AI Tracker

Objective

Track how long it takes and how much it costs to create projects with AI 🤖 in an attempt to optimize progress. Note that I have only been using Opus 6 and 8 same price per token. I have been trying to log my time but there are some gaps where I was working but making no progress because I'm fixing things that are broken or reworking code. Part of the rework is the model failing write the code as specifed. Part of it is my rearchitecting my data model after testing. See notes for details and time tracking file where I've strated tracking some (not all) rework.

Status Legend

Status	Description
🟢	Done
🟡	Broken
🔴	Not attempted

Tracker Diagram Generated By Application

This is just the particular configuration I'm tesing. The configuration supports any AWS resources and account structure.

~~ Right now the reoprting below is a bit messed up so what is shown below is no longer accurate. I'll update it shortly. As explained on social media and in the details of the mistakes, fixed, and time tracking mds, I'm revamping the architecture to overcome some concurrency issues. I've pretty much fixed the concurrency issues and tracker diagram creation - though I have some slowness to address. Though it's "working" to some degree, I have to fix a role assumption issue (mfa v no mfa before trust policy is updated), diagram slowness, an eternal loop on certain resources, and the individual resource issues). More in mistakes.md. I'll update this hoepfully shortly.

=========================================
 xxxxxx: Deploy Diagram
=========================================
🟡 org: xxxxxxx (xxxxxxxx)
|
|     Organization Resources:
|____ 🟢 Organization (xxxxxxxx)
|____ 🟢 Enable All Features (xxxxxxxx)
|____ 🟢 Deny-All OU (xxxxxxxx)
|____ 🟢 SCP Require IMDSv2 (xxxxxxxx)
|____ 🟢 SCP Deny Leave Org (xxxxxxxx)
|____ 🟢 SCP Allowed Regions (xxxxxxxx)
|
|____ 🟡 env: manage
|     |
|     |     Environment Resources:
|     |____ 🟢 OU (xxxxxxxx)
|     |____ 🟢 SCP Deny External (xxxxxxxx)
|     |
|     |____ 🟢 account: manage-iam (xxxxxxxx)
|     |     |
|     |     |     Resources:
|     |     |____ 🔴 Move account to OU
|     |     |____ 🟢 Account alias (xxxxxxxx)
|     |     |____ 🟢 Xadmin role (xxxxxxxx)
|     |     |____ 🟢 Iadmin role (xxxxxxxx)
|     |     |____ 🟢 Oadmin role (xxxxxxxx)
|     |     |____ 🟢 Account Budget (xxxxxxxx)
|     |     |____ 🟢 Delete default VPCs (xxxxxxxx)
|     |     |
|     |     |____ region: us-east-2
|     |           |     Resources:
|     |           |____ 🟢 iadmin-user (xxxxxxxx)
|     |           |____ 🟢 xadmin-user (xxxxxxxx)
|     |
|     |____ 🟢 account: manage-kms (xxxxxxxx)
|     |     |
|     |     |     Resources:
|     |     |____ 🔴 Move account to OU
|     |     |____ 🟢 Account alias (xxxxxxxx)
|     |     |____ 🟢 Xadmin role (xxxxxxxx)
|     |     |____ 🟢 Iadmin role (xxxxxxxx)
|     |     |____ 🟢 Oadmin role (xxxxxxxx)
|     |     |____ 🟢 Account Budget (xxxxxxxx)
|     |     |____ 🟢 Delete default VPCs (xxxxxxxx)
|     |     |
|     |     |____ region: us-east-2
|     |           |     Resources:
|     |           |____ 🟢 kms-logs-key (xxxxxxxx)
|     |           |____ 🟢 kms-auth-key (xxxxxxxx)
|     |           |____ 🟢 kms-jobs-key (xxxxxxxx)
|     |           |____ 🟢 kms-secrets-key (xxxxxxxx)
|     |           |____ 🟢 kms-config-key (xxxxxxxx)
|     |
|     |____ 🟢 account: manage-security (xxxxxxxx)
|     |     |
|     |     |     Resources:
|     |     |____ 🟢 Delegate Security Hub admin (xxxxxxxx)
|     |     |____ 🟢 Delegate GuardDuty admin (xxxxxxxx)
|     |     |____ 🟢 Delegate CloudTrail admin (xxxxxxxx)
|     |     |____ 🟢 Delegate AWS Config admin (xxxxxxxx)
|     |     |____ 🟢 Delegate Macie admin (xxxxxxxx)
|     |     |____ 🟢 Delegate Inspector admin (xxxxxxxx)
|     |     |____ 🟢 Delegate IAM Access Analyzer admin (xxxxxxxx)
|     |     |____ 🟢 Delegate Audit Manager admin (xxxxxxxx)
|     |     |____ 🟢 Delegate Health admin (xxxxxxxx)
|     |     |____ 🟢 Delegate Detective admin (xxxxxxxx)
|     |     |____ 🟢 Configure GuardDuty (xxxxxxxx)
|     |     |____ 🟢 Configure CloudTrail (xxxxxxxx)
|     |     |____ 🟢 Configure AWS Config (xxxxxxxx)
|     |     |____ 🟢 Configure Macie (xxxxxxxx)
|     |     |____ 🟢 Configure Inspector (xxxxxxxx)
|     |     |____ 🟢 Configure IAM Access Analyzer (xxxxxxxx)
|     |     |____ 🟢 Configure Security Alerts (xxxxxxxx)
|     |     |____ 🟢 Move account to OU (xxxxxxxx)
|     |     |____ 🟢 Account alias (xxxxxxxx)
|     |     |____ 🟢 Xadmin role (xxxxxxxx)
|     |     |____ 🟢 Iadmin role (xxxxxxxx)
|     |     |____ 🟢 Oadmin role (xxxxxxxx)
|     |     |____ 🟢 Account Budget (xxxxxxxx)
|     |     |____ 🟢 Delete default VPCs (xxxxxxxx)
|     |     |
|     |     |____ region: us-east-2
|     |           |     Resources:
|     |           |____ 🟢 s3-log-bucket (xxxxxxxx)
|     |           |____ 🟢 configure-security-hub (xxxxxxxx)
|     |           |____ 🟢 s3-log-bucket-policy (xxxxxxxx)
|     |
|     |____ 🟢 account: manage-org (xxxxxxxx)
|     |     |
|     |     |     Resources:
|     |     |____ 🟢 Org resource policy (xxxxxxxx)
|     |     |____ 🟢 Move account to OU (xxxxxxxx)
|     |     |____ 🟢 Account alias (xxxxxxxx)
|     |     |____ 🟢 Xadmin role (xxxxxxxx)
|     |     |____ 🟢 Iadmin role (xxxxxxxx)
|     |     |____ 🟢 Oadmin role (xxxxxxxx)
|     |     |____ 🟢 Account Budget (xxxxxxxx)
|     |     |____ 🟢 Delete default VPCs (xxxxxxxx)
|     |     |
|     |     |____ region: us-east-2
|     |           |     Resources:
|     |           |____ 🟢 delegate-org-admin (xxxxxxxx)
|     |
|     |____ 🟢 account: manage-accounting (xxxxxxxx)
|     |     |
|     |     |     Resources:
|     |     |____ 🟢 Delegate Cost Optimization Hub admin (xxxxxxxx)
|     |     |____ 🟢 Delegate Compute Optimizer admin (xxxxxxxx)
|     |     |____ 🟢 Move account to OU (xxxxxxxx)
|     |     |____ 🟢 Account alias (xxxxxxxx)
|     |     |____ 🟢 Xadmin role (xxxxxxxx)
|     |     |____ 🟢 Iadmin role (xxxxxxxx)
|     |     |____ 🟢 Oadmin role (xxxxxxxx)
|     |     |____ 🟢 Account Budget (xxxxxxxx)
|     |     |____ 🟢 Delete default VPCs (xxxxxxxx)
|     |     |
|     |     |____ region: us-east-2
|     |           |     Resources:
|     |
|     |____ 🟢 account: manage-ipam (xxxxxxxx)
|     |     |
|     |     |     Resources:
|     |     |____ 🟢 Delegate IPAM admin (xxxxxxxx)
|     |     |____ 🟢 IPAM (xxxxxxxx)
|     |     |____ 🟢 Delegate Network Manager admin (xxxxxxxx)
|     |     |____ 🟢 Delegate VPC Reachability Analyzer admin (xxxxxxxx)
|     |     |____ 🟢 Delegate Firewall Manager admin (xxxxxxxx)
|     |     |____ 🔴 Move account to OU
|     |     |____ 🟢 Account alias (xxxxxxxx)
|     |     |____ 🟢 Xadmin role (xxxxxxxx)
|     |     |____ 🟢 Iadmin role (xxxxxxxx)
|     |     |____ 🟢 Oadmin role (xxxxxxxx)
