awslog

Show the history and changes between configuration versions of AWS resources

Uses AWS Config to fetch the configuration history of resources, only works on resources supported by AWS Config.

Installation

pip install awslog

Usage

Make sure your AWS credentials are properly configured. You can test it using the AWS CLI by issuing aws sts get-caller-identity. It should report information about your current CLI session and not raise any errors.

Make sure AWS Config is set up to record configuration changes of your resources.

CLI

usage: awslog [-h] [--type TYPE] [--number NUMBER] [--before BEFORE]
              [--after AFTER] [--deleted] [--context CONTEXT] [--no-color]
              name

positional arguments:
  name                  name or ID of the resource to query

optional arguments:
  -h, --help            show this help message and exit
  --type TYPE, -t TYPE  the type of the resource to query list of supported
                        resource types: https://docs.aws.amazon.com/config/lat
                        est/developerguide/resource-config-reference.html
  --number NUMBER, -n NUMBER
                        number of history items to show
  --before BEFORE, -b BEFORE
                        show changes more recent than the specified date and
                        time
  --after AFTER, -a AFTER
                        show changes older than the specified date and time
  --deleted, -d         include deleted resources
  --context CONTEXT, -c CONTEXT
                        number of context lines in the diffs
  --no-color, -o        disable colored output

Examples:

$ awslog sg-7235f203
--- arn:aws:ec2:us-east-1:281519598877:security-group/sg-7235f203/configuration	2018-09-12 23:44:36
+++ arn:aws:ec2:us-east-1:281519598877:security-group/sg-7235f203/configuration	2018-09-12 23:53:44
@@ -1,24 +1,24 @@
 {
   "description": "default VPC security group",
   "groupId": "sg-7235f203",
   "groupName": "default",
   "ipPermissions": [
     {
       "fromPort": 80,
       "ipProtocol": "tcp",
       "ipRanges": [
-        "1.1.1.1/32"
+        "0.0.0.0/0"
       ],
       "ipv4Ranges": [
         {
-          "cidrIp": "1.1.1.1/32"
+          "cidrIp": "0.0.0.0/0"
         }
       ],
       "ipv6Ranges": [],
       "prefixListIds": [],
       "toPort": 80,
       "userIdGroupPairs": []
     }
   ],
   "ipPermissionsEgress": [
     {

$ awslog --type AWS::IAM::User \
>        --number 2 \
>        --before '10 minutes ago' \
>        --after '2018-01-01' \
>        --deleted \
>        --context 3 \
>        --no-color \
>        ReadOnly
--- arn:aws:iam::281519598877:user/ReadOnly/configuration	2018-09-13 11:28:16
+++ arn:aws:iam::281519598877:user/ReadOnly/configuration	2018-09-13 11:53:02
@@ -1,10 +1,6 @@
 {
   "arn": "arn:aws:iam::281519598877:user/ReadOnly",
   "attachedManagedPolicies": [
-    {
-      "policyArn": "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
-      "policyName": "AmazonEC2ReadOnlyAccess"
-    },
     {
       "policyArn": "arn:aws:iam::aws:policy/AdministratorAccess",
       "policyName": "AdministratorAccess"

--- arn:aws:iam::281519598877:user/ReadOnly/configuration	2018-09-13 10:58:19
+++ arn:aws:iam::281519598877:user/ReadOnly/configuration	2018-09-13 11:28:16
@@ -4,6 +4,10 @@
     {
       "policyArn": "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
       "policyName": "AmazonEC2ReadOnlyAccess"
+    },
+    {
+      "policyArn": "arn:aws:iam::aws:policy/AdministratorAccess",
+      "policyName": "AdministratorAccess"
     },
     {
       "policyArn": "arn:aws:iam::aws:policy/IAMUserChangePassword",

Python module

>>> import boto3
>>> import awslog
>>> config = boto3.client('config')
>>> after, before = list(awslog.get_config_history(config, 'AWS::EC2::SecurityGroup', 'sg-7235f203'))
>>> print('\n'.join(awslog.create_diff(after, before)))

--- arn:aws:ec2:us-east-1:281519598877:security-group/sg-7235f203/configuration	2018-09-12 23:44:36
+++ arn:aws:ec2:us-east-1:281519598877:security-group/sg-7235f203/configuration	2018-09-12 23:53:44
@@ -1,24 +1,24 @@
 {
   "description": "default VPC security group",
   "groupId": "sg-7235f203",
   "groupName": "default",
   "ipPermissions": [
     {
       "fromPort": 80,
       "ipProtocol": "tcp",
       "ipRanges": [
-        "1.1.1.1/32"
+        "0.0.0.0/0"
       ],
       "ipv4Ranges": [
         {
-          "cidrIp": "1.1.1.1/32"
+          "cidrIp": "0.0.0.0/0"
         }
       ],
       "ipv6Ranges": [],
       "prefixListIds": [],
       "toPort": 80,
       "userIdGroupPairs": []
     }
   ],
   "ipPermissionsEgress": [
     {