pike VS inframap

‍Pike is a tool that analyzes Terraform managed resources and automatically generates the necessary IAM permissions, improving security by ensuring that only the minimum necessary permissions are granted.

I test out the Api the hard way, I make a resource and test it with a role that doesnt have the permissions (see the folder i linked), the Api (with azure anyway) tells you what you lack, azure tends to be simpler with crud permissions than aws. I then have another privilege tole that can update the first with each permission and iterate: https://github.com/JamesWoolfenden/pike/tree/master/terraform/azurerm, i then create the mapping file for that resource and add it. I can show you if you need help - send me an email/message/zoom. If you figure a better way i'm all ears, but this way I can be sure on what permissions are required.

You can run my tool pike on your tf to generate iam for aws and gcp. Get it here https://github.com/jamesWoolfenden/pike

I wrote a small tool called Pike. It looks at your TF code and determines and create the IAM policy/Tf resource required to build it. To help you stick to least privilege in your build process. It currently supports a small but growing sub-set of AWS resources, it will support other providers. Use it or ?, but would welcome feedback https://github.com/JamesWoolfenden/pike . Its open source and always will be.

Like Blast Radius, InfraMap generates visual graphs of your infrastructure based on Terraform state or configurations, offering a visual overview of your infrastructure, which is especially helpful for large and complex environments.

We also contribute to the open-source community with projects like InfraMap, that generate your infra diagram on the fly based on your tfstate or the most famous TerraCognita, a reverse Terraform.

Pretty cool. The biggest thing I think is missing from many popular diagramming tools is the ability to easily diff the architecture across changes. Although that can already be done with graphviz source files.

However, these days I prefer to just have diagrams generated from the source code itself, like:

- https://github.com/cycloidio/inframap

- https://graphviz.org/Gallery/directed/bazel.html

In order to make a compelling use case out of having to maintain a parallel definition like this, I think it needs to be able to contribute to analysis like formal verification or, despite them stating that it's not a goal, being able to create the described architecture. Or even generate something like a terraform plan. Otherwise it falls victim to the same problem as any other method of creating diagrams, that of them falling out of sync with the system.

They are a long way there already by providing a way to use a programming language backed by a large ecosystem of other tools that can be used to work with e.g. terraform, like python/go.

I used https://github.com/cycloidio/inframap last week, was a good experience for me

Inframap reads your tfstate or HCL to generate a graph specific for each provider, showing only the resources that are most important/relevant.

Also if you want to easily visualize your HCL or TFState we did https://github.com/cycloidio/inframap which will allow you to visualize those in a more easy/readable way than just JSON.