AWS tells you something changed. Figuring out what actually happened is another story.

AWS tells you something changed. Figuring out what actually happened is another story.

AWS 会告诉你发生了变更，但要弄清楚到底发生了什么，又是另一回事。

I kept running into the same problem with AWS. The alert usually isn’t the hard part. The investigation is. An IAM policy changes, a security group gets opened, or a role suddenly has permissions it didn’t have before. 在使用 AWS 时，我一直遇到同一个问题：收到警报通常不是最难的，难的是后续的调查。比如 IAM 策略发生了变更、安全组被打开，或者某个角色突然拥有了之前没有的权限。

AWS gives you the event, but then you still need to figure out the story behind it. You check CloudTrail to see who made the change, IAM to understand the permissions, Terraform to see what should have been there, and GitHub to check whether it came from a normal deployment. AWS 会提供事件通知，但你仍需弄清楚事件背后的来龙去脉。你需要查看 CloudTrail 来确认是谁做的更改，查看 IAM 来理解权限设置，查看 Terraform 来核对原本的配置，还要查看 GitHub 来确认这是否来自正常的部署流程。

That context switching is what started bothering me. One change can be simple, but understanding whether it was expected, risky, or just part of a deployment can take much longer than the alert itself. 这种频繁的上下文切换让我感到困扰。一个变更可能很简单，但要判断它是预期的、有风险的，还是仅仅属于正常部署的一部分，所花费的时间往往远超处理警报本身。

That’s one of the problems I started working on with Kultarr. The idea is to bring that context together: who made the change, what changed, what existed before, what was affected, and whether there’s related Terraform or GitHub activity. 这就是我开始通过 Kultarr 解决的问题之一。其核心理念是将这些上下文信息整合在一起：谁做的更改、更改了什么、之前是什么状态、受影响的范围，以及是否存在相关的 Terraform 或 GitHub 活动。

I’m still working through a lot of the IAM edge cases, especially around understanding effective access without making assumptions. For people working with AWS: when you investigate an unexpected change, which part usually takes you the most time? 我目前仍在处理许多 IAM 的边缘情况，特别是在不进行假设的前提下准确理解有效访问权限。对于使用 AWS 的同行们：当你们调查意外变更时，通常哪一部分最耗时？