Skip to content


Folders and files

Last commit message
Last commit date

Latest commit



29 Commits

Repository files navigation


Uses the AWS Cloud Control API to list resources that are present in a given AWS account and region(s). Discovered resources are written to a JSON output file. See the accompanying blog posts here and here.


Make sure you have AWS credentials configured for your target account. This can either be done using environment variables or by specifying a named profile in the optional --profile argument. Read-only IAM permissions are sufficient.

If you run the script against specific regions, it is recommended to also include the us-east-1 region. This ensures that resources of global AWS services are captured as well.

Example invocations:

pip install -r requirements.txt

python --regions us-east-1,eu-central-1

python --regions ALL

python --regions ALL --include-resource-types AWS::EC2::*,AWS::DynamoDB::* --exclude-resource-types AWS::EC2::DHCPOptions,AWS::EC2::VPCGatewayAttachment

Supported arguments

--exclude-resource-types  do not list the specified comma-separated resource types (supports wildcards)
--include-resource-types  only list the specified comma-separated resource types (supports wildcards)
--only-show-counts        only show resource counts instead of listing their full identifiers
--profile PROFILE         named AWS profile to use
--regions REGIONS         comma-separated list of target AWS regions or 'ALL'


  • The script will only be able to discover resources that are currently supported by the AWS Cloud Control API and offer support for the List operation:

    It is further restricted to those resources where the List operation does not expect any additional parameters.

  • If the IAM user or role you use to run the script does not have permissions to interact with certain AWS services or regions, those resources will be missed. Note that permissions can be restricted on different levels, such as SCPs, identity-based polices, etc. The JSON output file will contain a list of resource types where listing was denied.

  • The JSON output file will also contain default resources that were created by AWS, independent of whether you actually used the service or not.

  • To speed up execution of the script, run it within an AWS region (e.g., on EC2 or CloudShell) instead of your local machine.

Example output file

Truncated example JSON output file:

  "_metadata": {
    "account_id": "123456789012",
    "account_principal": "arn:aws:iam::123456789012:user/myuser",
    "invocation": " --regions us-east-1,eu-central-1",
    "run_timestamp": "20221020084237"
    // ...
  "regions": {
    "us-east-1": {
      "AWS::Athena::DataCatalog": [
      "AWS::CloudFront::CachePolicy": [
      "AWS::EC2::DHCPOptions": [
      "AWS::EC2::InternetGateway": [
      "AWS::EC2::NetworkAcl": [
      "AWS::EC2::RouteTable": [
      "AWS::IAM::Role": [
      // ...


No description, website, or topics provided.







No releases published


No packages published