Even in shops that live by infrastructure as code, someone eventually opens the AWS Console and clicks. A quick fix during an incident, a security group tweak, a “temporary” instance. That is ClickOps, and it is how drift and silent risk creep into an otherwise clean account.

I built ClickOps Sentinel at zoph.io to catch those moments and, more importantly, to tell me what they actually mean.

Detecting console changes

Detection relies on the CloudTrail sessionCredentialFromConsole flag, which AWS sets server-side for every API call made with console session credentials. No user-agent guessing, no CloudTrail trail to create, no S3 log parsing.

Management write events land on the EventBridge default bus at no extra cost, in seconds. A rule filters for sessionCredentialFromConsole=true and readOnly=false, so you only hear about mutating actions, not someone reading a page.

AI-powered context, not just an alert

A raw “someone changed a security group” ping is noise. Each detection is handed to a Claude agent on Amazon Bedrock before you are notified. The agent:

  1. Retraces the whole console session through CloudTrail LookupEvents (one temporary access key equals one session).
  2. Checks adjacent activity from the same IP.
  3. Consults its long-term memory (Bedrock AgentCore Memory) about the actor.

It then produces a reasoned report:

  • A verdict (manual-change-confirmed, likely-sanctioned-activity, suspicious) with a confidence level.
  • What the user was apparently trying to accomplish.
  • Security implications with a severity rating: privilege escalation, public exposure, weakened defenses, secrets handling.
  • FinOps implications with a rough monthly dollar range, including savings.
  • A session narrative and history context, like “third manual security group change this month”.
  • A recommendation: import into IaC, revert, ask the user, or ignore.

Where the alerts land

Alerts go to Slack or Microsoft Teams through the Amazon Q Developer chat integration, or as a rich HTML email: verdict and confidence pills, security and cost cards, and a console session path diagram showing every step the user took, with the alerted action highlighted.

Here is a real example of the email alert, a manual RunInstances caught mid-session:

ClickOps Sentinel email alert showing the verdict pill, action, cost and security cards, the purpose, and the full console session path with the alerted RunInstances highlighted

Email is sent through an external provider (Resend, Postmark, Mailgun, SendGrid, or plain SMTP), not Amazon SES, so you skip the SES production-access dance. Delivery is guaranteed: if Bedrock is unavailable or the daily token budget is spent, the alert still goes out on a plain, non-AI path.

Try it

ClickOps Sentinel is open source under Apache-2.0, deployed with the AWS SAM CLI. Grab it here: clickops-sentinel.

That’s all, folks! 👋🏼

zoph.