A self-service AWS dashboard replacing repetitive console work: EC2 lifecycle, security group management, cost estimation and browser-based SSH.
A lot of a systems administrator's day is the same handful of AWS console journeys, repeated. Launch a test box. Open a port so a colleague can reach it. Work out what the estate is costing before someone asks. Get a shell on an instance quickly, which in practice means finding the right key, finding the right IP, and hoping the local SSH client is configured.
None of these are difficult. They are just slow, and the console makes each one a multi-page journey with the important information spread across tabs. The cost of that isn't only time — it's that infrastructure gets created by clicking, so nothing is written down, and a week later nobody can say why an instance exists.
This project collapses those journeys into one page, and makes the creation path go through Terraform so that what gets built is described as code.
List every instance with state, type and public IP. Start, stop and terminate. Provision new instances through a guided modal.
Every provision runs terraform plan first and shows the diff, with add/change/destroy counts and a warning when anything would be destroyed. Runs are async jobs with streamed output.
Cron schedules in any timezone, targeting instances by tag so they survive machines being replaced. Previewable and dry-runnable before they ever fire.
Full create, read, update and delete against live security groups, including editing individual ingress and egress rules.
Month-to-date, last month, a month-end forecast, daily trend, and breakdowns by service and by tag — including what share of spend nobody owns. Cached, because the API bills per request.
Unattached volumes and idle Elastic IPs with a cost attached, untagged and long-lived instances, sensitive ports open to the world, and Terraform drift in both directions.
A WebSocket relay backed by paramiko gives an interactive shell against any running instance, with no local SSH client needed.
Pluggable authentication — local users with argon2 hashes and rotating JWTs, or OIDC bearer tokens validated against an identity provider's JWKS. Three roles enforced server-side.
Every browser SSH session is written to an asciicast file, replayable in the dashboard. Terminal output is captured, not keystrokes — so a password typed at a prompt that suppresses echo is never recorded.
Every state-changing action is written to an append-only log with actor, role, target, source IP and outcome. Denied attempts are recorded too.
182 tests against a mocked EC2, covering role enforcement on every endpoint, token replay, Terraform job rollback, schedule due-time logic, insight false-positive cases, asciicast validity, and Cost Explorer caching. No AWS account needed and nothing is billed.
Two paths reach AWS. Read and lifecycle operations go through boto3 directly, because they are idempotent and need to be fast. Creation goes through Terraform, because it needs to leave a record. The SSH terminal is a third path entirely — the backend holds the paramiko session and relays raw bytes over a WebSocket to xterm.js in the browser.
An ops team on Entra ID or Okta needs OIDC; a small team or a local evaluation needs something that runs offline with no identity provider at all. Both backends produce the same principal object, so routes, the role model and the audit log are written once and do not know which is in use. The cost is one abstraction; the benefit is that the demo runs anywhere and the production path is real rather than aspirational.
The role is in the JWT, so trusting it would save a lookup. But then revoking someone's access does nothing until their token expires — up to fifteen minutes where a demoted or dismissed user still has admin. Reading the role per request makes revocation immediate, which is what anyone auditing the system will actually ask about. Disabling a user revokes their refresh tokens too, so the session cannot be renewed.
A browser cannot set an Authorization header on a WebSocket handshake, and putting a long-lived access token in the query string writes it into every proxy and server log along the path. Instead the authenticated REST API mints a ticket that is single-use, expires in sixty seconds, and is bound to one instance ID. A leaked ticket is worth almost nothing; a leaked access token is worth fifteen minutes of full access.
Recording keystrokes is the obvious implementation and it is the wrong one. It captures the password someone types at a sudo prompt, which turns the recording store into a credential store — the exact thing the feature is supposed to make safer. Recording the output stream instead still shows every command that ran, because the remote echoes what is typed, but a prompt that suppresses echo produces nothing to record. It is a smaller capture that answers the same question, and it means a leaked recording is embarrassing rather than catastrophic. Recordings remain admin-only, size-capped, retention-managed, and reading one is itself an audited event.
Every finding it produces looks obviously safe to auto-remediate and isn't. An unattached volume might be the only copy of something; an instance stopped for a month might be a licence-bound build box; a wide-open port might be deliberate for a public service. A tool that deletes things based on a heuristic gets switched off after the first false positive, and the report loses its value entirely. Recommending keeps it trustworthy, and the estimated monthly cost per finding gives the human a way to prioritise rather than a reason to stop reading.
An apply routinely takes minutes. Holding a request open for that long occupies a worker thread doing nothing and exceeds the idle timeout of most reverse proxies, so the operator sees a gateway error while the apply is still running — the worst possible outcome, because they do not know whether it worked. Runs are jobs: the caller gets an id immediately and polls, output is appended as it is produced, and a failed apply rolls the desired state back so it never claims resources that were not created.
An instance ID is only meaningful until the instance is replaced, and in an estate managed as code they get replaced often. A schedule bound to IDs quietly stops covering things and nobody notices until the bill arrives. Tags survive replacement, so a schedule written once keeps working. The trade-off is that a tag typo matches nothing silently, which is why schedules can be previewed and dry-run before they ever fire.
boto3 already handles start, stop and terminate. Creation is different: an instance that gets created by an API call exists only in AWS, but an instance created through Terraform exists in state, can be planned before it is applied, and can be destroyed cleanly. Shelling out to terraform apply keeps the dashboard from becoming a second, undocumented source of truth for infrastructure.
The browser cannot open a TCP connection to port 22 directly. The backend holds the paramiko session and relays bytes over a WebSocket, which means the private key never leaves the server and the browser never needs an SSH implementation. It also keeps the whole thing self-contained — no third-party terminal service in the path.
They answer different questions. Cost Explorer reports what was actually billed, but it lags by up to a day and charges a cent per API request — so an uncached dashboard polling it every fifteen seconds would cost around $60 a day to tell you what you are spending. The local estimate is a price table keyed on instance type: instantly wrong to the cent, instantly right about whether something is running that shouldn't be. Keeping both means the fast question stays free and the accurate question stays accurate, and neither pretends to be the other.
Cache it, and make the cost of the cache visible. Responses are held for six hours, because Cost Explorer only refreshes a few times a day and anything shorter pays to re-fetch identical numbers. Every response says whether it was served from cache, and the panel shows the running billed-request count and what it has cost. Clearing the cache is an admin action, because refilling it spends money. The failure modes are treated as expected states rather than errors: a missing permission returns 503 naming the exact IAM actions required, and an account where Cost Explorer has not finished initialising says so instead of showing zero.
This is a lab and portfolio project, and some defaults reflect that. They are documented in the repository rather than left to be discovered:
ssh_allowed_cidr variable exists to narrow it.| Frontend | React 18, TypeScript, Vite, Tailwind CSS, shadcn/ui |
| Backend | Python, Flask, flask-cors, flask-sock |
| AWS SDK | boto3 |
| SSH | paramiko over WebSocket |
| Provisioning | Terraform (AWS provider ~> 5.0) |
The full source, setup instructions and API reference are on GitHub.
View repository