|     |     |____ 🟢 Account Budget (xxxxxxxx)
|     |     |____ 🟢 Delete default VPCs (xxxxxxxx)
|     |     |
|     |     |____ region: us-east-2
|     |           |     Resources:
|     |
|     |____ 🟡 account: manage-kiro (xxxxxxxx)
|           |
|           |     Resources:
|           |____ 🔴 kiro-cli-identity-center
|           |____ 🔴 Move account to OU
|           |____ 🟢 Account alias (xxxxxxxx)
|           |____ 🔴 Xadmin role
|           |____ 🟡 Iadmin role (error)
|           |     ↳ ERROR: exit-conditions.sh failed for iadmin-role. [...renamed account problem]
|           |____ 🟡 Oadmin role (error)
|           |     ↳ ERROR: deployment of oadmin-role failed. [...renamed account problem]
|           |____ 🟡 Account Budget (error)
|           |     ↳ ERROR: deployment of account-budget failed.[...renamed account problem]
|           |____ 🟢 Delete default VPCs (xxxxxxxx)
|           |
|           |____ region: us-east-2
|                 |     Resources:
|
|____ 🟡 env: backup
|     |
|     |     Environment Resources:
|     |____ 🔴 OU
|     |____ 🔴 SCP Deny External
|     |
|     |____ 🟡 account: backup-work-test (xxxxxxxx)
|     |     |
|     |     |     Resources:
|     |     |____ 🟢 Delegate Backup admin (xxxxxxxx)
|     |     |____ 🔴 Move account to OU
|     |     |____ 🟡 Account alias (error)
|     |     |     ↳ ERROR: Failed to list aliases
|     |     |____ 🟡 Xadmin role (error)
|     |     |     ↳ ERROR: deployment of xadmin-role failed. [...renamed account problem]
|     |     |____ 🟡 Iadmin role (error)
|     |     |     ↳ ERROR: deployment of iadmin-role failed. [...renamed account problem]
|     |     |____ 🟡 Oadmin role (error)
|     |     |     ↳ ERROR: exit-conditions.sh failed for oadmin-role. [...renamed account problem]
|     |     |____ 🟡 Account Budget (error)
|     |     |     ↳ ERROR: deployment of account-budget failed. org=o-vif30ez4ew env=backup account=backup-work-test 
|     |     |       resource=account-budget action=deploy [...renamed account problem]
|     |     |____ 🟡 Delete default VPCs (error)
|     |     |     ↳ ERROR: deployment of delete-default-vpcs failed. o[...renamed account problem]
|     |     |
|     |     |____ region: us-east-2
|     |           |     Resources:
|     |           |____ 🔴 backup-work-test
|     |           |____ 🟡 kms-backup-key (error)
|     |           |     ↳ ERROR: parallel run aborted: [...renamed account problem]
|     |
|     |____ 🔴 account: backup-manage
|           |
|           |     Resources:
|           |____ 🔴 Move account to OU
|           |____ 🔴 Account alias
|           |____ 🔴 Xadmin role
|           |____ 🔴 Iadmin role
|           |____ 🔴 Oadmin role
|           |____ 🔴 Account Budget
|           |____ 🔴 Delete default VPCs
|
|____ 🔴 env: deny-all
|     |
|     |     Environment Resources:
|     |____ 🔴 SCP Always Denied Actions
|     |____ 🔴 OU
|     |____ 🔴 SCP Deny External
|
|____ 🔴 env: work-test
      |
      |     Environment Resources:
      |____ 🔴 OU
      |____ 🟢 SCP Deny External (xxxxxxxx)
      |
      |____ 🟢 account: work-test-iam
      |     |
      |     |     Resources:
      |     |____ 🔴 Iadmin user
      |     |____ 🔴 Move account to OU
      |     |____ 🔴 Account alias
      |     |____ 🟢 Xadmin role (xxxxxxxx)
      |     |____ 🟢 Iadmin role (xxxxxxxx)
      |     |____ 🔴 Oadmin role
      |     |____ 🔴 Account Budget
      |     |____ 🔴 Delete default VPCs
      |     |
      |     |____ region: us-east-2
      |           |     Resources:
      |           |____ 🟢 xadmin-user (xxxxxxxx)
      |
      |____ 🔴 account: work-test-kms
      |     |
      |     |     Resources:
      |     |____ 🔴 KMS Secrets Key
      |     |____ 🔴 Move account to OU
      |     |____ 🟢 Account alias (xxxxxxxx)
      |     |____ 🔴 Xadmin role
      |     |____ 🔴 Iadmin role
      |     |____ 🔴 Oadmin role
      |     |____ 🔴 Account Budget
      |     |____ 🔴 Delete default VPCs
      |     |
      |     |____ region: us-east-2
      |           |     Resources:
      |           |____ 🟢 kms-jobs-key (xxxxxxxx)
      |           |____ 🔴 kms-ami-key
      |
      |____ 🔴 account: work-test-network
      |     |
      |     |     Resources:
      |     |____ 🔴 Move account to OU
      |     |____ 🔴 Account alias
      |     |____ 🔴 Xadmin role
      |     |____ 🔴 Iadmin role
      |     |____ 🔴 Oadmin role
      |     |____ 🔴 Account Budget
      |     |____ 🔴 Delete default VPCs
      |     |
      |     |____ region: us-east-2
      |           |     Resources:
      |           |____ 🟢 remote-access-prefix-list (xxxxxxxx)
      |           |____ 🔴 auth-vpc
      |           |____ 🔴 work-vpc
      |           |____ 🔴 honeypot-vpc
      |           |____ 🔴 backup-vpc
      |           |____ 🟢 ipam-pool (xxxxxxxx)
      |           |____ 🟢 vpc-flow-logs-role (xxxxxxxx)
      |           |____ 🔴 jobs-vpc
      |
      |____ 🔴 account: work-test-ami
      |     |
      |     |     Resources:
      |     |____ 🔴 Move account to OU
      |     |____ 🔴 Account alias
      |     |____ 🔴 Xadmin role
      |     |____ 🔴 Iadmin role
      |     |____ 🔴 Oadmin role
      |     |____ 🔴 Account Budget
      |     |____ 🔴 Delete default VPCs
      |     |
      |     |____ region: us-east-2
      |           |     Resources:
      |           |____ 🔴 collab-ami
      |           |____ 🔴 base-ubuntu-ami
      |           |____ 🔴 share-amis-to-ou
      |           |____ 🔴 base-amazon-linux-ami
      |           |____ 🔴 share-ami
      |
      |____ 🟢 account: work-test-repo
      |     |
      |     |     Resources:
      |     |____ 🔴 Move account to OU
      |     |____ 🔴 Account alias
      |     |____ 🔴 Xadmin role
      |     |____ 🔴 Iadmin role
      |     |____ 🔴 Oadmin role
      |     |____ 🔴 Account Budget
      |     |____ 🔴 Delete default VPCs
      |     |
      |     |____ region: us-east-2
      |           |     Resources:
      |           |____ 🟢 code-commit-repository (xxxxxxxx)
      |
      |____ 🔴 account: work-test-domains
      |     |
      |     |     Resources:
      |     |____ 🔴 Move account to OU
      |     |____ 🔴 Account alias
      |     |____ 🔴 Xadmin role
      |     |____ 🔴 Iadmin role
      |     |____ 🔴 Oadmin role
      |     |____ 🔴 Account Budget
      |     |____ 🔴 Delete default VPCs
      |
      |____ 🔴 account: work-test-project-alnzbinsdvnasaosfil
            |
            |     Resources:
            |____ 🔴 Move account to OU
            |____ 🔴 Account alias
            |____ 🔴 Xadmin role
            |____ 🔴 Iadmin role
            |____ 🔴 Oadmin role
            |____ 🔴 Account Budget
            |____ 🔴 Delete default VPCs
            |
            |____ region: us-east-2
                  |     Resources:
                  |____ 🔴 work-test-project-alnzbinsdvnasaosfil

