isostat

Production-grounded evidence for infrastructure changes.

For every proposed Terraform change, Infrared reads what is actually running in your AWS account and reports which live resources the change touches, which of them are carrying traffic right now, who owns them, and which past incidents involved them.

Every claim cites an identifier you can check yourself. There is no risk score, no verdict, and no "safe to merge" — those are judgements the evidence does not support, and one wrong one costs more trust than ten right ones earn.

Install

Nothing to install. Node 18+ and:

npx isostat --help

Connect your AWS account

Create an API key in the console under Settings → API keys, then:

export INFRARED_API_KEY=irk_live_…

npx isostat connect

That prints the exact trust policy to create, with your organisation's external ID already filled in. Once the role exists:

npx isostat connect --role-arn arn:aws:iam::<your-account>:role/infrared-readonly

We assume the role and read your account before reporting success. A saved ARN is what you told us; only the verification is a fact.

Optional, and each one switches on a specific finding:

--cloudtrail-bucket <bucket>   who is using an IAM role, and deletion safety
--flowlog-group <log group>    security group traffic
--change-feed-queue <sqs url>  keeps our view fresh between sweeps

Left unset, that collector never starts, no coverage is recorded for it, and the claims resting on it are refused rather than guessed.

In CI

terraform plan -out tfplan
terraform show -json tfplan > tfplan.json

npx isostat assess

Repository, pull request and commit are read from the usual CI environment variables. The evidence pack is posted to the pull request and linked from the output.

It never fails your build

If Infrared is down, or cannot assess a change, the CLI says so and exits 0. The product assists the review and blocks nothing, and that has to hold when we are the thing that is broken.

Commands

| | | |---|---| | npx isostat connect | Print the AWS role to create, with your external ID | | npx isostat connect --role-arn <arn> | Submit it; we assume the role and read the account | | npx isostat assess | Submit a Terraform plan, print where the pack landed | | npx isostat whoami | What this key is connected to, and which signals are live |

Environment

| | | |---|---| | INFRARED_API_KEY | Required. Create one in the console | | INFRARED_API_URL | Defaults to https://platform.isostat.xyz | | INFRARED_PLAN | Path to the plan JSON. Defaults to tfplan.json |

Dependencies

None. It is one file of Node with no build step, because everything it does is an HTTP call and some printing — a bundler and a dependency tree would be more moving parts than the program.