CloudQuery

• Why you need a cloud asset inventory (yes, even you)
• How to sync your AWS data and actually make sense of it
• A simple, repeatable way to keep your inventory fresh

What is a Cloud Asset Inventory? #

Why Bother with a Cloud Asset Inventory for AWS? #

• Security – Find what’s exposed before hackers do.
• Compliance – Know where your data lives.
• FinOps – Stop paying for things you don’t use.

How to Sync Your AWS Cloud Config Data #

Step 1: Sign Up for CloudQuery #

Step 2: Set Up Your Data Sync #

Step 3: Run Your Data Sync #

Making Your Cloud Inventory Actually Useful #

• Security teams need to lock down misconfigurations before they turn into headline-worthy breaches.
• Governance teams want to cross-check policies without manually clicking through the AWS console (because that’s a special kind of pain).
• FinOps folks are on a mission to find and kill zombie resources before they eat the budget.

Security Teams: Find Misconfigurations and Exposed Resources #

Find all publicly accessible S3 buckets #

SELECT
    name,
    region,
    public_access
FROM
    aws_s3_buckets
WHERE
    public_access = true;

List security groups with open SSH (port 22) access to the world #

SELECT
    security_group_id,
    description,
    ip_permissions
FROM
    aws_ec2_security_groups
WHERE
    '0.0.0.0/0' = ANY(ip_permissions -> 'IpRanges');

Detect EC2 instances without encryption enabled on their root volumes #

SELECT
    instance_id,
    instance_type,
    volume_id,
    encrypted
FROM
    aws_ec2_volumes
WHERE
    encrypted = false;

Governance Teams: Cross-check Infrastructure Against Policies #

Find all IAM users who haven’t logged in for 90+ days #

SELECT
    user_name,
    last_login
FROM
    aws_iam_users
WHERE
    last_login < NOW() - INTERVAL '90 days';

Identify untagged resources (cost allocation + compliance tracking) #

SELECT
    resource_id,
    resource_type,
    tags
FROM
    aws_tagging_resources
WHERE
    tags IS NULL OR jsonb_array_length(tags) = 0;

Check which AWS regions are in use (avoid shadow IT) #

SELECT
    DISTINCT region
FROM
    aws_ec2_instances;

FinOps Teams: Identify Cost Savings Opportunities #

Find unused EC2 instances (low CPU usage over time) #

SELECT
    instance_id,
    instance_type,
    AVG(cpu_utilization) as avg_cpu_usage
FROM
    aws_cloudwatch_metrics
WHERE
    metric_name = 'CPUUtilization'
GROUP BY
    instance_id, instance_type
HAVING
    AVG(cpu_utilization) < 5;

Find unattached EBS volumes (orphaned storage costs) #

SELECT
    volume_id,
    size_gb,
    state
FROM
    aws_ec2_volumes
WHERE
    state = 'available';

Spot over-provisioned RDS instances (low CPU & memory usage) #

SELECT
    db_instance_identifier,
    db_instance_class,
    AVG(cpu_utilization) as avg_cpu_usage,
    AVG(memory_utilization) as avg_memory_usage
FROM
    aws_rds_metrics
WHERE
    metric_name IN ('CPUUtilization', 'FreeableMemory')
GROUP BY
    db_instance_identifier, db_instance_class
HAVING
    AVG(cpu_utilization) < 10 AND AVG(memory_utilization) < 20;

Final Word #

• Why you need an AWS cloud asset inventory (because surprise bills and security gaps are fun for no one).
• How to set up CloudQuery and sync your AWS resources for a complete, up-to-date inventory.
• How different teams—Security, Governance, and FinOps—can query this data to solve real problems.

Additional Resources #

• CloudQuery Platform API
• CloudQuery REST API Guide
• Google Cloud Asset Inventory 101
• What is a Cloud Asset Inventory?
• Cloud Asset Inventory with AWS QuickSight
• Build an AWS Cloud Asset Inventory

FAQs #