Skip to main content

Configuration Change History

Understanding how your cloud resources change over time is critical for security auditing, troubleshooting incidents, and maintaining compliance. CloudYali records configuration snapshots for your cloud resources and lets you navigate through versions and compare changes side by side.

How Change History Works​

CloudYali captures resource configuration snapshots during each sync cycle. When a resource's configuration changes between scans, a new version is recorded. You can:

  • View the full configuration at any point in time
  • Compare any two versions side by side
  • See exactly which fields were added, removed, or modified

Viewing Change History​

  1. Navigate to Asset Inventory and find a resource using the table or filters
  2. Click the resource row to open the Resource Detail Dialog
  3. Select the Configuration History tab

Configuration History timeline with version milestones

Timeline Navigation​

The timeline on the left side shows all recorded configuration versions:

  • Latest badge — The most recent version is marked with a "Latest" label
  • Version numbers — Each snapshot is numbered sequentially (v1, v2, v3, ...)
  • Timestamps — Each milestone shows when the change was detected
  • Click any milestone to view that version's full configuration

Version Comparison (Diff View)​

To compare two versions side by side:

  1. Select a version from the timeline to view it
  2. Select a second version to enter comparison mode
  3. A side-by-side diff view appears with highlighted changes

Side-by-side configuration diff with highlighted changes

Understanding the Diff​

The diff summary at the top shows three types of changes:

IndicatorMeaningColor
Added (+)Fields present in the newer version but not the olderGreen
Removed (-)Fields present in the older version but not the newerRed
ModifiedFields that changed value between versionsYellow

Changed field paths are shown as clickable chips (e.g., SecurityGroups.0.GroupId, Tags.Environment) for quick navigation to the specific change in the JSON tree.

Click Exit Compare to return to single-version view.

Change History by Provider​

Different cloud providers offer different levels of change tracking depth:

ProviderHistory TypeHistory DepthChange Metadata
AWSConfiguration snapshots via CloudTrail/Config syncFull history (retention-dependent)Timestamp only
GCPSnapshot-based via Cloud Asset Inventory APIUp to 35-day window from CAITimestamp only
AzureNative change tracking via Azure Resource GraphFull historyWho changed, how it was changed
FastlyCurrent state onlyNo history—
AnthropicCurrent state onlyNo history—

AWS Change History​

AWS resource configurations are captured during each snapshot sync cycle. When a resource's configuration changes between scans, a new version is created in the timeline. Checksums are used to detect changes efficiently.

Scan Interval

Rapid changes that occur between scan intervals may not be individually captured. Only the state at each scan time is recorded.

GCP Change History​

GCP uses the Cloud Asset Inventory API which provides a rolling 35-day history window. CloudYali retrieves the full history on the first sync and fetches incremental changes on subsequent runs.

Configurations older than 35 days are retained by CloudYali based on your subscription retention policy, but no new historical snapshots can be retrieved beyond the CAI window.

Azure Change History​

Azure provides the richest change metadata through Azure Resource Graph's native change tracking. In addition to the configuration diff, Azure change records include:

  • Who — The identity (user email or application ID) that made the change
  • How — The method used to make the change (e.g., Azure Portal, Azure CLI, Terraform, ARM template)
  • Change Type — Whether the change was a Create, Update, or Delete operation

This additional context is displayed in the change history timeline alongside the configuration diff.

Fastly and Anthropic​

Fastly and Anthropic resources show only the current configuration snapshot. The Configuration History tab displays the current JSON configuration without a timeline. As change history support is added for these providers, historical tracking will become available automatically.

Use Cases​

Security Auditing​

Review changes to security-sensitive resources like security groups, IAM policies, network configurations, or key vault settings. Identify unauthorized modifications by comparing versions and checking who made the change (Azure).

Incident Troubleshooting​

When an issue occurs, compare the current configuration with a known-good version to identify what changed. The diff view makes it easy to spot the exact fields that were modified — helping you pinpoint the root cause faster.

Compliance Evidence​

Maintain an auditable record of configuration changes for compliance frameworks that require change tracking. The version timeline provides evidence of when configurations were in specific states.

Last updated on