Guardrail for AWS Console

Confirm before destructive AWS Console actions (Terminate, Delete bucket/DB/Function, 0.0.0.0/0 rules) on production accounts.

A safety net for developers, SREs, and cloud admins who switch between AWS accounts all day. The AWS Console has some friction on destructive actions (typing a bucket name to delete S3, the "delete me" confirmation on RDS) — but it's piecemeal, and it isn't account-aware. Nothing stops you from terminating an EC2 instance in production with a single click because you thought you were in dev. Nothing warns you that the security-group rule you're about to save opens SSH to 0.0.0.0/0 on a prod account. Guardrail adds uniform, account-aware confirmation on the AWS Console actions that AWS doesn't. WHAT IT DOES • Confirm-before-action — on a guarded account, clicking Terminate Instance, Delete Bucket, Delete (DB), or Delete Function pops a confirmation that names the account. • 0.0.0.0/0 form scan — when you click Save rules / Add rule, the form is scanned for 0.0.0.0/0; if present, the modal warns specifically. • PROD account banner — the detected account ID + region across the top of every Console page, color-coded. • Root-user warning — a separate prominent bar when you're signed in as the root user. • Configurable rules — add your own button labels to guard, mark accounts as production or non-production from the popup. PRIVACY Guardrail runs entirely on your device. It has no backend, no account, no telemetry — it makes zero network requests. The AWS account ID is read from the page DOM (NOT from your session cookie); your AWS resources, credentials, and session data never leave your browser. All code is bundled — no remote code. Source on GitHub. Full policy: https://codedigital-software.github.io/legal/guardrail-aws-privacy.html Not affiliated with or endorsed by Amazon Web Services. AWS is a trademark of Amazon.com, Inc.