'aws iam list-attached-user-policies --user-name {} --query "AttachedPolicies[].PolicyArn" --output text' | \
grep AdministratorAccess
sisu monta le risorse AWS come file system locale. Usa gli strumenti che già conosci - grep, cat, diff, vim - invece di combattere con JSON e la CLI AWS.
Progettato per essere AI-friendly: gli strumenti AI non possono connettersi via SSH ai server o eseguire sessioni interattive della CLI AWS. Ma con sisu, la tua intera infrastruttura AWS diventa semplici percorsi di file che qualsiasi AI può leggere. I file system EC2 remoti sono accessibili in ec2/<instance>/fs/ - consentendo all'AI di esplorare /var/log, /etc e qualsiasi file sulle tue istanze senza SSH.
Attualmente supporta S3, SSM, IAM, VPC, Lambda, EC2, ECS, CloudFront, Secrets Manager, Route 53 e CloudWatch Logs.
go install github.com/semonte/sisu@latest
Richiede FUSE:
sudo apt install fuse # Ubuntu/Debian
sudo yum install fuse # RHEL/CentOS
sisu
Ci sei. Il tuo AWS è ora a portata di mano:
~/.sisu/mnt/
├── default/ # AWS profile
│ ├── global/ # IAM, S3, Route 53 (region-independent)
│ │ ├── iam/
│ │ ├── route53/
│ │ └── s3/
│ ├── us-east-1/ # Regional services
│ │ ├── cloudfront/
│ │ ├── ec2/
│ │ ├── ecs/
│ │ ├── lambda/
│ │ ├── logs/
│ │ ├── secrets/
│ │ ├── ssm/
│ │ └── vpc/
│ └── eu-west-1/
│ └── ...
├── prod/ # Other profiles from ~/.aws/credentials
└── staging/
Digita exit quando hai finito.
# Who has admin access?
grep -l "AdministratorAccess" */global/iam/users/*/policies.json
# Security groups with SSH open
grep -r '"FromPort": 22' */us-east-1/vpc/*/security-groups/
# Roles that Lambda can assume
grep -l "lambda.amazonaws.com" */global/iam/roles/*/info.json
# Secrets in SSM?
grep -r "password" */us-east-1/ssm/
# Lambda functions with secrets in env vars
grep -r "PASSWORD\|SECRET\|API_KEY" */us-east-1/lambda/*/env.json
# Functions using deprecated runtimes
grep -r "python3.8\|nodejs16" */*/lambda/*/config.json
# EC2 instances with public IPs
grep -r "PublicIpAddress" */*/ec2/*/info.json
# Find stopped instances (wasting money?)
grep -r '"Name": "stopped"' */*/ec2/*/info.json
# Connect to an EC2 instance via SSM (no SSH keys needed!)
./default/us-east-1/ec2/i-abc123/connect
# View EC2 boot logs and kernel messages
cat default/us-east-1/ec2/i-abc123/console.log
# View all secrets
ls */us-east-1/secrets/
# Read a secret value
cat default/us-east-1/secrets/myapp/database/value
# List all DNS zones
ls */global/route53/
# View DNS records for a zone
cat default/global/route53/example.com/records.json
# Find all CNAME records
grep -r '"Type": "CNAME"' */global/route53/*/records.json
# Grep recent logs for errors
grep -i "error" default/us-east-1/logs/aws/lambda/my-function/latest.log
# View all log groups
ls */us-east-1/logs/
# List log streams (shows 20 most recent)
ls default/us-east-1/logs/aws/lambda/my-function/
# View events from a specific stream
cat default/us-east-1/logs/aws/lambda/my-function/2024_01_15_abc123/events.log
# ECS: Browse clusters, services, and tasks
ls default/us-east-1/ecs/my-cluster/my-service/
cat default/us-east-1/ecs/my-cluster/my-service/logs/latest.log
# CloudFront: View distributions and functions
ls default/us-east-1/cloudfront/distributions/
cat default/us-east-1/cloudfront/functions/my-auth/code.js
# S3: Check bucket policies and access settings
cat default/global/s3/my-bucket/.meta/policy.json
cat default/global/s3/my-bucket/.meta/public-access-block.json
# Compare IAM roles between accounts
diff prod/global/iam/roles/api/info.json staging/global/iam/roles/api/info.json
# Security group drift between regions
diff default/us-east-1/vpc/vpc-xxx/security-groups/sg-xxx.json default/eu-west-1/vpc/vpc-yyy/security-groups/sg-yyy.json
# Lambda config differences
diff prod/us-east-1/lambda/my-func/config.json staging/us-east-1/lambda/my-func/config.json
# Pretty print with jq
cat default/global/iam/roles/my-role/info.json | jq '.AssumeRolePolicyDocument'
# Count your roles
ls default/global/iam/roles/ | wc -l
# Find untagged resources
cat default/us-east-1/vpc/vpc-xxx/info.json | jq 'select(.Tags == null)'
# List all Lambda runtimes in use
grep -h "Runtime" */*/lambda/*/config.json | sort | uniq -c
cat default/us-east-1/ssm/myapp/database-url # read
echo "postgres://prod:5432" > default/us-east-1/ssm/database-url # write
vim default/us-east-1/ssm/myapp/config # edit
cp local.txt default/global/s3/my-bucket/backup/
cat default/global/s3/my-bucket/logs/app.log | grep ERROR
rm default/global/s3/my-bucket/old-file.txt
sisu # Start at root
sisu --profile prod # Start in prod/
sisu --profile prod --region us-east-1 # Start in prod/us-east-1/
sisu stop # Unmount
sisu --debug # Debug logging
| Servizio | Lettura | Scrittura | Eliminazione |
|---|---|---|---|
| S3 (oggetti, bucket policies, impostazioni di accesso) | ✓ | ✓ | ✓ |
| SSM Parameter Store | ✓ | ✓ | ✓ |
| IAM (utenti, ruoli, policies, gruppi) | ✓ | - | - |
| VPC (subnet, security group, route) | ✓ | - | - |
| Lambda (config, policy, variabili d'ambiente, log) | ✓ | - | - |
| EC2 (istanze, security group, tag, log, fs remoto) | ✓ | - | - |
| ECS (cluster, servizi, task, log) | ✓ | - | - |
| CloudFront (distribuzioni, funzioni, log) | ✓ | - | - |
| Secrets Manager | ✓ | - | - |
| Route 53 (zone, record) | ✓ | - | - |
| CloudWatch Logs | ✓ | - | - |
I file events.log dei log stream vengono trasmessi pigramente da AWS invece di essere caricati interamente in memoria:
cat, grep, head, less# Fetches only enough batches to find the match
grep "ERROR" .../my-stream/events.log
# Fetches just the first batch
head -50 .../my-stream/events.log
# Scroll through with on-demand loading
less .../my-stream/events.log
# Will fetch all events
cat .../my-stream/events.log | wc -l