Status Summary

Status	Description
🟢	Configure Reosurce Types
🟢	Organization
🟡	Deploy Environment & Resources
🟡	Verify Environment & Resources
🟡	Delete Environent & Resources
🔴	Manage Drift
🟡	Packaged Code
🟡	QA
🔴	Code Review
🔴	Security Testing

Token / Credit Usage

Usage Dates	Plan	% usage	charges	days	cost per day
June 1 - 12	$200 plan	100%	$83	12	$6.92
June 13 - 17 9:00 pm	$200 plan	100%	$67	4	$16.75
June 17 9:16PM - 23 3:00 AM	$200 plan	100%	$120	6	$20
June 24 - 28 2:15 AM	$200 plan	100%	$134.16	4	$33.54
June 30 - July 1	partial $200 plan	?	$53.55	< 1	$53.55

Total Kiro charged for June: $457.71

Note that I started a new $200 plan on the last day of June presumably a few hours before the UTC rollover time and the balance between what I was billed the full month and what I was billed prior to that was $53.55. Which equates to something like $20 per hour of churning nonsense since the models were going haywire at that point and didn't accomplish the current objective I was working on and was getting tons of noops. this was right after Fable came out. Happens every time a new Anthropic model comes out whether I have access to it or not.

Usage Dates	Plan	% usage	charges	days	cost per day
July 1 - 2 4:00 AM	$200 plan	100%	$12.90	2	$6.45
July 2 - July 3	$200 plan	100%	$181	2	$90.5

I stopped posting here. I'm using a $200 plan about every 2 days now. I think I've spent another $200. Up to $1000 for the mont and it's July 10th. Still not done.

