Guide / First run

First run

No AWS account? Try the demo

neboto --demo

opens a made-up account, acme-prod, with a few problems planted in it: a failed ECS deploy, SSH open to the world, a drifted CloudFormation stack, a Lambda whose logs keep streaming. It uses no credentials and makes no network calls, so it’s also a safe way to learn the keys before pointing neboto at a real account. The recordings on the home page were made with it.

Credentials and region

neboto uses the standard AWS credential chain: environment variables, ~/.aws/credentials, ~/.aws/config (SSO profiles, IAM roles), then an instance or task role. If the aws CLI works in your shell, neboto works.

A credential_process that asks for something in the terminal works too: granted with the pass keyring, say, where gpg’s pinentry asks for your passphrase. neboto runs it before the TUI starts. When it runs again later (after P, or when the credentials expire), neboto steps aside until the prompt is answered, then redraws.

The startup region comes from AWS_DEFAULT_REGION or the active profile. R switches region at runtime without a restart; P switches profile.

With regions set in the configuration, opening R also lists the current service in each of those regions and shows how many rows of the current tab each one has: 3 EC2 instances, or denied where an SCP blocks the region. Those lists go into the cache, so switching to one of them afterwards is instant. A region you haven’t listed shows nothing rather than 0. Global services, and ones scoped by a toggle (Cost, GuardDuty’s severity, CloudTrail’s query…), aren’t counted.

The account needs read permissions for the services you browse. The quickest correct answer is the AWS-managed ReadOnlyAccess policy; see Permissions for the narrower, auditable grant.

The welcome splash

With no arguments and no default_service configured, neboto shows a welcome splash and loads nothing until you pick a service, so startup is instant. Press S for the service picker, or type @ followed by a prefix such as ec2 and press Enter. With a mouse, click one of the services under the logo (@ec2, @s3, @lambda …) or any row of the menu. If no profile is set, a ⦿ no profile badge at the top right opens the profile picker.

Set default_service in the config file to skip the splash.

Command line

Every flag overrides the config file for that run only.

The screen

Top to bottom: the service strip with the region and profile badges, the search bar, the sub-tabs for the current service, then the list pane on the left and the detail pane on the right, and a status bar. The status bar shows the key hints for what’s selected, and always ends with : commands · ? help · q quit. Any error is y-copyable from it; M reviews past messages.

The detail pane opens on section 1, Overview: the resource’s identity and configuration. (The few panes with a single section call it Details.) On security groups, network ACLs, route tables, transit gateway route tables, target groups and hosted zones, the Overview also answers the first question you’d ask: which rules are open to the internet, where the default route goes, how many targets are healthy and why the others aren’t. The sections after it hold the full detail.

l, → or Enter moves from the list into the detail pane; h, ← or Esc comes back. That spatial left-and-right is the whole navigation model.