neboto

A fast, keyboard-driven terminal UI for browsing AWS. 70+ services, rich console-style detail panes, live log tailing, CloudWatch charts, and cross-service link-following — all without leaving the terminal.

Built in Rust with Ratatui. Website and guide: neboto.dev.

Try it without an AWS account: neboto --demo opens a made-up account with a few problems planted in it (a failed ECS deploy, SSH open to the world, a drifted CloudFormation stack) and makes no network calls.

neboto is read-only. It issues only describe/list/get calls. Nothing it does can change your account, which is the point: it is safe to run against production, and the IAM policy in PERMISSIONS.md is auditably read-only. See Why read-only.

---

Highlights

• 70+ AWS services behind an @prefix fuzzy search — @ec2 web, @sh, @orgs. Multi-resource services get numbered sub-tabs. @all searches everything already loaded.
• Console-style split detail panes on 200+ resource types: fixed header, section tabs, scrollable body. Expensive sections load lazily on first view.
• Follow the links — press Enter on any ARN, id or reference to jump to that resource, across services and even across regions. Tracing a dependency chain is faster here than in the Console.
• Live log tail (t) and server-side log search (f) on log groups, Lambda, RDS, ECS tasks, WAF, CloudTrail, Step Functions, CodeBuild and more.
• CloudWatch charts in the pane (m) for 50+ resource kinds, each with the right namespace and dimension set, and recent changes marked on the chart.
• "What changed around this?" (W) — a timeline on any resource that merges CloudTrail, alarm history, CloudFormation events, ECS deployments, Auto Scaling activities and RDS events.
• Who uses this? (U) lists the loaded resources that reference it, and what can reach it? (N) shows the effective security group and NACL rules in one table.
• A security pass (@audit) over what's loaded: open security groups, public buckets, unencrypted volumes, root MFA and more.
• Find any key — ? help filters as you type, and : runs any key by name.
• Multi-account — switch profiles (P), or assume a role into an Organizations member account (s) scoped by a ReadOnlyAccess session policy so an assumed session provably cannot mutate.
• Watch mode (w) — auto-refresh without the list ever blanking.
• Macros (,) — record a navigation routine once, replay it with one key or from the CLI with --macro.
• Themes — 10 presets (light and dark) plus per-color overrides.
• Export (X / Ctrl-X) to JSON, CSV and/or Markdown (export_formats), including deep exports of a multi-row selection.

---

See it in action

Each clip is one workflow against neboto --demo. Click for full size.

---

Install

Prebuilt binaries for Linux (x86_64, aarch64) and macOS (Intel, Apple Silicon) are attached to every GitHub release.

Installer — picks the right binary, verifies its SHA-256 and, when the GitHub CLI is installed, its signed build provenance, and puts it in ~/.local/bin:

curl -fsSL https://raw.githubusercontent.com/neboto/neboto-tui/main/install.sh | sh

Prefer to read a script before running it? Download it first:

curl -fsSLO https://raw.githubusercontent.com/neboto/neboto-tui/main/install.sh && less install.sh && sh install.sh

Or with cargo-binstall:

cargo binstall --git https://github.com/neboto/neboto-tui neboto

NEBOTO_VERSION=v0.1.0 pins a version and NEBOTO_INSTALL_DIR changes the destination. Or grab the tarball for your platform from the releases page and put neboto anywhere on your PATH.

Verify a download. Every release archive carries a signed build provenance attestation naming the commit and workflow that built it. With the GitHub CLI:

gh attestation verify neboto-aarch64-apple-darwin.tar.gz --repo neboto/neboto-tui

A tampered or substituted archive fails this check even if its .sha256 was replaced alongside it.

From source — needs a recent stable Rust toolchain:

cargo install --git https://github.com/neboto/neboto-tui

Or clone and build:

git clone https://github.com/neboto/neboto-tui.git && cd neboto-tui
cargo build --release && ./target/release/neboto

Either way you need configured AWS credentials. Optional companions: the aws CLI + session-manager-plugin for SSM sessions (s), and a $EDITOR for e. The user guide lives at neboto.dev/guide; how releases are cut is in docs/RELEASING.md.

Command line

Every flag overrides the config file for that run only.

This is the beginning of the README. Read the rest at the original. Read the full README ↗