Support this research

If you want to support of follow this research consider becoming a paid subscriber on my substack technology and security research blog. Paid subscribers can add comments and see the archives. Founding members can ask questions (i.e. consulting or training). You can also just sign up for free - no worries! All are welcome and appreciated. 🩵

https://teriradichel.substack.com

Project Objective: AWS Bootstrap Script for AI Agent Environment

Build a script to deploy, delete, and test an AWS environment to securely run AI agents. Specifically I want to segregate my security testing, development, production, and management environments. The framework also sets up my organization with monitoring including budgets and security services used by delegated administrators (Guard Duty, etc.)

The whole point of this is to be able to quickly spin up and tear down environments for projects. As for agents I want to be able to quickly deploy new ideas. That is in part achieved by my job framework which is the follow-on project to this one, but I need first and foremost to have the secure base infrastructure in which to deploy my agent framework and agent resources.

I also spin up separate environments for each penetration test so one test cannot affect another. If I am running AI agents in an environment and they mess it up, I can tear down the whole environment and rebuild it easily. In addition, it ensures that my agents cannot affect production resources with proper security boundaries. When something is deployed incorrectly or I have a billing issue I cannot fix, I can tear down the environment to stop the building and build a new one.

A full series on what I am developing in this project can be found here:

https://teriradichel.substack.com/p/toc-aws-organizations-and-ai-agent

More granular updates on X @teriradichel and the AWS Builder Center.

https://builder.aws.com/profile?tab=articles

Tools and models

I'm primarily using Kiro CLI and anthropic models, though I do use Google aimode to ask questions at times and may branch out to test other models and technologies after this infrastructure is up and running.

Issues:

https://github.com/2ndSightLab/ai-tracker/blob/main/issues.md

Fixed / Notes:

https://github.com/2ndSightLab/ai-tracker/blob/main/fixed.md

AWS Wishlist

https://github.com/2ndSightLab/ai-tracker/blob/main/awswishlist.md

My Time

I started this project around March 7th. I had to take a break for about three weeks in May. I haven't really worked on anything else besides this and blog posts because I keep thinking it is "almost done." I've also been working kind of long hours to do it and figure things out.

My initial post on this project tracks the start project and initial progress in 2.5 weeks

https://teriradichel.substack.com/p/what-ive-vibe-coded-in-25-weeks

The time it takes is demonstrated by feature completion and the timestamps in this GitHub repo, though my time may be taken away for other things periodically.

Response Time

Sometimes I am blocked by the system being slow or copmletely unsuable. It's hard to tell if it's the model or Kiro so I tried to measure gaps. This is a work in progress. I have limited information to work with, which I think needs to improve. We need more transparency for all metrics.

https://github.com/2ndSightLab/ai-tracker/blob/main/response-time.md

Cost:

Costs while building an AI Agent Bootstrap Script and Framework

Date Range: Mar 7, 2026 - Jul 2, 2026

Service / Resource	Total	Mar 2026	Apr 2026	May 2026	Jun 2026	Jul 2026*
Total costs	$2,151.92	$359.07	$387.55	$621.52	$755.02	$28.76
Kiro	$1,079.02	$193.55	$129.07	$285.79	$457.71	$12.90
Virtual Private Cloud	$411.17	$50.07	$118.34	$137.58	$104.22	$0.97
Elastic Compute Cloud - Compute	$283.88	$39.45	$44.28	$100.12	$96.80	$3.23

Costs broken down by service and other details here:

https://github.com/2ndSightLab/ai-tracker/blob/main/cost.md

Details

I was tracking all this manually but now I ahve the tracker diagram above to track deployments. But notice I haven't spent much time on actually security testing or code review. I review the code as it's being writtne a lot. I have crucial pieces of code that I move to other projects and lock down and some of that has been reviewed a bit more.

Bootrstrap Role

Bootstrap Role Script

Role, policy and permission boundary deployed in root management account in AWS CloudShell.

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Role	🟢	🟢	🟢	🟢	🟢	🟢
Policy	🟢	🟢	🟢	🟢	🟢	🟢
Permission Boundary	🟢	🟢	🟢	🟢	🟢	🔴
Trust policy with MFA and IP condition	🟢	🟢	🟢	🟢	🟢	🟢

Shared Code Projects

AWS CLI Auth with MFA

Separate reusable project that handles configuring role profiles and role assumption with MFA.

I used some previously written code as a starting point in which the role trust policies contain MFA and IPAddress conditions to assume the role and the user associated with the keys cannot do anything except asusme a role with MFA. I found at some point the CLI Auth code in my AI repos was modified to cache creds. I thought I removed that in the original repo. Do your own code review.

Feature	Tested	Code Review	Security Review
Configure Role Profile	🟢	🟢	🟢
Assume Role With MFA	🟢	🟡	🟡

XML Parser

A generic XML parser project that can be used by any bash project to move error prone and vulnerability prone code to a spearate locked down project.

Feature	Tested	Code Review	Security Review
XML read by path	🟢	🔴	🔴
XML write by path	🟢	🔴	🔴
XML load by path	🟢	🔴	🔴
XML read by single value	🟢	🔴	🔴
XML write by single value	🟢	🔴	🔴
XML load by single value	🟢	🔴	🔴

Menus

Separate reusable project provides simple and xml driven menus for consistency and easy updates

Feature	Tested	Code Review	Security Review
Reusaable Numbered Menu with Filter by letters	🟢	🔴	🔴
Reusable y/n/e prompt	🟢	🔴	🔴
XML data driven Menu	🟢	🔴	🔴
Multi-select menu	🟢	🔴	🔴
/c to return to previous menu	🟢	🔴	🔴
common banner with lines above and below and text between	🟢	🔴	🔴

AWS Command Runner

Feature	Tested	Code Review	Security Review
Run AWS Command	🟢	🔴	🔴
Track Deployed Resources	🟢	🔴	🔴
Switch Role (org/acount)	🟢	🔴	🔴

Time tracker

Feature	Tested	Code Review	Security Review
Analysis Report	🟢	🔴	🔴
Report time (logs per day)	🟢	🔴	🔴
Report mistake (logs per day)	🟢	🔴	🔴
Bug Report	🟢	🔴	🔴
Run all tests (all projects)	🟢	🔴	🔴

Global Requirements

Feature	Done
Cross-Project Requiremetns and Logging	🟢

Test Runner

Feature	Done
Run test for all projects	🟢

Bootstrap Code

Bootstrap Orchestrator

A project to manaage te handoff from org to environnet project so neither depends on the other. Reduces context and scope of the org and environment projects.

