AWS Config Advance Queries against Aggregator sample

Cloud 1 Minute

It is quite convenient to use the AWS Config advance queries against the aggregator, a simple use case is like – Find out which instances in which accounts have public IP address cross the organisation.

Instead of writing a script to describe instances across all the accounts, we can just simply run the following query in AWS config console.

SELECT
accountId,
configuration.instancdId,
configuration.publicIp,
configuration.ipv6Addresses
WHERE
resourceType = 'AWS::EC2::Instance'
AND (
configuration.publicIp BETWEEN '0.0.0.0'
AND '255.255.255.255'
OR configuration.ipv6Addresses BETWEEN '0:0:0:0:0:0:0:0'
AND 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff'
)
view raw aws_config_query_sample.sql hosted with ❤ by GitHub

The results can be exported in json or csv format. Just bear in mind that the query results are paginated. When you choose export, up to 500 results are exported.

The query can be run in AWS CLI as well:

export aggregator="REPLACE_WITH_YOUR_AGGREGATOR_NAME"
export query="SELECT accountId, configuration.instancdId, configuration.publicIp, configuration.ipv6Addresses WHERE resourceType = 'AWS::EC2::Instance' AND (configuration.publicIp BETWEEN '0.0.0.0' AND '255.255.255.255' OR configuration.ipv6Addresses BETWEEN '0:0:0:0:0:0:0:0' AND 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff')"
aws configservice select-aggregate-resource-config –expression $query –configuration-aggregator-name $aggregator
view raw aws_config_query_sample.sh hosted with ❤ by GitHub

Check the supported aws-config-resource-schema, there are so many things you can do with the query.

As a quick summary, here is what you need to run AWS Config advance queries against the aggregator:

Enjoy 😉

Unknown's avatar

Published by Jackie Chen

Published

One thought on “AWS Config Advance Queries against Aggregator sample”

  1. Pingback: AWS Config Advanced Query Supported Regions – Jackie Chen's IT Workshop

Leave a comment