What did our VPC look like at 22:14 (Tue, 2026-05-20) — building clew, a CLI for navigating AWS Config snapshots

It's 2am. Production is on fire. Someone in the war room asks, "what did the VPC actually look like at 22:14, when this started?", and the only honest answer is, "give me twenty minutes with jq."

That moment, repeated enough times, is why I started writing the tool I want to talk about today: clew, a Go CLI that ingests AWS Config Configuration Snapshots into a local DuckDB and renders an interactive topology you can actually read.

▎

The DuckDB file holds three tables:

config_items

Stores one row per imported configurationItem, including the original configuration, relationships, tags, and capture_time.

graph_nodes

Stores one row per resource, including placeholder rows for resources referenced by relationships but not yet imported.

graph_edges

Stores resource-to-resource edges extracted from both relationships[] and the configuration body.

(MIT)

If you want to see the output without setting up real AWS Config, the repo ships a testdata/sample_snapshot.json that exercises every piece of the rendering pipeline:

clew import --input testdata/sample_snapshot.json --db /tmp/demo.duckdb

clew render --db /tmp/demo.duckdb --view vpc --format html --output /tmp/demo.html

open /tmp/demo.html

This is still a PoC — there are sharp edges and obvious gaps. Issues, PRs and "here's the view I actually need" feature requests are all welcome.

Thanks for reading. If this means one fewer engineer is writing jq queries at 2am next month, the project has paid for itself.