IC CLI Tool (Infrastructure Commander)

A comprehensive, production-grade Infrastructure Command Line Interface tool for managing multi-cloud infrastructure and server components across multiple platforms. IC CLI provides unified access to AWS, Tencent Cloud, GCP, Oracle Cloud Infrastructure (OCI), CloudFlare, and SSH server management with rich progress indicators and secure configuration management.

✨ Key Features

• 🚀 Multi-Cloud Support: AWS, Tencent Cloud, GCP, OCI, CloudFlare, and SSH server management
• 🔄 Smart Auth & Profile Switcher: One-touch atomic switching between personal SSO/STS sessions (aws login, tccli auth login) and service accounts with real-time session expiry tracking & automatic background refresh
• 🛡️ IAM & CAM Security Auditing: One-touch audit of console login types (User/Service/Collaborator), password age (color-coded warnings for 90+ days), last login, access key usage, and attached policies
• 📊 Rich Progress Bars: Real-time progress indicators for all long-running operations across accounts and regions
• 🔒 Secure Configuration: Modern YAML-based configuration (~/.ic/config/) and native credential files (~/.aws/config, ~/.tencent/credentials) with private role mapping
• 🌍 Multi-Account / Multi-Region: Concurrent querying across multiple cloud accounts and regions with STS / CAM AssumeRole support
• 🎨 Beautiful Terminal UI: Rich terminal output with tables, colors, JSON formatting, and hierarchical tree diagrams
• ⚡ High Performance: Optimized async and concurrent execution for fast resource discovery
• 🛡️ Security First: Built-in credential masking, secret scanning, and pre-commit hook support

🖥️ Terminal UI Preview

📦 Supported Platforms & Services

1. 🟧 AWS Services (Production Ready)

• Authentication & Profile:
  • Seamless authentication switching between personal aws login STS session and service account static credentials (ic aws profile switch [login|service])
  • Real-time STS session lifetime tracking and profile overview (ic aws profile info)
• Security & IAM:
  • IAM user security auditing: console login status, password age with color-coded risk alerts (90+ days red, 60-89 yellow), last login date, last Access Key usage date, and attached managed/inline/group policies (ic aws iam user)
• Compute & Containers:
  • EC2 instances with state, type, IPs, VPC, and deep attribute inspection (ic aws ec2 info, ic aws ec2 desc)
  • ECS clusters, services, and task inspection (ic aws ecs info, ic aws ecs service, ic aws ecs task)
  • EKS Kubernetes clusters, node groups, pods, addons, and Fargate profiles (ic aws eks info, ic aws eks nodes, ic aws eks pods, ic aws eks addons, ic aws eks fargate)
• Storage & Databases:
  • EBS volumes inspection: size, state, volume type, IOPS, throughput, and attached instances (ic aws ebs info)
  • S3 buckets inspection and tagging compliance checks (ic aws s3 info, ic aws s3 tag_check)
  • RDS database instances and Aurora clusters (ic aws rds info)
• Networking & Content Delivery:
  • VPC, Subnets, NAT Gateways, and VPN connections (ic aws vpc info, ic aws vpn info)
  • Load Balancers (ALB/NLB) with listener rules, health check paths, and target instance health analysis (ic aws lb info, ic aws lb desc)
  • Security Groups with Ingress/Egress rule inspection and visual relation tree (ic aws sg info, ic aws sg info -o tree)
  • CloudFront CDN distributions and origin configs (ic aws cloudfront info)
• Health & Maintenance:
  • AWS Health Dashboard EC2 scheduled reboot maintenance check across all accounts (ic aws healthdashboard reboot)
• Integrations:
  • MSK (Managed Streaming for Kafka) clusters and brokers (ic aws msk info, ic aws msk broker)
  • CodePipeline build and deployment pipeline status (ic aws codepipeline build, ic aws codepipeline deploy)

2. 🟦 Tencent Cloud Services (Production Ready)

