Not safe to delete. Attached to 3 prod resources. Owned by the payments team.
| Resource | Type | Account | Team |
|---|---|---|---|
| payments-api | EC2 | prod-payments | payments |
| payments-db | RDS | prod-payments | payments |
| alb-checkout | ALB | prod-edge | platform |
Know what’s running
in your AWS, and what breaks if you touch it.
Every resource in every account, in one inventory inside your cloud. Ask who owns it, what depends on it, what changed.
Can I delete sg-0a1b2c3d? What depends on it, and who created it?
What uses the expiring checkout cert, and who can renew it?
Renew this week. Auto-renewal is failing. Owned by the platform team.
| Resource | Type | Account | Team |
|---|---|---|---|
| alb-checkout | ALB | prod-edge | platform |
| alb-checkout-canary | ALB | prod-edge | platform |
| cf-checkout-assets | CloudFront | prod-edge | web |
Who owns vol-0c4e19f2a7, and is anyone still using it?
Safe to delete after one check. Its creator left, and nothing has used it in 207 days.
| Resource | Type | Account | Team |
|---|---|---|---|
| vol-0c4e19f2a7 | EBS volume | data-eng-prod | none |
| i-07b2e5c91d | EC2 | data-eng-prod | data-eng |
| snap-0a91f3e4b2 | EBS snapshot | data-eng-prod | data-eng |
Four questions you get every week. None of them should take a day.
Real answers from a demo AWS org. Pick a question.
You run 150+ accounts. Every question means logging into each one, or filing a ticket and waiting on another team.
Every VM across AWS, Azure and GCP with no owner tag.
214 VMs have no owner tag.
151 in AWS, 41 in Azure, 22 in GCP. 63 were created in the last 90 days.
| Resource | Type | Account | Created by |
|---|---|---|---|
| ml-train-07 | EC2 | research-sandbox | svc-terraform |
| vm-reporting-02 | Azure VM | finance-prod | k.ahmed@… |
| batch-runner-3 | Compute Engine | data-eng-prod | p.lindqvist@…(left the company) |
UsesAWSAzureGCP
select 'EC2' as type, instance_id, account_id from aws_ec2_instances where tags->>'owner' is null union all select 'Azure VM', name, subscription_id from azure_compute_virtual_machines where tags->>'owner' is null union all select 'Compute Engine', name, project_id from gcp_compute_instances where labels->>'owner' is null;
The engineer who launched it left six months ago. Now it’s flagged, and nobody will claim it.
Which resources does this Wiz finding affect, and who owns them?
The finding touches 6 resources in 3 accounts.
Payments owns 4 and data-platform owns 2. Payments on call: r.silva, via PagerDuty.
| Resource | Type | Account | Team |
|---|---|---|---|
| payments-receipts | S3 bucket | prod-payments | payments |
| receipts-export | Lambda | prod-payments | payments |
| etl-receipts | Glue job | data-prod | data-platform |
UsesAWS
OktaPagerDuty
select e.name as resource, e.type, e.account, e.tags->>'team' as team from wiz_issues i join wiz_issue_entities e on e.issue_id = i.id where i.status = 'OPEN' and i.severity = 'CRITICAL';
A critical CVE lands. Finding everywhere that version runs takes three tools and a round of phone calls.
Which hosts run a package affected by CVE-2026-…?
41 hosts in 9 accounts run an affected version.
12 of them face the internet. Platform owns 19, payments 14, search 8.
| Host | Account | Team | Exposure |
|---|---|---|---|
| edge-proxy-4 | prod-edge | platform | Internet-facing |
| payments-api-3 | prod-payments | payments | Internet-facing |
| search-indexer-1 | prod-search | search | Internal |
UsesAWSSnyk
select h.hostname as host, a.name as account, h.tags->>'team' as team,
case when h.public_ip is null then 'Internal' else 'Internet-facing' end as exposure
from crowdstrike_hosts h
join aws_organizations_accounts a on a.id = h.account_id
join snyk_issues s on s.package_name = any (h.packages)
where s.identifiers->>'CVE' like 'CVE-2026-%';Prod broke overnight, or audit wants every manual change from last quarter. Either way, you’re piecing CloudTrail together by hand.
What changed in prod-payments in the last 24 hours, and who changed it?
17 changes in prod-payments. 2 were made by hand.
The other 15 came from ci-deploy-role. Both manual changes came from one person in the console, 17 minutes apart.
| Time | Resource | Change | Changed by |
|---|---|---|---|
| 02:14 | sg-04f8e21b | Inbound rule added: 0.0.0.0/0 on 5432 | m.kowal@…(console) |
| 02:31 | payments-db | Parameter group changed | m.kowal@…(console) |
| 09:02 | payments-api | Task definition updated | ci-deploy-role |
UsesAWSOkta
select event_time, resources->0->>'ARN' as resource, event_name, user_identity->>'arn' as changed_by from aws_cloudtrail_events where recipient_account_id = 'prod-payments' and event_time > now() - interval '24 hours' and read_only = false order by event_time desc;
Three steps. All of it runs in your account.
Deploy.
One stack in your AWS account: the sync, a Postgres database and an MCP server.
Connect.
Point it at your AWS Organization and every account comes in. Add Azure, GCP and Kubernetes, then the tools that know what your cloud APIs don’t.
Ask.
Ask Claude, Cursor or any MCP-compatible agent in plain English. Prefer SQL? Query Postgres directly or plug in your BI tool.
Your inventory never leaves your account.
CloudQuery runs entirely in your own cloud account, so we never see your inventory. If FedRAMP, GDPR or data-residency rules keep data in your environment, it stays there.
Self-hosted
The database, the sync and the MCP server all run in your account.
Works air-gapped
The license is validated locally, so it runs with no connection to CloudQuery endpoints.
Telemetry you control
Telemetry can be turned off.
Stop asking around. Ask your cloud.
Deploy CloudQuery in your AWS account and ask your first question.