All notable changes to this project are documented in this file.
Based on Keep a Changelog, and this project adheres to Semantic Versioning.
- Security issue in
nanoid.
- Security issue in
js-yaml. - Security issue in
fast-uri. - Security issue in
brace-expansion. - Security issue in
undici. - Security issue in
undici. - Security issue in
undici. - Security issue in
undici. - Security issue in
undici. - Security issue in
postcss. - Security issue in
cryptography.
- Updated Amazon Linux 2023 base image to latest version.
- Updated Node.js container image version from
24.18.0to24.19.0.
- Updated Amazon Linux 2023 base image to latest version.
- Security issue in
brace-expansion. - Security issue in
fast-uri. - Security issue in
fast-uri. - Security issue in
js-yaml. - Security issue in
immutable. - Security issue in
@vitest/browser.
- Updated Amazon Linux 2023 base image to latest version.
- Updated Amazon Linux 2023 base image to latest version.
- Updated Node.js container image version from
24.16.0to24.18.0.
- Security issues CVE-2026-9697 and CVE-2026-9678 in
undici. - Security issue in
form-data. - Security issue in
ws. - Security issue in
js-yaml. - Security issue in
esbuild. - Security issue in
cryptography. - Security issue in
msgpack. - Improved input validation in
getResourcesByCostByDayandgetCostForResourcecost queries.
- Updated Amazon Linux 2023 base image to latest version.
- Migrated
metricstest mocks from the deprecated@mswjs/datato@msw/datav1. - Updated Amazon Linux 2023 base image to latest version.
- Migrated frontend from
react-useto@react-hookz/web. - Updated Amazon Linux 2023 base image to latest version.
- Updated Node.js container image version from
24.15.0to24.16.0.
- Security issue in
fast-xml-builder. - Security issue in
fast-uri. - Security issue in
fast-xml-parser. - Security issue in
postcss. - Security issue in
pip. - Security issue in
pip. - Security issue in
pytest. - Security issue in
urllib3. - Security issue in
urllib3. - Security issue in
cryptography. OrganizationUnitIdparameter now validates against a regex to ensure a valid OU or root ID format is supplied.- Frontend resource pagination adapts to Lambda payload size limits to prevent load failures on large pages.
- Updated Amazon Linux 2023 base image to latest version.
- Updated Node.js container image version from
24.13.1to24.15.0. - Upgraded frontend to React Router v7.
- Upgraded frontend to Vite 8 with the Rolldown bundler.
- WAF exception for
GenericLFI_BODYrule on requests from the discovery process.
- Security issue in
picomatch. - Security issue in
vite. - Security issue in
path-to-regexp. - Security issue in
brace-expansion. - Security issue in
lodash. - Security issue in
handlebars. - Security issue in
serialize-javascript. - Security issue in
pygments. - Security issue in
requests. - Security issue in
cryptography. - Expand/Focus actions failing for compound nodes.
- Flaky browser test screenshots caused by vitest orchestrator scaling.
- Updated Amazon Linux 2023 base image to latest version.
- Security issue in
fast-xml-parser. - Security issue in
flatted. - S3 CORS configuration for Amplify v6 multipart uploads.
- Renamed
.jsfiles containing JSX to.jsxand removed esbuild workaround.
- Security issue in
fast-xml-parser. - Security issue in
flatted. - Security issue in
undici. - Security issue in
@tootallnate/once.
- Updated Amazon Linux 2023 base image to latest version.
- Upgraded frontend from React 18 to React 19.
- Exception for
EC2MetaDataSSRF_BODYrule on requests from discovery process to address false positives causing write failures to Neptune.
- Security issue in
rollup. - Security issue in
fast-xml-parser. - Security issue in
minimatch. - Security issue in
minimatch. - Security issue in
serialize-javascript. - Security issue in
joserfc.
- Updated Amazon Linux 2023 base image to latest version.
- Updated Amplify to v6.
- Discovery task frequency can now be set to intervals of 48 hours, 3 days, and 1 week.
- Reduced Node.js max old space value for discovery process to give more headroom for non-heap allocations.
- Security issue in
cryptography. - Discovery process not launching due to Node version mismatch 642
- Updated Amazon Linux 2023 base image to latest version.
- Added support for Hong Kong (ap-east-1) region
- Security issue in
qs.
- Security issue in
glob.