• Authentication & Profile:
  • Seamless dual-mode authentication switching between personal account (tccli auth login STS) and service account (~/.tencent/credentials) with real-time session tracking (ic tencent profile switch [tccli|service])
  • Cross-account dynamic AssumeRole support with credentials inspection (ic tencent profile info)
• Security & CAM:
  • CAM sub-account and collaborator (협력자/외부계정) security auditing: login type (User/Service/Collaborator), password age, last login timestamp, SecretId key usage date, and policy details (ic tencent cam user)
• Compute & Containers:
  • CVM instances with CPU, Memory, Disk, Zone, IPs, attached SGs, and deep attribute inspection (ic tencent cvm info, ic tencent cvm desc)
  • Lighthouse lightweight application servers (ic tencent lighthouse info, ic tencent lighthouse info -p) and dedicated instance firewall rules inspection (ic tencent lighthouse firewall, ic tencent lighthouse firewall -o tree)
  • TKE (Tencent Kubernetes Engine) clusters and node details (ic tencent tke info)
• Storage & Databases:
  • CBS (Cloud Block Storage) disk inspection: volume size, disk type, status, and attached CVM instances (ic tencent cbs info, ic tencent disk info)
• Networking:
  • VPC, Subnets, and NAT Gateways (ic tencent vpc info, ic tencent nat info)
  • CLB (Cloud Load Balancer): listeners, rules, health check path, and target instance health status (ic tencent clb info, ic tencent clb desc)
  • CLB Traffic & Bandwidth: In/Out bandwidth (Avg/Max in Mbps) and total data transfer over 7 or 30 days (ic tencent clb traffic)
  • Security Groups with Ingress/Egress rule analysis and visual hierarchy tree (ic tencent sg info, ic tencent sg info -o tree)

3. 🟩 GCP Services (Production Ready - v1.5.3)

• Compute Engine: VM instances with status, zone, machine type (custom parsing), vCPU, memory, disks, IPs, tags, and verbose 15-column output (ic gcp compute info -v)
• Compute Detailed Inspection (desc): Full attribute discovery, dot-notation key filtering (-k / --keys), schema discovery (-l / --list-keys) for instances
• Load Balancing (LB): Forwarding rules, Target proxies, URL maps, Backend services, Health checks, and SSL certificates (ic gcp lb info)
• LB Detailed Inspection (desc): Deep hierarchical inspection of proxies, rules, backends, and health checks with dot-notation key filtering (ic gcp lb desc)
• GKE: Kubernetes Engine clusters and node pool configurations (ic gcp gke info)
• Cloud Run: Serverless container services, ready status, CPU/Mem, and revisions (ic gcp run info)
• Cloud Functions: Serverless functions, triggers, runtime, and memory (ic gcp functions info)
• Cloud SQL: Managed database instances, engine versions, HA, and status (ic gcp sql info)
• Cloud Storage: Buckets, locations, storage classes, and lifecycle (ic gcp storage info)
• VPC & Firewall: Virtual networks, subnets, and ingress/egress firewall rules (ic gcp vpc info, ic gcp firewall info)
• Cloud DNS: Managed public and private DNS zones and record sets (ic gcp dns info)
• Resource Hierarchy & Projects: Multi-level folder tree, project status, and active project indicators (ic gcp project info)
• Billing: Cost by service, budgets, and alerts (ic gcp billing info)
• Profile: gcloud CLI configurations and active account verification (ic gcp profile info)

4. 🟥 Oracle Cloud Infrastructure (OCI) (Production Ready)

• Compute & Containers: VM instances, Container instances (ACI)
• Networking: VCN, Subnets, Load Balancers, Network Security Groups (NSG)
• Storage: Block Volumes, Object Storage buckets
• IAM & Cost: Compartment hierarchy, IAM Policy search/validation, Cost usage & billing credits

5. 🟧 CloudFlare (Production Ready)

• DNS & Zones: Zone listings, DNS record management, and account filtering

6. 🟦 SSH Server Management (Production Ready)

• Discovery: Automatic server registration, connection verification, and security filtering

📦 Installation

From PyPI (Recommended)

# Install the latest stable version (v1.3.1+)
pip install ic-code

# Verify installation
ic --version
ic --help

From Source (Development)

# Clone the repository
git clone https://github.com/dgr009/ic.git
cd ic

# Create and activate virtual environment
python -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate

# Install dependencies and local editable package
pip install -e .

# Verify installation
ic --version

⚙️ Configuration Setup

IC CLI uses a modern two-file configuration system located in ~/.ic/config/ for security:

~/.ic/config/
├── default.yaml        # Non-sensitive default settings
└── secrets.yaml        # Sensitive API keys, tokens, and profiles

1. Initialize Configuration

# Guided interactive configuration setup
ic config init

# Or generate template for specific clouds
ic config init --template aws
ic config init --template multi-cloud

2. Configure Credentials (~/.ic/config/secrets.yaml)

# AWS Configuration
aws:
  accounts:
    - "123456789012"
  profiles:
    default: "my-aws-profile"
  regions:
    - "ap-northeast-2"
    - "us-east-1"

