AWS Config Advance Queries against Aggregator sample


It is quite convenient to use the AWS Config advance queries against the aggregator, a simple use case is like – Find out which instances in which accounts have public IP address cross the organisation.

Instead of writing a script to describe instances across all the accounts, we can just simply run the following query in AWS config console.

SELECT
accountId,
configuration.instancdId,
configuration.publicIp,
configuration.ipv6Addresses
WHERE
resourceType = 'AWS::EC2::Instance'
AND (
configuration.publicIp BETWEEN '0.0.0.0'
AND '255.255.255.255'
OR configuration.ipv6Addresses BETWEEN '0:0:0:0:0:0:0:0'
AND 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff'
)

The results can be exported in json or csv format. Just bear in mind that the query results are paginated. When you choose export, up to 500 results are exported.

The query can be run in AWS CLI as well:

export aggregator="REPLACE_WITH_YOUR_AGGREGATOR_NAME"
export query="SELECT accountId, configuration.instancdId, configuration.publicIp, configuration.ipv6Addresses WHERE resourceType = 'AWS::EC2::Instance' AND (configuration.publicIp BETWEEN '0.0.0.0' AND '255.255.255.255' OR configuration.ipv6Addresses BETWEEN '0:0:0:0:0:0:0:0' AND 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff')"
aws configservice select-aggregate-resource-config –expression $query –configuration-aggregator-name $aggregator

Check the supported aws-config-resource-schema, there are so many things you can do with the query.

As a quick summary, here is what you need to run AWS Config advance queries against the aggregator:

Enjoy 😉

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s