- Removed AppRegistry integration
- Beta support for rendering diagrams using WebGL, significantly improving the performance of diagrams with thousands of resources.
- Security issue in
form-data.
AWS::EC2::Volume->AWS::EC2::VPC/AWS::EC2::Subnetrelationships
- Workload Discovery ECS tasks failing with AWS Config errors 593
AWS::Bedrock::KnowledgeBaseresource type is now discovered via AWS Config- Update Neptune Engine version to
1.4.5.1.
- New resource types include:
AWS::Bedrock::AgentAWS::Bedrock::AgentVersionAWS::Bedrock::CustomModelAWS::Bedrock::DataSourceAWS::Bedrock::FoundationModelAWS::Bedrock::ImportedModelAWS::Bedrock::InferenceProfileAWS::Bedrock::KnowledgeBaseAWS::Glue::ConnectionAWS::Glue::CrawlerAWS::Glue::DatabaseAWS::Glue::TableAWS::OpenSearchServerless::Collection
- New relationships include:
AWS::Bedrock::Agent->AWS::IAM::Role/AWS::Bedrock::FoundationModel/AWS::Lambda::Function/AWS::KMS::KeyAWS::Bedrock::AgentVersion->AWS::Bedrock::KnowledgeBaseAWS::Bedrock::CustomModel->AWS::Bedrock::FoundationModel/AWS::KMS::Key/AWS::S3::BucketAWS::Bedrock::DataSource->AWS::Bedrock::KnowledgeBase/AWS::KMS::Key/AWS::S3::Bucket/AWS::SecretsManager::Secret/AWS::Lambda::Function/AWS::Bedrock::FoundationModelAWS::Bedrock::ImportedModel->AWS::KMS::Key/AWS::S3::BucketAWS::Bedrock::KnowledgeBase->AWS::IAM::Role/AWS::Kendra::Index/AWS::RDS::DBCluster/AWS::OpenSearchServerless::Collection/AWS::S3::Bucket/AWS::Redshift::ClusterAWS::Glue::Connection->AWS::EC2::Subnet/AWS::EC2::SecurityGroup/AWS::EC2::Instance/AWS::SecretsManager::Secret/AWS::IAM::Role/AWS::Glue::ConnectionAWS::Glue::Crawler->AWS::SQS::Queue/AWS::S3::Bucket/AWS::Glue::Database/AWS::Glue::Connection/AWS::DynamoDB::TableAWS::Glue::Database->AWS::Glue::Connection/AWS::S3::BucketAWS::Glue::Job->AWS::IAM::Role/AWS::S3::Bucket/AWS::Glue::ConnectionAWS::Glue::Table->AWS::Kinesis::Stream/AWS::S3::Bucket/AWS::Glue::Connection/AWS::Glue::Database
- Configuration status section on Cost Page
- Alert in AppInsights dashboard if Config aggregator is of incorrect type
- Updated Homepage with quicklinks to common user actions and configuration status alerts to surface errors in the solution's deployment and their remediation steps
- Accounts in accounts page now display if AWS Config is enabled in imported regions
- Warning displayed on Accounts page in
SELF_MANAGEDmode if regional CloudFormation template is not deployed in imported region - Default Neptune instance type is now
db.r8g.large - Neptune engine version has been updated to
1.4.5.0 - Added extra validation to account names to disallow angle brackets
- Added extra validation for all inputs in Settings AppSync Lambda resovler
- Reduced whitespace on diagram page
- Account name could not be updated through form on Accounts page
- Pagination size in resource table on Resources page is now configurable
- Alert in AppInsights dashboard if discovery process cannot route to required AWS services
- Security issue in
axios. - Security issue in
babel. - Security issue in
esbuild. - Security issue in
jinja. - Security issue in
tsup.
- Discovery process now downloads accounts from Neptune concurrently
- Alert in AppInsights dashboard if discovery process cannot pull image from ECR
- Metrics lambda always sent
falseforcostFeatureEnabledmetric - Invalid default value in
CognitoAttributeMappingCloudFormation parameter - Large dark circle appears in canvas when user saves an empty diagram
- Security issue in
jinja. - Security issue in
cryptography.
