Split from #642, which is now scoped to GCP.
The goal is to track configuration changes in clickops platforms, the way cloudflare-account.txt and cloudflare-zones.txt do. Terraform is incidental: it is a serializer that happens to be the easiest reader for Cloudflare, not the objective.
For AWS, Terraform is the worst reader. There is no first-party exporter:
terraformer needs a per-service resource list, recreating the curation that the Cloudflare resource-type sets in manage.py cost.former2 is browser-based and manual.terraform plan -generate-config-out needs every resource address written by hand first, so it discovers nothing.
Scripted aws … describe-*/list-* JSON dumps are much less work, and the AWS provider's coverage is irrelevant when nothing populates it.
Scope to what is documented in docs/deploy/services/aws.rst:
- SES identities, receipt rule sets, configuration sets, notification topics
- IAM policies and users
- S3 bucket policies
Skip AWS Config: it bills per configuration item and is not diffable in git. CloudTrail Event History already retains 90 days of change records at no charge, as the analogue of the gcloud logging read recipe for GCP.
The work is normalization, not retrieval: stable ordering, volatile fields stripped, and IAM policy documents URL-decoded and re-sorted before they can be diffed. See manage.py gcp snapshot for the shape.
Note that this repository is public, so the output needs review before the first commit.
🤖 Generated with Claude Code
Split from #642, which is now scoped to GCP.
The goal is to track configuration changes in clickops platforms, the way
cloudflare-account.txtandcloudflare-zones.txtdo. Terraform is incidental: it is a serializer that happens to be the easiest reader for Cloudflare, not the objective.For AWS, Terraform is the worst reader. There is no first-party exporter:
terraformerneeds a per-service resource list, recreating the curation that the Cloudflare resource-type sets inmanage.pycost.former2is browser-based and manual.terraform plan -generate-config-outneeds every resource address written by hand first, so it discovers nothing.Scripted
aws … describe-*/list-*JSON dumps are much less work, and the AWS provider's coverage is irrelevant when nothing populates it.Scope to what is documented in
docs/deploy/services/aws.rst:Skip AWS Config: it bills per configuration item and is not diffable in git. CloudTrail Event History already retains 90 days of change records at no charge, as the analogue of the
gcloud logging readrecipe for GCP.The work is normalization, not retrieval: stable ordering, volatile fields stripped, and IAM policy documents URL-decoded and re-sorted before they can be diffed. See
manage.py gcp snapshotfor the shape.Note that this repository is public, so the output needs review before the first commit.
🤖 Generated with Claude Code