TLDR Tech / InfoSec
TrailTool: CloudTrail for AI Agents
TrailTool is an open-source AWS tool that pre-processes CloudTrail logs via Lambda and caches them in DynamoDB grouped by entities (People, Sessions, Roles, Services, and Resources) so AI agents can answer access-pattern questions without burning context on raw log queries. The CLI surfaces four agent-driven workflows: detecting ClickOps resource modifications, generating least-privilege IAM policies from session activity using iamlive mappings, auto-drafting permission fixes for AccessDenied errors, and validating break-glass justifications by comparing stated intent against actual session activity. Defenders deploy the Ingestor Lambda via SAM and query with standard AWS credentials. A hosted version is available at trailtool.io for teams that want to skip the deployment step.
Read the full story