AWS Config Advance Queries against Aggregator sample

It is quite convenient to use the AWS Config advance queries against the aggregator, a simple use case is like – Find out which instances in which accounts have public IP address cross the organisation.

Instead of writing a script to describe instances across all the accounts, we can just simply run the following query in AWS config console.

	SELECT
	accountId,
	configuration.instancdId,
	configuration.publicIp,
	configuration.ipv6Addresses
	WHERE
	resourceType = 'AWS::EC2::Instance'
	AND (
	configuration.publicIp BETWEEN '0.0.0.0'
	AND '255.255.255.255'
	OR configuration.ipv6Addresses BETWEEN '0:0:0:0:0:0:0:0'
	AND 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff'
	)

view raw aws_config_query_sample.sql hosted with ❤ by GitHub

The results can be exported in json or csv format. Just bear in mind that the query results are paginated. When you choose export, up to 500 results are exported.

The query can be run in AWS CLI as well:

	export aggregator="REPLACE_WITH_YOUR_AGGREGATOR_NAME"
	export query="SELECT accountId, configuration.instancdId, configuration.publicIp, configuration.ipv6Addresses WHERE resourceType = 'AWS::EC2::Instance' AND (configuration.publicIp BETWEEN '0.0.0.0' AND '255.255.255.255' OR configuration.ipv6Addresses BETWEEN '0:0:0:0:0:0:0:0' AND 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff')"
	aws configservice select-aggregate-resource-config –expression $query –configuration-aggregator-name $aggregator

view raw aws_config_query_sample.sh hosted with ❤ by GitHub

Check the supported aws-config-resource-schema, there are so many things you can do with the query.

As a quick summary, here is what you need to run AWS Config advance queries against the aggregator:

• Enable Config recording
• Create an aggregator

Enjoy 😉