Feature	Tested	Code Review	Security Review
Configure Org Types (Menu Action)	🟢	🔴	🔴
Configure Org (Menu Action)	🟢	🔴	🔴
Deploy Resources (Menu Action)	🟢	🔴	🔴
Manage Drift (Menu Action)	🟢	🔴	🔴

Configure Organization Types

Configure organization to deploy; define environemnt types (allowed resources)

Environment Types Define accounts and resources that can be deployed to an environment.
Accounts define resources that can be deployed to account on top of environmen resources.
The resource master list maps a reosurce to a script that deploys it (to create a menu of resources to deploy)

Feature	List	Add	Delete	Rename	Edit	Menus	Tested	Code Review	Security Review
Resource Types	🟢	🟢	🟢	🟢	n/a	🟢	🟢	🔴	🔴
Account Types	🟢	🟢	🟢	n/a	🟢	🟢	🟢	🔴	🔴
Account Resource Types	🟢	🟢	🟢	🟢	n/a	🟢	🟢	🔴	🔴
Environment Types	🟢	🟢	🟢	🟢	n/a	🟢	🟢	🔴	🔴
Environment Type Account Types	🟢	🟢	🟢	n/a	🟢	🟢	🟢	🔴	🔴
Environment Type Resource Types	🟢	🟢	🟢	n/a	🟢	🟢	🟢	🔴	🔴
Default Org (define mangemnt env)	🟢	n/a	n/a	n/a	🟢	🟢	🟢	🔴	🔴
Default Org (define backup env)	🟢	n/a	n/a	n/a	🟢	🟢	🟢	🔴	🔴
Resource type Dependencies	🟢	🟢	🟢	🟢	🟢	🟢	🟢	🔴	🔴
Bootstrap / Account Role Resource Confit	🟢	🟢	🟢	🟢	🟢	🟢	🟢	🔴	🔴

Configure Organization Types Actions

Feature	Tested	Code Review	Security Review
Management Environment - Type ID	🟢	🔴	🔴
Backup Environment - Type ID	🟢	🔴	🔴
View Settings XML	🟢	🔴	🔴
Organization Diagram - All	🟢	🔴	🔴
Organization Diagram - Enviroments	🟢	🔴	🔴
Organization Diagram - Accounts	🟢	🔴	🔴
Organization Diagram - Per org/env resources	🟢	🔴	🔴
Organization Diagram - Type descriptions	🟢	🔴	🔴
Actions File (menus)	🟢	🔴	🔴

Configure Organization

Multiple enviroments of a single type can be created (Web-Dev, Web-Prod, etc.)
Multiple accounts of the same type can be created (Pentest1, Pentest2, etc.)
The resource list is pullled from the type configuration, not altered here.

Feature	List	Add	Delete	Rename	Menus	Tested	Code Review	Security Review
Organization	🟢	🟢	🟢	🟢	🟢	🟢	🔴	🔴
Evironments	🟢	🟢	🟢	n/a	🟢	🟢	🔴	🔴
Environment Accounts	🟢	🟢	🟢	n/a	🟢	🟢	🔴	🔴

Configure Organization Actions

Feature	Run	Tested	Code Review	Security Review
Create CLI Profiles	🟡	🟡	🔴	🔴
Select CLI Profiles	🟢	🟢	🔴	🔴
Test CLI Porfile	🟢	🟢	🔴	🔴
Look up Org, Root, Acount ID	🟢	🟢	🔴	🔴
Organization Seettings	🟢	🟢	🔴	🔴
Environment Settings	🟡	🟡	🔴	🔴
List Available Account Resources	🟢	🟢	🔴	🔴
Organization Diagram - All	🟢	🟢	🔴	🔴
Organization Diagram - Enviroments	🟢	🟢	🔴	🔴
Organization Diagram - Accounts	🟢	🟢	🔴	🔴
Organization Diagram - Per org/env resources	🟢	🟢	🔴	🔴
Organization Diagram - Type descriptions	🟢	🟢	🔴	🔴
Actions File (menus)	🟢	🟢	🔴	🔴

Deploy Actions

Feature	Menus	Run	Tested	Code Review	Security Review
Select Organization	🟢	🟢	🟢	🔴	🔴
Deploy Org Resources	🟢	🟢	🟢	🔴	🔴
Select Env	🟢	🟢	🟢	🔴	🔴
Deploy Env Resources	🟢	🟢	🟢	🔴	🔴
Select Account	🟢	🟢	🟢	🔴	🔴
Deploy Account Resources	🟢	🟢	🟢	🔴	🔴
Deployed Resources Tracking	🟢	🟢	🟢	🔴	🔴
Deployed Resources Diagram	🟢	🟢	🟢	🔴	🔴
Deploy With Confirm	🟢	🟢	🟢	🔴	🔴
Deploy No Prompt	🟢	🟢	🟢	🔴	🔴

Drift Actions

Feature	Run	Tested	Code Review	Security Review
Drift Report	🟡	🔴	🔴	🔴
Drift Delete Unauthorized Resources	🔴	🔴	🔴	🔴
Drift Deploy Missing Resources	🔴	🔴	🔴	🔴

Deploy Org Resources

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Organization	🟢	🟢	🟢	🟢	🔴	🔴
Enable All Features	🟢	🟢	🟢	🟢	🔴	🔴
SCP: env-allowed-regions [env]	🟢	🟢	🟢	🟢	🔴	🔴
SCP: IMDSV1 [env]	🟢	🟢	🟢	🟢	🔴	🔴
SCP: always-denied-actions [root]	🟢	🟢	🟢	🟢	🔴	🔴
SCP: always-default-org-root [root]	🟢	🟢	🟢	🟢	🔴	🔴
SCP: deploy-scp-require-imdsv2.sh [root]	🟢	🟢	🟢	🟢	🔴	🔴

