{
  "id": 8328415,
  "title": "AWS tells you something changed. Figuring out what actually happened is another story.",
  "url": "https://urgent.news/2026/09/18/aws-tells-you-something-changed-figuring-out-what-actually-happened",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-18T23:08:30.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ofirbe/aws-tells-you-something-changed-figuring-out-what-actually-happened-is-another-story-2hd7"
  },
  "original_language": "en",
  "account": "When investigating an unexpected change within AWS, the investigation process can be challenging. AWS alerts you to the event, but determining the story behind it can prove difficult. To investigate, you examine CloudTrail to identify who made the change, IAM to comprehend the permissions, Terraform to understand the expected configuration, and GitHub to check whether it originated from a normal deployment. This context switching, which involves piecing together information from various sources, is what initially caused the reporter to question the process. While a single change might be simple, discerning whether it was anticipated, risky, or merely part of a deployment can consume considerably more time than the alert itself. This problem led the reporter to work on a solution called Kultarr. The objective is to consolidate all relevant context: the individual who made the change, the modifications made, the previous state, the affected components, and whether there is any associated Terraform or GitHub activity. The reporter is still grappling with numerous IAM edge cases, particularly in terms of understanding effective access without making incorrect assumptions. A reporter posed the question: when investigating an unexpected change within AWS, which stage typically consumes the most time?",
  "summary": "I kept running into the same problem with AWS. The alert usually isn’t the hard part. The investigation is. An IAM policy changes, a security group gets opened, or a role suddenly has permissions it didn’t have before. AWS gives you the event, but then you still need to figure out the story behind it. You check CloudTrail to see who made the change, IAM to understand the permissions, Terraform to…",
  "key_points": [
    "Investigating unexpected AWS changes is challenging due to context switching.",
    "Kultarr aims to consolidate relevant context for change investigation.",
    "Determining if a change was anticipated, risky, or part of deployment consumes significant time."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}