- Importing accounts using form is now default setting on Accounts page
- Account lists can now be filtered by account name 514
- Error dialog on resources page now includes link to AppInsights dashboard
- Text for button on diagram page is now Add to diagram rather than Search
- Alert in AppInsights dashboard if discovery process runs out of memory
- Alert in AppInsights dashboard if Config not enabled in discoverable region
- Null pointer error in SAML identity provider custom resource 567
- Incorrect description string in diagram settings filter when hiding resources
- Erroneous validation error when exporting diagrams with global resources to myApplications
- Empty region dropdown list when exporting diagram with only global resources to myApplications
- Security issue in
vite. - Security issue in
vitest. - Security issue in
undici. - Security issue in
jinja. - Security issue in
jinja.
- Use of
FARGATEorFARGATE_SPOTfor discovery process is configurable via a CloudFormation parameter.
- Support for custom identity providers (SAML and OIDC) 61 510
- Export of diagrams to myApplications
- Export of diagrams to SVG
- Application Insights dashboard to monitor health of solution
- Number of supported resource types is over 450, newly added types include, but are not limited to:
AWS::AppSync::DataSourceAWS::AppSync::ResolverAWS::MediaConnect::FlowAWS::MediaConnect::FlowEntitlementAWS::MediaConnect::FlowSourceAWS::MediaConnect::FlowVpcInterfaceAWS::MediaPackage::PackagingConfigurationAWS::MediaPackage::PackagingGroupAWS::ServiceCatalogAppRegistry::Application
- Increase in number of relationships not captured by AWS Config, including, but not limited to:
AWS::AppSync::DataSource->AWS::Lambda::Function/AWS::DynamoDB::Table/AWS::Events::EventBus/AWS::RDS::DBCluster/AWS::OpenSearchService::DomainAWS::AppSync::Resolver->AWS::AppSync::GraphQLApi/AWS::AppSync::DataSourceAWS::S3::Bucket->AWS::Lambda::Function/AWS::SQS::Queue/AWS::SNS::TopicAWS::IAM::InstanceProfile->AWS::IAM::RoleAWS::MediaConnect::FlowEntitlement->AWS::MediaConnect::FlowAWS::MediaConnect::FlowSource->AWS::MediaConnect::Flow/AWS::MediaConnect::FlowEntitlement/AWS::MediaConnect::FlowVpcInterface/AWS::IAM::Role/AWS::SecretsManager::SecretAWS::MediaConnect::FlowVpcInterface->AWS::EC2::VPC/AWS::EC2::Subnet/AWS::EC2::SecurityGroup/AWS::EC2::NetworkInterfaceAWS::MediaPackage::PackagingConfiguration->AWS::MediaPackage::PackagingGroup/AWS::IAM::Role
- Multiple resources can now be selected in the search bar on the Diagram page
- Migrate AppRegistry integration to myApplications for monitoring solution costs and usage.
- Migrate JavaScript lambda functions and the discovery process from CommonJS to ESM
- Update Neptune Engine version to
1.3.1.0. - Update OpenSearch version to
2.11.0.
AWS::EC2::NetworkInterface->AWS::OpenSearchService::Domainrelationships are not discovered- Failed writes to OpenSearch should stop the corresponding write being made to Neptune
- Metrics lambda times out when hundreds of accounts have been imported
- Cron expression for running discovery process every 24 hours. 546
- Security issue in
rollup. - Security issue in
vite. - Security issue in
vite.
- Cron expression for running discovery process every 24 hours. 546
- Intermittent failures in
cleanup-bucketcustom resource. 545 - SCP error relating to
putConfigAggregatorwhen adding accounts in an AWS organisation using Control Tower. 544 - Security issue in
micromatch. - Security issue in
path-to-regexp. - Security issue in
send.
- Security issue in
axios.
- Security issue in
fast-xml-parser.
- Use Amazon Linux 2023 as the base image for the discovery process Docker container
- Restrict egress for Neptune lambda security group to VPC IP address range. 531
- Security issue in
ws. - Add better logging if individual accounts aggregator supplied when cross account discovery mode is
AWS_ORGANIZATIONS. 529
- Removed dev environment CDK build pipeline
- Invalid policy error when deploying Settings resolver nested stack
- Update Node.js runtimes to v20.x
- Update Python runtimes to Python 3.12
- Security issue in
follow-redirects. - Security issue in
vite. - Security issue in
undici. - Security issue in
undici.
- Discovery Process Assumes Root Account Is Management Account 496
- Security issue in
follow-redirects. - Security issue in
vite.