Env Resources

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
OU	🟢	🟢	🟢	🟢	🔴	🔴
SCP: deny-external-access	🟢	🟢	🟢	🟢	🔴	🔴
SCP: account specific OU only allowing resources deployed	🔴	🔴	🔴	🔴	🔴	🔴
SCP: for different regions than org regions (more restrictive)	🔴	🔴	🔴	🔴	🔴	🔴
Rename OU	🟢	🟢	🟢	🟢	🔴	🔴

Account Resources - every account

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Accounts	🟢	🟢	🟢	🟢	🔴	🔴
Move account to OU	🟢	🟢	🟢	🟢	🔴	🔴
Account alias	🟢	🟢	🟢	🟢	🔴	🔴
Admin roles	🟢	🟢	🟢	🟢	🔴	🔴
Admin role policy	🟢	🟢	🟢	🟢	🔴	🔴
Delete Default VPC	🟢	🟢	🟢	🟢	🔴	🔴
Rename account, alias, email, name	🟢	🟢	🟢	🟢	🔴	🔴

Deny All Environment

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
OU	🟢	🟢	🟢	🟢	🔴	🔴
Deny All SCP	🟢	🟢	🟢	🟢	🔴	🔴

Test Environment

Environment where people log into EC2 instances.

OU

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
OU	🟢	🟢	🟢	🟢	🔴	🔴
SCP	🟢	🟢	🟢	🟢	🔴	🔴
Accounts	🟢	🟢	🟢	🟢	🔴	🔴
Budgets	🟡	🟡	🟡	🟡	🔴	🔴
Delete Default VPCs	🟢	🟢	🟢	🟢	🔴	🔴
Admin roles	🟢	🟢	🟢	🟢	🔴	🔴
log to security account	🔴	🔴	🔴	🔴	🔴	🔴

IAM Account

IAM users in work environment

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Acoount resources	🟢	🟢	🟢	🟢	🔴	🔴
IAM User	🟢	🟢	🟢	🟢	🔴	🔴

KMS Account

KMS keys used in enviroment

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Acoount resources	🟢	🟢	🟢	🟢	🔴	🔴
KMS keys	🟢	🟢	🟢	🟢	🔴	🔴
KMS policies	🟢	🟢	🟢	🟢	🔴	🔴
KMS key aliases	🟢	🟢	🟢	🟢	🔴	🔴

Network Account

Network resources shared to environmeng via RAM

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Acoount resources	🟢	🟢	🟢	🟢	🔴	🔴
VPC Flow Logs Role	🟡	🟡	🟡	🟡	🔴	🔴
Jobs VPC	🟢	🟢	🟢	🟢	🔴	🔴
Jobs Subnet	🟢	🟢	🟢	🟢	🔴	🔴
Jobs NACL	🟢	🟢	🟢	🟢	🔴	🔴
Route Table + Routes	🟢	🟢	🟢	🟢	🔴	🔴
VPC Endpoints	🟢	🟢	🟢	🟢	🔴	🔴
Vpc Endoint Security Groups	🟡	🟡	🟡	🟡	🔴	🔴
Jobs VCP Flow Logs	🟡	🟡	🟡	🟡	🔴	🔴
Jobs Ram Share	🟡	🟡	🟡	🟡	🔴	🔴
Work VPC	🟢	🟢	🟢	🟢	🔴	🔴
Work Subnet	🟢	🟢	🟢	🟢	🔴	🔴
Work NACL	🟢	🟢	🟢	🟢	🔴	🔴
Work Route Table + Routes	🟢	🟢	🟢	🟢	🔴	🔴
Work IGW	🟡	🟡	🟡	🟡	🔴	🔴
Work Ram Share	🟡	🟡	🟡	🟡	🔴	🔴
Work VCP Flow Logs	🟡	🟡	🟡	🟡	🔴	🔴
Jobs Auth VPC	🟢	🟢	🟢	🟢	🔴	🔴
Jobs Auth Subnet	🟢	🟢	🟢	🟢	🔴	🔴
Jobs Auth NACL	🟢	🟢	🟢	🟢	🔴	🔴
Jobs Auth Route Auth Table + Routes	🟢	🟢	🟢	🟢	🔴	🔴
Jobs AUth IGW	🟡	🟡	🟡	🟡	🔴	🔴
Jobs Auth VCP Flow Logs	🟡	🟡	🟡	🟡	🔴	🔴
Jobs Auth Ram Share	🟡	🟡	🟡	🟡	🔴	🔴
Remote Access Prefix List	🟢	🟢	🟢	🟢	🔴	🔴
AWS Services Prefix Lists	🟡	🟡	🟡	🟡	🔴	🔴
SSH Security Group	🟢	🟢	🟢	🟢	🔴	🔴
RDP Security Group	🟢	🟢	🟢	🟢	🔴	🔴
HTTP/HTTPS Security Group	🟡	🟡	🟡	🟡	🔴	🔴
Account: log to security account	🔴	🔴	🔴	🔴	🔴	🔴

AMI Account

Account where people log into EC2 instances.

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Acoount resources	🟢	🟢	🟢	🟢	🔴	🔴
Base Ubuntu AMI	🟡	🟡	🟡	🟡	🔴	🔴
Base Amazon Linux AMI	🔴	🔴	🔴	🔴	🔴	🔴
Burp AMI	🟡	🟡	🟡	🟡	🔴	🔴
Collab AMI	🔴	🔴	🔴	🔴	🔴	🔴
Kiro Dev AMI	🔴	🔴	🔴	🔴	🔴	🔴
Claude Code Ami	🔴	🔴	🔴	🔴	🔴	🔴
Codex Ami	🔴	🔴	🔴	🔴	🔴	🔴

Repos Account

Account where people log into EC2 instances.

