Skip to content

Changelog

This page is a copy of CHANGELOG.md in the repository, which is the source of truth. Edit that file, not this one. At each release, regenerate the copy: keep this header, replace everything below it with CHANGELOG.md without its first line, and change links that start with docs/ to relative links.

All notable changes to this project are documented here. The format follows Keep a Changelog and the project uses semantic versioning.

[0.1.0] - Unreleased

Added

  • Credentials for every common method: --profile (repeatable), --role-arn (repeatable) with --external-id, --mfa-serial and --mfa-token, --session-duration and --role-session-name, with the matching variables VPCATLAS_EXTERNAL_ID, VPCATLAS_SESSION_DURATION and VPCATLAS_ROLE_SESSION_NAME. Access keys come only through the standard chain (environment, shared files, SSO, instance, task and pod roles); there is no flag for a secret key.
  • A documentation site (mkdocs.yml, make docs) published at https://vpcatlas.com/docs/.
  • Three distributions, each with the dashboard: a one-file binary for Linux, macOS and Windows (PyInstaller, attached to the GitHub Release with SHA256SUMS, installed by scripts/install.sh), the Python package on PyPI and the image vpcatlas/vpcatlas on Docker Hub. The image entrypoint is now vpcatlas and its default command is serve. python -m vpcatlas runs the CLI, and vpcatlas serve reads VPCATLAS_REFRESH_SECONDS.
  • Service layer of the model (model.md): Route 53 hosted zones, CloudFront distributions, WAFv2 web ACLs, ACM certificates, Shield, API Gateway APIs and VPC links, target groups, ECS clusters and services, EKS clusters, EC2 instance groups (Auto Scaling group or Name tag), RDS and Aurora, ElastiCache, EFS, Lambda, S3, DynamoDB and the account services (CloudTrail, GuardDuty, Config, CloudWatch, KMS, ECR), with the edges serves, origin, protects, secures, integrates, targets, attaches and mounts. The registry has an icon, a caption, a Lucid class and an edge style for each, and three flows of their own for the service pages. The MALZ fixture carries the services of the Application account.
  • Edge collectors (Route 53 records, CloudFront distributions, WAFv2 web ACLs, ACM certificates and Shield): read-only calls listed in docs/iam.md.
  • Compute collectors (target groups, ECS, EKS, EC2 instance groups, Lambda and API Gateway): read-only calls listed in docs/iam.md.
  • Data store collectors (RDS and Aurora, ElastiCache, EFS, S3 and DynamoDB): read-only calls listed in docs/iam.md.
  • Account service collectors (CloudTrail, GuardDuty, Config, CloudWatch, KMS and ECR): read-only calls listed in docs/iam.md.
  • VPC-level pages (--level vpc|all, default all): one page per VPC with its route tables (routes and associations), network ACLs and security groups beside the subnets, next to the account-level pages.
  • Numbered flow discs in one colour per flow, repeated along the route; VPCs and accounts packed by aspect.
  • A /diff/{old}/{new} view in the dashboard, with the changed boxes and edges highlighted on the same draw.io file that /export/diff/{old}/{new}/{page}.drawio returns.
  • Lines run behind icons: an edge that crosses an icon it does not end in is cut at the outline of the icon instead of bending around it; icons outside the subnets get a white backing and caption.
  • Read-only discovery of VPCs, subnets, route tables, internet and NAT gateways, Transit Gateways and attachments, VPC peering, VPN and Direct Connect, VPC endpoints, load balancers, Network Firewall, Route 53 Resolver and RAM shares.
  • Cross-account detection through owner ids, peering accepter and requester ids and RAM shares, with external accounts shown in the diagrams and the inventory.
  • Inventory output in JSON (versioned schema), Markdown and HTML.
  • draw.io and Lucid Standard Import diagrams with AWS Architecture Icons styling, one per region plus a global Transit Gateway and peering diagram.
  • vpcatlas CLI: discover, inventory, diagram, serve and iam-policy.
  • FastAPI dashboard with periodic refresh (VPCATLAS_REFRESH_SECONDS), in-memory cache and export routes.
  • Container image, Lambda handler (Mangum), Kubernetes and ECS deployment files, minimal auditor IAM policy.