AWS · terminal · read-only

Browse your AWS accounts without leaving the terminal.

All your AWS behind one fuzzy search, console-style detail panes, live log tailing, CloudWatch charts, and links you can follow across services and regions. It issues only describe, list and get calls — nothing it does can change your account.

curl -fsSL https://raw.githubusercontent.com/neboto/neboto-tui/main/install.sh | sh

Install guide Read the guide Source on GitHub

A failed deploy, from “something’s wrong” to “here’s why”. Recorded with neboto --demo, a made-up account that ships in the binary: run it yourself, no AWS account needed.

What you get

All your AWS, one search. @ec2 web, @sh, @orgs — an @prefix switches service and fuzzy-matches the rest against ids, names, IPs, CIDRs, tags and ARNs. Multi-resource services get numbered sub-tabs.
Console-style detail panes. Fixed header, section tabs, scrollable body, for every resource type. Expensive sections load lazily the first time you look.
Follow the links. Enter on any ARN, id or reference jumps to that resource — across services and even across regions. Tracing a dependency chain is faster here than in the Console.
Logs and metrics in place. t tails CloudWatch logs live, f runs a server-side log search, m charts CloudWatch metrics with the right namespace and dimensions already picked.
Browse the data, not just the config. o walks a bucket like a file manager, with version history, previews and downloads; i scans or queries a DynamoDB table. Open a .tfstate from the bucket and Enter jumps from any Terraform address to the live resource.
“Who changed this?” W opens a CloudTrail lens on any resource, merged with alarm history, stack events and deployments.
Multi-account, safely. Switch profiles with P, or assume into an Organizations member account with s — every assumed session is pinned to a ReadOnlyAccess session policy.
Watch, record, export. w auto-refreshes without the list ever blanking, , records a navigation routine you can replay with one key, X exports JSON, CSV and Markdown.
Copy the command, not the risk. C copies the AWS CLI command for what you want to do next — describe, connect, stop, scale, force-deploy — previewed with region and profile filled in. neboto never runs it.
Keyboard first, mouse welcome. Every status-bar hint, badge, tab and picker is clickable. Double-click drills in, the wheel scrolls, and right-click goes back. Nobody has to learn the keys to get started.
Your colours. Ten theme presets, light and dark, plus per-colour overrides. This site uses the same catppuccin-mocha palette as the recording.

Workflows, not tabs

Each clip is one question answered against neboto --demo.

Follow the links. Enter from an ECS service to its target group and load balancer, Ctrl-O back, then N for the service's effective network access across every security group.

Who changed this?. SSH is open to the world. W merges CloudTrail, alarm history, stack events and deployments for this one resource, and names who opened it.

Tail the logs. t live-tails a Lambda's log group; / filters to the DynamoDB throttles and w wraps them so the message reads in full.

Explain the drift. A stack's Drift section names the changed property. Follow it to the resource and W finds the console edit behind it.

Read the charts. m charts every metric at once, with the failed deploy drawn where it happened. W opens those changes and Esc comes back. Then a Lambda's errors climbing, s for Duration's peaks, and 5 for the last 30 days.

One resource, every angle

A security group's inbound rules, what uses it, and a link to every group it references — one pane, no tab-hopping. The SSH rule someone forgot stands out.

neboto showing a security group's inbound rules in the split detail pane, with the EC2 sub-tabs above and the status bar below

Read-only is the point

Every assumed cross-account session is pinned to the AWS-managed ReadOnlyAccess session policy, and the full IAM footprint is documented action by action in PERMISSIONS.md. Security teams can approve it because it cannot mutate. When you do want to change something, C copies the ready-to-run AWS CLI command for the selected resource, region and ids filled in.

Permissions and the read-only guarantee →

On Azure: nebaz

nebaz is neboto's Azure sibling: the same keyboard-driven, read-only terminal UI, built on the same core and signed in through the Azure CLI. It covers 20 services, including VMs, Storage, Networking, Key Vault, AKS, App Service, SQL, Cosmos DB and Container Apps, with the network access lens, the change timeline and @audit. It is early and experimental. Try it with nebaz --demo, no Azure account needed.

Meet nebaz →