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Acoount resources	🟢	🟢	🟢	🟢	🔴	🔴
Code Commit Repo	🟢	🟢	🟢	🟢	🔴	🔴
ECR	🔴	🔴	🔴	🔴	🔴	🔴

Work Account

Account where people log into EC2 instances.

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Acoount resources	🟢	🟢	🟢	🟢	🔴	🔴
IPAM pool	🟡	🟡	🟡	🟡	🔴	🔴
IPAM EIP allocation	🟡	🟡	🟡	🟡	🔴	🔴
S3 buckets (with KMS)	🟡	🟡	🟡	🟡	🔴	🔴
Bucket policies	🟡	🟡	🟡	🟡	🔴	🔴
Kiro Dev ENI	🟡	🟡	🟡	🔴	🔴	🔴
Kiro Instance Role	🟡	🟡	🟡	🔴	🔴	🔴
Kiro Instance	🟡	🟡	🟡	🔴	🔴	🔴
Burp ENI	🟡	🟡	🟡	🔴	🔴	🔴
Burp Instance Role	🟡	🟡	🟡	🔴	🔴	🔴
Burp Instance	🟡	🟡	🟡	🔴	🔴	🔴
Collab ENI	🟡	🟡	🟡	🔴	🔴	🔴
Collab Instance Role	🔴	🔴	🔴	🔴	🔴	🔴
Collab Instance	🔴	🔴	🔴	🔴	🔴	🔴
Claude Code Dev ENI	🟡	🟡	🟡	🔴	🔴	🔴
Claude Code Instance Role	🟡	🟡	🟡	🔴	🔴	🔴
Claude Code Instance	🟡	🟡	🟡	🔴	🔴	🔴
Codex Dev ENI	🟡	🟡	🟡	🔴	🔴	🔴
Codex Instance Role	🟡	🟡	🟡	🔴	🔴	🔴
Codex Instance	🟡	🟡	🟡	🔴	🔴	🔴

Domains Account

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Acoount resources	🟢	🟢	🟢	🟢	🔴	🔴

Web Account

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Acoount resources		🟢	🟢	🟢	🟢	🔴
Webs	🟡	🟡	🔴	🔴	🔴	🔴
log to security account	🔴	🔴	🔴	🔴	🔴	🔴

Jobs Auth Account

If I use CloudFront have to allow us-east-1 for ACM Cert. Lock down when not acively making chanages.

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Acoount resources	🟢	🟢	🟢	🟢	🔴	🔴
Job Auth Lambdas	🟡	🟡	🟡	🟡	🔴	🔴
Auth Lambda VPC Config	🟡	🟡	🟡	🟡	🔴	🔴
ACM Certificate	🟡	🟡	🟡	🔴	🔴	🔴
API Gateway	🟡	🟡	🟡	🔴	🔴	🔴
API Gateway CNAME	🟡	🟡	🟡	🔴	🔴	🔴
DynamoDB	🟡	🟡	🟡	🔴	🔴	🔴

Jobs Run Account

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Acoount resources	🟢	🟢	🟢	🟢	🔴	🔴
S3 buckets	🟡	🟡	🟡	🔴	🔴	🔴
Job Instance Role	🟡	🟡	🟡	🔴	🔴	🔴
Job ENI	🟡	🟡	🟡	🔴	🔴	🔴
Job EC2 Instance	🟡	🟡	🟡	🔴	🔴	🔴
Job AMI	🟡	🟡	🟡	🔴	🔴	🔴
Job Run (other resources, lambdas, micro VMs? TBD)	🟡	🟡	🟡	🔴	🔴	🔴

Management Environment

The management environment contains accounts where my organization deletegated administrators exist.

IAM Acount

IAM users in management environment

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Account	🟢	🟢	🟢	🟢	🔴	🔴
IAM User	🟢	🟢	🟢	🟢	🔴	🔴

Org Acount

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Org resource policy	🟢	🟢	🟢	🟢	🔴	🔴

Kiro Account

IAM users in work environment

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Acoount resources	🟢	🟢	🟢	🟢	🔴	🔴
Identity Center (requires interaction)	🟡	🟡	🟡	🟡	🔴	🔴
Kiro (requires interaction)	🟡	🟡	🟡	🟡	🔴	🔴

IPAM Account (Network)

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Account	🟢	🟢	🟢	🟢	🔴	🔴
Delegate IPAM admin	🟢	🟢	🟢	🟢	🔴	🔴
Delegate Firewall Manager admin	🟢	🟢	🟢	🟢	🔴	🔴
Delegate Network Manager admin	🟢	🟢	🟢	🟢	🔴	🔴
Delegate VPC Reachability Analyzer admin	🟢	🟢	🟢	🟢	🔴	🔴
IPAM	🟢	🟢	🟢	🟢	🔴	🔴

Security Acount

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Account	🟢	🟢	🟢	🟢	🔴	🔴
Delegate Security Hub admin	🟢	🟢	🟢	🟢	🔴	🔴
Delegate GuardDuty admin	🟢	🟢	🟢	🟢	🔴	🔴
Delegate CloudTrail admin	🟢	🟢	🟢	🟢	🔴	🔴
Delegate AWS Config admin	🟢	🟢	🟢	🟢	🔴	🔴
Delegate Macie admin	🟢	🟢	🟢	🟢	🔴	🔴
Delegate Inspector admin	🟢	🟢	🟢	🟢	🔴	🔴
Delegate IAM Access Analyzer admin	🟢	🟢	🟢	🟢	🔴	🔴
Delegate Audit Manager admin	🟢	🟢	🟢	🟢	🔴	🔴
Delegate Health admin	🟢	🟢	🟢	🟢	🔴	🔴
Delegate Detective admin	🟢	🟢	🟢	🟢	🔴	🔴
S3 Logs buckets (one per env)	🟢	🟢	🟢	🟢	🔴	🔴
S3 Logs bucket - with encryption	🟢	🟢	🟢	🟢	🔴	🔴
Configure GuardDuty	🟢	🟢	🟢	🟢	🔴	🔴
Configure Security Hub	🟢	🟢	🟢	🟢	🔴	🔴
Configure CloudTrail	🟢	🟢	🟢	🟢	🔴	🔴
Configure AWS Config	🟢	🟢	🟢	🟢	🔴	🔴
Configure Macie	🟢	🟢	🟢	🟢	🔴	🔴
Configure Inspector	🟢	🟢	🟢	🟢	🔴	🔴
Configure IAM Access Analyzer	🟢	🟢	🟢	🟢	🔴	🔴
Configure Security Alerts	🟡	🔴	🔴	🔴	🔴	🔴