- Rate Limited Exceeded in ORGANIZATIONS mode 478
- Incorrect status displayed for EC2 instances, load balancers, databases and lambda functions 483
- Missing resource type icons 485
- Comma in Service Name Results in Cost Feature sum of account to be 0 489
- "Load Cost" and "Cost Report" buttons are using different time spans by default, but showing the sameone in the UI 490
- Comma in Service Name Results causes GraphQL type error 491
- Frequency at which the scheduled discovery process ECS task runs is now configurable via a CloudFormation parameter.
- Throttle
ListAccountsAPI to prevent rate limiting from stopping the Discovery process discover accounts in large organisation. 478 - Only attempt to discover accounts from provided OU and its children, rather than whole organization.
- Throttle
SelectAggregateResourceConfigAPI to prevent rate limiting from stopping discovery process from reading from the Config aggregator. - Remove Retain on organization-wide StackSet so IAM roles are no longer left in organization's accounts after solution is uninstalled.
- Handle error message difference between AppSync VTL resolvers and JS resolvers that prevented discovery process from retrying requests to DB if payload was too large.
- Move GraphQL queries that queried whole Neptune database to use DynamoDB, significantly reducing load on Neptune and improving rendering times on the frontend.
- Retrieve the following resource types from AWS Config advanced query rather than
ListAggregateDiscoveredResourcesandBatchGetAggregateResourceConfig.AWS::EC2::LaunchTemplateAWS::EC2::TransitGatewayAWS::EC2::TransitGatewayAttachmentAWS::EC2::TransitGatewayRouteTableAWS::Kinesis::StreamAWS::MSK::Cluster
- Ensure OAC name length does not exceed 64 characters. 462
- No longer ingest resources with status
ResourceNotRecorded. - Improve performance of
getResourceChangesfunction in Discovery process from O(n2) to O(n). - Retrieve account metadata on frontend in batches of 50.
- AppRegistry integration to monitor application costs and usage.
- Integration with Organizations. Customers can install the solution in a delegated admin account (recommended) or the management account and the solution will use an organization wide config aggregator to discover resources across their organization. 1
- Pipeline for local development of the solution.
- Support for deploying this solution in an existing VPC. 169
- Support for deploying this solution with Neptune Serverless. 314
- UI now indicates if global resources template has been deployed in target accounts. 367
- Support for more resource types now totalling over 250.
- Migrated from the deprecated awsui frontend framework to Cloudscape.
- Export of diagrams to JSON 426
- Export of diagrams to draw.io 329
- Outdated OpenSSL package being used 424
- Response payload size exceeding maximum allowed payload size 351
- Publishing name instead of ARN of resources 330
- CSV report of the Resources does not include ARN 407
- Added ObjectOwnership property to S3 buckets in accordance with new bucket ACL changes.
- Updated aws-sdk version to get around this xml2js vulnerability.
- Pagination size in discovery process could lead to maximum allowed payload errors 331
- AWS Config throttling stopped resources not supported by advanced query being discovered 332
- Null errors when adding relationships for
AWS::Lambda::Function,AWS::ECS::Task,AWS::AutoScaling::AutoScalingGroupandAWS::RDS::DBInstanceresource types 333 - Permission errors when decrypting encrypted lambda functions broke batch lambda relationship discovery 334
- Removing last account caused an AWS Config error and stopped account being removed 315
- Pagination size in discovery process could lead to maximum allowed payload errors 316
- Specifying
neptune1family parameter group broke Neptune stack deployment scripts 320 - Inconsistent return type from AWS Config for tags broke tag creation
- Solution now ingests all resource types supported, as well as the following resource types
AWS::APIGateway::ResourceAWS::APIGateway::MethodAWS::APIGateway::AuthorizerAWS::IAM::InlinePolicyAWS::IAM::ManagedPolicyAWS::ECS::TaskAWS::EKS:::NodeGroupAWS::ElasticLoadBalancingV2::TargetGroupAWS::Cognito::UserPoolAWS::EC2::SpotAWS::EC2::SpotFleet
- Large increase in number of relationships not captured by AWS Config, including, but not limited to:
- Lambda -> SNS/SQS/Kinesis/MSK/EFS
- AWS::APIGateway::Authorizer -> Cognito User Pool
- CloudFront -> ELB/ELBv2
- SecurityGroup -> SecurityGroup
- ELBv2 -> ELBv2 Listener -> ELBv2 Target Group -> ASG
- ECS Task -> EFS
- EKS Cluster -> NodeGroup/VPC/Subnet/SecurityGroup/IAM Role
- EKS NodeGroup -> ASG/VPC/Subnet/SecurityGroup/IAM Role/Launch Template
- Transit Gateway -> VPC/Subnet
- New UI:
- Uses Cloudscape Design System to make look and feel more consistent
- Migrated from modal dialogs to React router for page management
- New Views feature to allow users to scope searches to only resource types they are interested in
- Filters in UI now operate on a per diagram basis, rather than globally
- Discovery process can now discover regions with tens of thousands of resources
- Migrated all backend APIs using API Gateway to AppSync
- Streamlined CloudFormation templates to improve reliability and deployment time
- Use official node.js Docker container for Discovery process ECS task
- Cost calculation bug due to UI using incorrect date
- Missing icons for EC2 types and a few others
- Cost calculations to query on resourceIds as well as ARNs. 231
- Drawio export bug that was causing diagrams with collapsed nodes to cause an error. 219
- Hover over box when hovering over a resource it was going outside the screen. 220
- Slow deployment step that uploads files to S3. Increase maxSockets in HTTPS agent within the Lambda.
