cloudquery.md

CloudQuery for identifying public network endpoints

You can try creating these in the CloudQuery portal.

• API Gateways
• CloudFront Distributions
• EC2 instances with Public IPs
• ElasticSearch
• ElastiCache
• ELB Classic
• ELBv2
• EMR
• Redshift
• RDS

The following resources are not supported today by CloudQuery, but are coming soon:

• Elastic IPS that are not attached to EC2 Instances
• ElastiCache
• Global Accelerator
• Lightsail
• NeptuneDB

Supported Today

API Gateways

select id, hostname, ip_addresses, account_id, region from aws_api_gateway where public_ipaddress is not null

CloudFront Distributions

select domain_name, account_id, arn  from aws_cloudfront_distributions

EC2 instances with Public IPs

select id, public_dns_name, public_ip_address, account_id, region from aws_ec2_instances where public_ip_address is not null

Note: this covers ECS, EKS, Beanstalk, Fargate, Batch, & NAT Instances.

ElasticSearch

select * from aws_elasticsearch_domains where endpoint is not null or endpoints->'vpc' is not null;

ELB Classic

select id, hostname, ip_addresses, account_id, region from aws_elb where public_ip_address is not null

ELBv2

SELECT name, dns_name, account_id, region FROM aws_elbv2_load_balancers WHERE scheme = 'internet-facing';

EMR

-- TODO

Redshift

select account_id, region, id, endpoint_address, endpoint_port from aws_redshift_clusters;

RDS

select id, hostname, ip_addresses, account_id, region from aws_rds_clusters where public_ip_address is not null

Not supported yet

Elastic IPs that are not attached to EC2 Instances

This resource is not supported yet. For more details on this resource, see the entry in Scott Piper's aws_exposable_resources.

ElastiCache

This resource is not supported yet. For more details on this resource, see the entry in Scott Piper's aws_exposable_resources.

Global Accelerator

This resource is not supported yet. For more details on this resource, see the entry in Scott Piper's aws_exposable_resources.

Lightsail

This resource is not supported yet. For more details on this resource, see the entry in Scott Piper's aws_exposable_resources.

NeptuneDB

This resource is not supported yet. For more details on this resource, see the entry in Scott Piper's aws_exposable_resources.

Prior Art

• AWS Exposable Resources by Scott Piper
• aws_public_ips by Arkadiy Tetelman