KMS Acount

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Account, Move to OU, Alias	🟢	🟢	🟢	🟢	🔴	🔴
KMS Log Key	🟢	🟢	🟢	🟢	🔴	🔴
KMS Log Key Alias	🟢	🟢	🟢	🟢	🔴	🔴
KMS Log Key Policy	🟢	🟢	🟢	🟢	🔴	🔴

Accounting Acount

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Account, Move to OU, Alias	🟢	🟢	🟢	🟢	🔴	🔴
Delegate Cost Optimization Hub admin	🟢	🟢	🟢	🟢	🔴	🔴
Delegate Compute Optimizer admin	🟢	🟢	🟢	🟢	🔴	🔴

Org Acount

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Account, Move to OU, Alias	🟢	🟢	🟢	🟢	🔴	🔴
Org Policy (org delegated admin)	🟢	🟢	🟢	🟢	🔴	🔴

Jobs

Feature	Run	Tested	Code Review	Security Review
Deploy Web Site	🔴	🔴	🔴	🔴
IAM Acccess Analyzer Report	🔴	🔴	🔴	🔴
Prowler Report	🔴	🔴	🔴	🔴
Enable AWS default Org Role	🔴	🔴	🔴	🔴
Disable AWS default Org Role	🔴	🔴	🔴	🔴
Move website	🔴	🔴	🔴	🔴
Lock Environment (apply deny-all SCP)	🔴	🔴	🔴	🔴
Unlock Environment (remove deny-all SCP)	🔴	🔴	🔴	🔴
Lock Account (apply deny-all SCP)	🔴	🔴	🔴	🔴
Unlock Account (remove deny-all SCP)	🔴	🔴	🔴	🔴
Transfer GitHub repo to Code Commit	🔴	🔴	🔴	🔴
Transfer one Code Commit repo to Another	🔴	🔴	🔴	🔴
Troubleshoot Job	🔴	🔴	🔴	🔴
Analyze Network Traffic	🔴	🔴	🔴	🔴
Analyze System Logs	🔴	🔴	🔴	🔴
Move Domain	🔴	🔴	🔴	🔴
Move Hosted Zone	🔴	🔴	🔴	🔴
Register domain	🔴	🔴	🔴	🔴
Update Parent Hosted Zone (specific steps TBD)	🔴	🔴	🔴	🔴
Share all amis to all acounts in ou	🔴	🔴	🔴	🔴
Share AMI To External	🔴	🔴	🔴	🔴
Archive Acount	🔴	🔴	🔴	🔴

Backup Environment

Env OU

Back up infrastructure segregated from other infrastructure

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Backup OU	🟢	🟢	🟢	🟢	🔴	🔴
budgets	🟡	🟡	🟡	🟡	🔴	🔴
delete default vpcs	🟡	🟡	🟡	🟡	🔴	🔴
admin roles	🟢	🟢	🟢	🟢	🔴	🔴
log to security account	🔴	🔴	🔴	🔴	🔴	🔴

Backup Admin Account

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Delegate Backup admin	🟡	🟡	🟡	🟡	🔴	🔴

KMS Account

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Delegate Backup admin	🟡	🟡	🟡	🟡	🔴	🔴

Backup Accounts

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Backup Account Per Environment	🔴	🔴	🔴	🔴	🔴	🔴

Single Account Test Environment

Single Account Resources To Run Jobs (?)

Deploy environment to single account (account in a different organization or standalone)

Feature	Deploy	Delete	Verify	Tested	Code Review	Security Review
Network	🟡	🟡	🟡	🔴	🔴	🔴
User	🟡	🟡	🟡	🔴	🔴	🔴
Role	🟡	🟡	🟡	🔴	🔴	🔴
Jobs Instance	🟡	🟡	🟡	🔴	🔴	🔴

Name		Name	Last commit message	Last commit date
Latest commit History 1,141 Commits
bak		bak
troubleshooting		troubleshooting
README.md		README.md
assessing-degredation.md		assessing-degredation.md
awswishlist.md		awswishlist.md
cost.md		cost.md
fixed.md		fixed.md
issues.md		issues.md
mistake-tracker.md		mistake-tracker.md
time-tracker.md		time-tracker.md

Uh oh!

Folders and files

Latest commit

History

Repository files navigation

AI Tracker

Objective

Status Legend

Tracker Diagram Generated By Application

Status Summary

Token / Credit Usage

Support this research

Project Objective: AWS Bootstrap Script for AI Agent Environment

Tools and models

Issues:

Fixed / Notes:

AWS Wishlist

My Time

Response Time

Cost:

Costs while building an AI Agent Bootstrap Script and Framework

Details

Bootrstrap Role

Bootstrap Role Script

Shared Code Projects

AWS CLI Auth with MFA

XML Parser

Menus

AWS Command Runner

Time tracker

Global Requirements

Test Runner

Bootstrap Code

Bootstrap Orchestrator

Configure Organization Types

Configure Organization Types Actions

Configure Organization

Configure Organization Actions

Deploy Actions

Drift Actions

Deploy Org Resources

Env Resources

Account Resources - every account

Deny All Environment

Test Environment

OU

IAM Account

KMS Account

Network Account

AMI Account

Repos Account

Work Account

Domains Account

Web Account

Jobs Auth Account

Jobs Run Account

Management Environment

IAM Acount

Org Acount

Kiro Account

IPAM Account (Network)

Security Acount

KMS Acount

Accounting Acount

Org Acount

Jobs

Backup Environment

Env OU

Backup Admin Account

KMS Account

Backup Accounts

Single Account Test Environment

Single Account Resources To Run Jobs (?)

About

Resources

Stars

Watchers

Forks

Releases

Packages