I’ve spent a lot of time working with AWS environments, and one thing that keeps coming up is how annoying it can be to understand what actually happened after something changes.
You notice a security group is suddenly open, an IAM policy was changed, a new access key appeared, or something in the environment just doesn’t look right. AWS has the information, but finding the answer usually means opening CloudTrail, checking IAM, jumping back to the resource, looking at permissions, timestamps, and trying to connect everything yourself.
That’s why I started building Kultarr.
The idea is pretty simple: when something changes in AWS, I want to make it easier to understand the full story behind it. What changed, who made the change, what permissions were used, which resource was affected, and what it looked like before.
I’m not trying to replace AWS tools. I actually want to use the data AWS already gives us and make the investigation around it much easier to follow.
Kultarr is still being built and there’s a lot I want to improve, but the direction is becoming much clearer.
I’d really like to hear from people who work with AWS regularly: when something unexpected happens in an account, what usually wastes the most time during the investigation?