It is quite convenient to use the AWS Config advance queries against the aggregator, a simple use case is like – Find out which instances in which accounts have public IP address cross the organisation.
Instead of writing a script to describe instances across all the accounts, we can just simply run the following query in AWS config console.
The results can be exported in json or csv format. Just bear in mind that the query results are paginated. When you choose export, up to 500 results are exported.
The query can be run in AWS CLI as well:
Check the supported aws-config-resource-schema, there are so many things you can do with the query.
As a quick summary, here is what you need to run AWS Config advance queries against the aggregator: