MrkToolsAWS Drift · Self-hosted
Detect the unmanaged resources terraform plan misses, see where definition and reality diverge, and keep a full ledger — console-created resources included. A self-hosted AWS infrastructure ledger that runs in Docker.
git clone https://github.com/MR-TABATA/SyncVey
cd SyncVey
cp .env.example .env
docker compose up -d
Self-hosted · Docker
AWS resources are organized by system, environment (PROD / STG / DEV) and resource. Each environment lists its resources — EC2, RDS, S3, ALB and more — with counts, and an environment with changes shows how many were changed or added.
terraform plan only sees what Terraform already knows. SyncVey calls the AWS API directly through Boto3 and finds resources created by hand in the console. Differences from tfstate come down to the attribute that changed.
Every scan and import records a drift snapshot. A trend chart shows when, and what, started to drift, and each point keeps its field-level diff.
With an S3 backend, set the bucket and key once and state syncs on its own. With a local tfstate, just upload it in the UI.
SyncVey diffs definition against reality at the attribute level and notifies Slack. Set a scan interval and fewer drifts go unnoticed.
Each change is graded by security impact: a security group opened to 0.0.0.0/0 is critical, a tag tweak is low. “Who changed this?” traces the change to the actor via CloudTrail. A weekly Slack briefing is available too.
From each drifted resource, SyncVey walks the reference graph outward and ranks what it can reach by severity and distance, so you fix the change that touches the most first.
A secret that never rotated produces no diff. SyncVey grades the current state instead. It reads only rotation metadata; the secret value is never fetched or stored.
End-of-life runtimes and middleware are flagged per environment. RDS and EKS show extended support (paid), and Lambda shows deprecated, before past end-of-life, using the dates AWS publishes. Works offline from built-in data, with an optional daily refresh from endoflife.date.
Register an application's GitHub repository once and its lockfiles (requirements.txt, package-lock.json, composer.lock, Gemfile.lock, go.mod) are re-imported every day, so each library's publicly known vulnerabilities stay current without anyone touching them. RDS PostgreSQL and MySQL, and ElastiCache Redis and Memcached, engine versions are matched in NVD. You get severity, fixed versions, links, and a mark for what CISA lists as exploited — facts only. Off by default; only the package name and version leave your network.
Track language, framework, deployment method and dependencies per environment (PROD / STG / DEV). Dependencies follow the GitHub repository on their own, every day — a stage environment can point at another branch.
No broad ReadOnlyAccess. A custom IAM policy scoped to the exact read permissions scanning needs ships in the box.
Keep the infrastructure ledger in your own hands.
Free
Self-hosted · Docker
MIT License · Source on GitHub
git clone https://github.com/MR-TABATA/SyncVey
cd SyncVey
cp .env.example .env
docker compose up -d