Overview
Annie maintains a temporal record of your entire infrastructure, enabling you to ask questions about the state of any resource at any point in time. This “time travel” capability is essential for:- Incident Investigation: “What changed before the outage?”
- Change Validation: “Did my Terraform apply work correctly?”
- Compliance & Auditing: “When was this security group modified?”
- Rollback Analysis: “What was the previous configuration?”
Default Retention: 7 DaysAnnie retains infrastructure history for 7 days by default. You can ask about any resource’s state as it existed at any point in the last week.
What You Can Ask Annie
Track Recent Changes
Ask Annie what changed in your infrastructure:What changed recently?
What changed recently?
- “What changed in production in the last 24 hours?”
- “Show me infrastructure changes from yesterday”
- “What was modified in AWS this week?”
- “List all security group changes since Monday”
Resource-specific history
Resource-specific history
- “Show me the history of this RDS instance”
- “What happened to my prod-database in the last 3 days?”
- “When was this security group last modified?”
- “Who changed the IAM role permissions?”
Point-in-time state
Point-in-time state
- “What did our production VPC look like yesterday at 2pm?”
- “Show me the security group rules before the incident”
- “What resources existed in staging last week?”
Real-World Examples
Incident Investigation
Incident Investigation
Production database experiencing connection issues starting at 2:00 PM.“What changed in production between 1pm and 3pm today?”
I found 3 changes in that window:Root cause: The security group change at 1:45 PM removed access from the application subnet.
- 1:45 PM: Security group
sg-prod-dbwas modified - an inbound rule for subnet 10.0.1.0/24 was removed- 1:52 PM: The prod-api service lost connectivity to the database
- 2:00 PM: PagerDuty alert fired
Compliance Audit
Compliance Audit
Auditor asks when encryption settings were changed on a sensitive S3 bucket.“Show me the history of the sensitive-data-bucket”
Here’s the change history for sensitive-data-bucket:The bucket has been encrypted since creation.
- June 15, 2023: Bucket created with SSE-S3 encryption
- September 1, 2023: Encryption changed to SSE-KMS with key arn:aws:kms:…
- December 15, 2023: Key rotation policy enabled
Post-Deployment Validation
Post-Deployment Validation
You just ran
terraform apply and want to verify the changes.“What changed in the last 30 minutes?”I found 5 resources updated in the last 30 minutes:All changes match your Terraform configuration.
- EC2 instance
prod-api-1: instance type changed from t3.medium to t3.large- EC2 instance
prod-api-2: instance type changed from t3.medium to t3.large- Auto Scaling Group
prod-api-asg: desired capacity changed from 2 to 4- Target Group
prod-api-tg: 2 new targets registered- CloudWatch Alarm
prod-api-cpu: threshold changed from 70% to 80%
Understanding Drift
Understanding Drift
You suspect someone made manual changes in the AWS console.“What resources were modified outside of Terraform this week?”
I found 2 resources with manual changes not in your Terraform code:Would you like me to show you the specific changes?
- Security group
sg-dev-debug: Port 22 opened to 0.0.0.0/0 via AWS console on Tuesday- IAM role
dev-admin-role: New policy attached manually on Wednesday
Best Practices
Start with the Incident Time
When investigating issues, ask about changes around the time symptoms first appeared.
Narrow to Specific Resources
If you know which resource is problematic, ask about its specific history.
Compare Before and After
Ask Annie to show you what a resource looked like before a specific event.
Track Terraform vs Manual
Ask Annie to identify changes made outside of your Infrastructure as Code.