cdk-insights previewDeployment preview
Compare against a reviewed template baseline. Replacement, deletion, exposure, encryption and stateful-resource changes contribute to a clear GO, REVIEW or BLOCK recommendation.
Skip to main content
Local-first architecture review
Go beyond a findings list.
CDK Insights can explain the shape, change risk, resilience and live drift of an estate before deployment. These tools use synthesized templates locally and consume no AI credits.
cdk-insights graphArchitecture and attack paths
Build a resource relationship graph and highlight dependency paths from public entry points to sensitive data services.
cdk-insights simulateReliability simulation
Review Availability Zone resilience, dependency isolation, quota pressure and regional recovery assumptions without touching AWS.
cdk-insights policyInfrastructure contracts
Enforce required tags, forbidden resource types, public-entry limits and maximum deployment risk as version-controlled policy.
cdk-insights liveRead-only live comparison
Compare cdk.out with the deployed CloudFormation template and existing drift results. The command never starts drift detection and never mutates AWS.
cdk-insights learnIncident-to-rule learning
Turn a structured incident report into an auditable local custom rule plus a Markdown postmortem, keeping incident data on your machine.
cdk-insights planGit history plan advisor
Combine synthesized resource counts, infrastructure change frequency, cache reuse and model rates into an explained monthly credit estimate.
cdk-insights documentArchitecture documentation
Generate version-controlled Markdown with a Mermaid graph, estate inventory and public-to-sensitive path notes.
A practical release gate
Save a known-good baseline once, then reuse the same synthesized assembly across each guard to avoid repeated CDK synthesis.
npx cdk-insights preview --write-baseline
# In CI after cdk synth
npx cdk-insights preview --no-synth --fail-on review
npx cdk-insights policy check --no-synth
npx cdk-insights simulate --no-synth --fail-on-highLive AWS, read-only
Use a read-only profile. CDK Insights calls GetTemplate, DescribeStacks and DescribeStackResourceDrifts only.
AWS_PROFILE=audit npx cdk-insights live --stack ProductionStackMCP and editor access
Run cdk-insights mcp to expose architecture, reliability, documentation and plan-advisor tools to compatible editors and assistants.
For native diagnostics, generate SARIF and open it in your editor's SARIF viewer.
Configure MCP step by step →Use cdk-insights document --file docs/architecture.md to keep a reviewable Mermaid diagram beside the code that produced it. See the architecture documentation guide for a CI freshness check.