# Tencent Cloud Configuration (Dynamic AssumeRole & Profile Switching)
tencent:
  root_account: "main"                     # Source profile for AssumeRole
  root_account_id: "123456789012"          # Source root account UIN
  tccli_role: "OrganizationAccountAccessRole"  # Role for personal tccli session AssumeRole
  service_role: "ServiceAdminRole"         # Role for service account static key AssumeRole
  isolated_accounts:                       # Sub-accounts that keep dedicated direct credentials
    - "china-mainland-account"
  regions:
    - "ap-seoul"
    - "ap-guangzhou"

# GCP Configuration
gcp:
  project_id: "my-gcp-project-id"
  credentials_file: "~/.config/gcloud/application_default_credentials.json"
  regions:
    - "asia-northeast3"
    - "us-central1"

# Oracle Cloud Infrastructure (OCI)
oci:
  config_file: "~/.oci/config"
  profile: "DEFAULT"
  compartments:
    - "ocid1.compartment.oc1..example"

# CloudFlare Configuration
cloudflare:
  api_token: "your-cloudflare-api-token"

# SSH Configuration
ssh:
  key_dir: "~/.ssh"
  skip_prefixes:
    - "bastion"
    - "jump"

3. Manage & Validate Config

# Show configuration (sensitive fields masked automatically)
ic config show

# Validate configuration structure and paths
ic config validate

🚀 Command Usage Examples

AWS Commands

# --- Authentication & Profile Switching ---
# View current authentication mode (login vs service) and STS session validity
ic aws profile switch

# Switch between personal SSO/STS mode (aws login) and service account (static credentials)
ic aws profile switch login
ic aws profile switch service

# Inspect all configured profiles and active credential status
ic aws profile info

# --- IAM User Security & Password Audit ---
# Audit all IAM users: console login type, password age, last login, last key used, policies
ic aws iam user

# Filter warning users with password older than 90 days
ic aws iam user -w
ic aws iam user -a prod-account -w

# Filter by login type (user or service)
ic aws iam user -t user
ic aws iam user -t service

# Verbose output (including User ID and Access Key ID list) or copyable text for spreadsheets
ic aws iam user -v
ic aws iam user -p

# --- Health & Maintenance ---
# Check EC2 scheduled reboot maintenance across all accounts
ic aws healthdashboard reboot
ic aws healthdashboard reboot -A
ic aws healthdashboard reboot -a prod-account --all-status

# --- Compute & Containers ---
# List EC2 instances across regions
ic aws ec2 info

# Detailed EC2 instance inspection with key filtering
ic aws ec2 desc -l                                       # Discover available keys
ic aws ec2 desc -k InstanceId,State.Name,PrivateIpAddress

# EKS cluster, node groups, and pod status
ic aws eks info
ic aws eks nodes
ic aws eks pods

# ECS clusters, services, and tasks
ic aws ecs info
ic aws ecs service
ic aws ecs task

# --- Storage & Databases ---
# Inspect EBS volumes (size, status, volume type, IOPS, attached instances)
ic aws ebs info

# S3 bucket listing and tagging compliance checks
ic aws s3 info
ic aws s3 tag_check

# RDS instances and Aurora clusters
ic aws rds info

# --- Networking & Security ---
# Security Group info (Ingress & Egress rules)
ic aws sg info
ic aws sg info --ingress    # Show Ingress rules only
ic aws sg info --egress     # Show Egress rules only

# Render Security Groups in visual hierarchical tree (← Ingress, → Egress)
ic aws sg info -o tree

# Load Balancers (ALB / NLB) and deep hierarchy inspection
ic aws lb info
ic aws lb desc -l

# VPC & NAT Gateway
ic aws vpc info

Tencent Cloud Commands

# --- Authentication & Profile Switching ---
# View current authentication mode (tccli vs service) and STS token validity
ic tencent profile switch

# Switch between personal account (tccli STS token) and service account (~/.tencent/credentials)
ic tencent profile switch tccli
ic tencent profile switch service

# Inspect registered accounts, active authentication mode, and dynamic AssumeRole mapping
ic tencent profile info

# --- CAM User Security & Password Audit ---
# Audit CAM users & collaborators: console login type, password age, last login, last key used
ic tencent cam user

# Filter users with password older than 90 days
ic tencent cam user -w

# Filter by login type (user, service, or collaborator)
ic tencent cam user -t user
ic tencent cam user -t collaborator

# --- Compute & Containers ---
# List CVM instances across accounts and regions
ic tencent cvm info
ic tencent cvm info -a prod-account
ic tencent cvm info -n "web,db"                           # Multi-pattern search with comma
ic tencent cvm info -c "YYYY-MM-DD"                       # Filter by creation date (exact, comma, range, >=, <=)
ic tencent cvm info -p                                    # Spreadsheet copyable comma-separated format

# Deep CVM instance inspection with dot-notation key filtering
ic tencent cvm desc -l                                   # Discover available keys
ic tencent cvm desc -k InstanceId,InstanceState,PrivateIpAddresses.0

# Lightweight application servers (Lighthouse)
ic tencent lighthouse info
ic tencent lighthouse info -n "web,db"                           # Multi-pattern search with comma
ic tencent lighthouse info -c "YYYY-MM-DD"                       # Filter by creation date (exact, comma, range, >=, <=)
ic tencent lighthouse info -p                                    # Spreadsheet copyable comma-separated format

# Lighthouse Firewall Rules (Instance inbound firewall rules)
ic tencent lighthouse firewall                              # Table view across instances
ic tencent lighthouse firewall -o tree                      # Hierarchical tree view (Account > Region > Instance > Rules)
ic tencent lighthouse firewall -p                           # Spreadsheet copyable comma-separated format
ic tencent lighthouse firewall -c ">=YYYY-MM-DD"            # Filter by instance creation date
ic tencent lighthouse firewall --port 22 --action ACCEPT    # Filter by port and action

# TKE Kubernetes clusters & node details
ic tencent tke info

# --- Storage ---
# Inspect Cloud Block Storage (CBS / Disk) volumes
ic tencent cbs info
ic tencent disk info

# --- Networking & Load Balancing ---
# Cloud Load Balancer (CLB) with listeners, rules, and target health
ic tencent clb info
ic tencent clb desc -l

# CLB Network bandwidth statistics (Avg/Max Mbps) and data transfer (default 7 days, or 30 days)
ic tencent clb traffic
ic tencent clb traffic -d 30

# Security Groups with Ingress/Egress rules and tree view
ic tencent sg info
ic tencent sg info -o tree

# VPC, Subnets, and NAT Gateways
ic tencent vpc info
ic tencent nat info

GCP Commands (v1.5.3)

# Compute Engine VM instances (summary & verbose 15-column output)
ic gcp compute info
ic gcp compute info -v

# Compute Engine detailed resource inspection (desc)
ic gcp compute desc                                          # Full YAML dump
ic gcp compute desc -l                                       # Discover queryable dot-notation keys
ic gcp compute desc -k status,machine_type,internal_ip       # Filter attributes into table

# Load Balancers (ALB / NLB)
ic gcp lb info
ic gcp lb desc -l                                            # Discover LB schema keys
ic gcp lb desc -k type,ip_address,backend_services.0.name    # Inspect LB backend services

# Container & Serverless
ic gcp gke info                                              # GKE clusters & node pools
ic gcp run info                                              # Cloud Run services & revisions
ic gcp functions info                                        # Cloud Functions & triggers

# Databases, Storage & Networking
ic gcp sql info                                              # Cloud SQL instances
ic gcp storage info                                          # Cloud Storage buckets
ic gcp vpc info                                              # VPC networks & subnets
ic gcp firewall info                                         # Firewall ingress/egress rules
ic gcp dns info                                              # Cloud DNS managed zones

# Resource Hierarchy & Project Management
ic gcp project info                                          # Active project & folder tree view
ic gcp billing info                                          # Monthly billing costs by service
ic gcp profile info                                          # gcloud active configurations

OCI Commands

# Compute VM instances
ic oci vm info

# Virtual Cloud Networks
ic oci vcn info

# Load Balancers & Network Security Groups
ic oci lb info
ic oci nsg info

# Storage & Cost usage
ic oci volume info
ic oci cost usage

CloudFlare & SSH Commands

# CloudFlare Zones and DNS
ic cf zone info
ic cf dns info

# SSH Server discovery
ic ssh info

Security & Hook Commands

# Scan codebase for hardcoded secrets
ic security scan

# Install pre-commit security hooks
ic security install-hooks

🧪 Testing & Validation

# Run unit & integration test suites
pytest tests/unit tests/integration

# Run End-to-End CLI validation
python tests/validation/end_to_end_cli_validation.py

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.