Let’s Be Real…
If you work in cloud operations or security, you know the feeling: you log in and it’s like a fire alarm is going off in a library. A sea of red notifications. A flood of emails. Dashboards screaming for your attention. It’s called alert fatigue, and it’s a real problem.
I hit my breaking point a few months ago while juggling multiple AWS accounts. Getting a simple, bird’s-eye view of our security posture felt impossible. Sure, AWS Security Hub is powerful—but I needed that instant “are-we-okay-or-not?” clarity.
So I built my own dashboard. Simple, real-time, and customized to my needs. The stack? AWS Security Hub, Amazon EventBridge, and a frontend built with Svelte—a framework I now swear by. Let me show you how it all came together.
The Brains of the Operation: Making Sense of the Noise
Step 1: Consolidating with AWS Security Hub
The first step was centralizing the data. AWS has powerful security services—GuardDuty, Inspector, Macie—but they operate in silos. AWS Security Hub acts as the aggregator, pulling everything together into one unified format. Now I had a centralized stream of findings across all tools and accounts.
Step 2: Going Real-Time with EventBridge and Lambda
Centralization is great—but I didn’t want to refresh dashboards all day. I wanted instant alerts.
So I created an event-driven pipeline:
- Security Hub generates a finding.
- Amazon EventBridge captures the event.
- A lightweight AWS Lambda function gets triggered.
- This function parses and simplifies the data, then sends it to a WebSocket API.
Think of the WebSocket as an open, real-time line from the cloud to my browser. No more polling. No more refreshing.
The Face of the Operation: Why I Chose Svelte
Once the backend was solid, I needed a frontend to bring it to life. I’ve worked with React, Vue, and Angular, but for this, I wanted something fast, intuitive, and minimal. I went with Svelte—and I’m glad I did.
Svelte compiles at build time, so there’s no runtime overhead. The app is tiny and blazingly fast, which is perfect for a real-time dashboard.
More importantly, Svelte made development fun again. To connect to the WebSocket stream, I just:
- Opened a connection.
- Appended incoming messages to a list.
- Let Svelte’s reactivity take care of rendering.
No complex state management. No clunky lifecycle methods. It just worked.
The Final Vision: A Single Pane of Sanity
Here’s what my custom dashboard looks like:
- Real-time alert feed on the left — scrolling cards that show the latest Security Hub findings.
- Interactive donut chart in the center — a visual breakdown of active findings by severity (Critical, High, Medium, etc.). Click on a slice to filter the feed instantly.
- Account breakdown widget — shows which AWS accounts are generating the most findings.
- Top issue types — a bar chart showing trends like open ports, misconfigured S3 buckets, or risky IAM policies.
It’s simple, clean, and best of all—it updates itself. No refresh needed.
Why This Was Worth It
This wasn’t about replacing AWS tools—it was about reframing them. I built a custom lens tailored to the signals that matter to me. And because it’s event-driven, I can expand it easily. Want to send critical alerts to Slack or SMS? Just modify the Lambda.
If you’re buried under security alerts and tired of dashboard overload, this project might be just what you need. It’s a great way to:
- Learn about event-driven architecture.
- Explore AWS integrations.
- Try a new frontend like Svelte.
- Reclaim control over your own security data.
You don’t have to be overwhelmed. With the right setup, you can see clearly—and respond faster.
Read more posts:- Using Temporal for Workflow Orchestration in Microservices
