AWS queries
Cloud computing services by AWS.
| Query | Description | Verb | Required params |
|---|---|---|---|
| Cloud Control resource request by token draft | Gets the progress event for one Cloud Control resource request by its request token; poll it until the operation completes. | select | region request_token |
| Cloud Control resource requests by status | Lists recent Cloud Control resource requests in a region filtered by operation and status; the follow-up surface for asynchronous AWS mutations. | select | region operation operation_status |
| Launch an EC2 instance draft | Launches an EC2 instance through Cloud Control, returning a progress event to poll; user data must be base64 encoded. | mutation | region image_id instance_type subnet_id user_data tags |
| EC2 instance state and lifecycle control | Reports instance state and health checks for a region, and covers the stop and start lifecycle operations that change it. | select | region |
| EC2 instance type specifications | Looks up vCPU, memory, architecture and capability details for named EC2 instance types; the architecture check before launching an instance. | select | region instance_type |
| EC2 instances in a region | Lists EC2 instances in one region with type, state, addressing and network placement. | select | region |
| Enabled AWS regions | Lists the AWS regions enabled for the account with endpoint, country and opt-in status; the valid fan-out list for region-swept queries. | select | - |
| IAM access key age and rotation status | Lists a user's access keys with their age in days; keys older than the rotation window are the finding. | select | user_name |
| IAM federated identity providers | Inventories the SAML and OIDC identity providers registered in the account; the trusted federation surface behind assumable roles. | select | - |
| IAM account password policy vs CIS benchmark | Assesses the IAM account password policy against CIS AWS Foundations Benchmark password controls, returning raw values and per-control PASS/FAIL verdicts. | select | - |
| IAM roles trusting external accounts | Lists IAM roles whose trust policy admits principals from other AWS accounts, flagging external id and federation use; the cross-account exposure surface. | select | account_id |
| IAM users with console access and no MFA | Lists IAM users alongside whether they have a virtual MFA device registered; console-capable users without MFA are the finding. | select | - |
| IAM users enumeration | Enumerates IAM users in the account; IAM is global and always served from us-east-1, so the query takes no parameters. | select | - |
| Lambda fleet analytics by runtime and architecture | Summarises a region's Lambda functions by runtime and architecture with counts and memory totals; the runtime modernisation and Graviton migration view. | select | region |
| Lambda functions in a region | Lists Lambda functions in one region with runtime, architecture, memory, timeout and execution role in a single call. | select | region |
| Lambda functions with public resource policies draft | Reads a Lambda function's resource policy and flags statements granting invoke rights to a wildcard principal; the public-invoke exposure check. | select | region function_name |
| Set CloudWatch log group retention draft | Updates RetentionInDays on a CloudWatch log group via an asynchronous Cloud Control update. | mutation | region log_group_name retention_days |
| S3 bucket security detail | Full security configuration for one bucket: public access block, encryption, versioning, ownership controls and logging. | select | region bucket_name |
| S3 buckets cheap enumeration | Enumerates every S3 bucket in the account with its ARN, home region and creation date in one account-global call. | select | - |
| S3 bucket public access block audit | Reports the four block-public-access settings plus object ownership for a bucket; any flag returning 0 leaves a public exposure path open. | select | region bucket_name |
| Find AWS resource identifiers by tag | Resolves identifiers for ID-centric AWS resource types by querying the tagging API with a resource type and tag filter; returns ARNs, extracted ids and tags. | select | region resource_type tag_key tag_value |
draft marks entries not yet verified against a live provider by the nightly execution job; templates are still schema-validated and parse-checked in CI.