- Amazon OpenSearch Service to discovery process Config queries.
- Limiting the date pickers to select dates in the past. To limit confusion around the cost data Perspective displays.
- Fixed permissions errors preventing in-place upgrades.
- Fixed a bug causing Amazon Elasticsearch Service costs to be missed out when calculating estimated workload costs 216.
- Fixed a bug causing cost query date not to update in the overview component.
- Missing icons for MariaDB, Aurora, SQL-Server RDS types.
- OpensearchMultiAz parameter to CloudFormation template to set Amazon OpenSearch Service up with a single instance.
- Migrated from Lambda@Edge to CloudFront Functions to handle secure headers for web requests to the frontend.
- References to Amazon Elasticsearch Service to Amazon OpenSearch Service
- Fixed a bug causing a blank screen when expanding nodes whilst filters are enabled 201
- Fixed a bug that meant the time period for cost report queries was not persisted 200
- Fixed a bug that could result in python files being incorrectly excluded 64
- A bug causing some resource types to throw an exception when clicking "Show more details"
- Support for newer ECS task ARNs
- Version number to UI side panel to show which version of Perspective is deployed.
- Ability to select Elasticsearch instance type on deploy (#53)
- Ability to update Perspective in-place rather than re-installing (#86)
- Support for Redshift resources
- Upload a CSV containing Regions during the import process
- "Costs & Usage" component in the UI.
- "Cost report" option on the canvas to see a breakdown of the costs for a workload
- Fix API Gateway logging issue (#81)
- Fix access log bucket deletion issue (#30)
- Fix filters issue (#46)
- Fix lambda layer files that were erroneously in .gitignore (#64)
- Fix unnecessary ConfigAggregator deployment in account import template (#73)
- Fix API Gateway logging issue (#81)
- Show resource names instead of IDs where possible (#90)
- Fixed README examples for using the API (#92)
- Fixed cost bucket not being removed on deletion (#97)
- Fixed Docker Hub rate limit for downloading images. (#93)
- Enable buildspec.yaml customization (#111)
- Fix IAM permissions when checking for duplicate ECS tasks (#112)
- Increased zoom on canvas to visualize larger diagrams
- Cost data is now retrieved from a new API that queries Cost and Usage Reports via Athena (manual steps to set up are still required)
- Improved the "Getting started" wizard to help new users.
- Improved filtering to allow user to include or exclude resources of a certain type.
- Added 'Save Template' option when importing new accounts and Regions. This removes the need to enable public access objects in the AmplifyStorageBucket
- Altered wording around visibility levels when saving architecture diagrams. 'You' and 'All users' is now used instead of 'public' and 'private'.
- Fixed bug that was causing import configurations to become corrupt when an account or Region was deleted by the UI if a discovery was in progress.
- Fixed bug leading to invalid JSON being generated in CloudFormation templates for importing accounts and Regions.
- Fixed Dependabot issues raised by GitHub
- Fixed bug leading to RestApi icons not being displayed in Firefox.
- Added support for Amazon QLDB Ledgers.
- Updated README.
- Initial release