Use filter queries to search the Asset Inventory without writing SQL.

Full-text Search

Type a search query to find the categorized resources containing the searched value in one of their properties (table columns).

Examples

Return all categorized resources that are related to an IP address, such as an instance and the actual IP address resource.

Find an instance by name

Searching by Tags

Because tags are stored as a map type, you can use Array and Map operators. You can also use this short-hand syntax to search for a tag with a specific key and value:

Examples

Return assets where tags contains key service .

Return assets where tags contains a key that has the substringservice

Return assets where tags contains key service and value picture-service

tags.service = "picture-service"

Return assets where tags contains key “service” and pattern-match picture anywhere in the value.

tags.service = "*picture*"

Searching in JSON columns

You can use dot notation to search deep in nested JSON in JSON columns.

Examples

Find instances with public IP interface attachments (network_interfaces is a column in the aws_ec2_instances table).

network_interfaces.*.Association.PublicIp != ""

Escaping special characters

Use backslash \ to escape special characters that have other meaning, such as asterisk * .

Basic Comparison Operators

Equals (=, !=)

String values should be wrapped in double quotes.

Examples

Return assets where name is aws-mysql-db

Return assets where name is z1d.xlarge

Return assets where name begins with aws

Return assets where ebs_optimized is false

Return assets where instance_id is ID 123456789

Return assets where name does not begin with z1d

Greater Than, Equals (>, >=)

Examples

Return assets where ami_launch_index is greater than 5

Return assets where ami_launch_index is greater than or equal to 5

Less Than, Equals (<, <=)

Examples

Return assets where ami_launch_index is less than 10

Return assets where ami_launch_index is less than or equal to 10

Logical Operators

AND

expression1 AND expression2

Examples

Return assets where name is aws-mysql-db AND ebs_optimized is false

name = "aws-mysql-db" AND ebs_optimized = false

OR

expression1 OR expression2

Examples

Return assets where name is aws-mysql-db OR ebs_optimized is false

name = aws-mysql-db OR ebs_optimized = false

NOT

Examples

Return assets where name is not aws-mysql-db

NOT name = "aws-mysql-db"

Grouping ((…))

(expression1 OR expression2) AND expression3

Examples

Return assets where name is either aws-mysql-db OR aws-oracle-db, AND ebs_optimized is false

(name = "aws-mysql-db" OR name = "aws-oracle-db") AND ebs_optimized = false

Set Membership Operators

Includes (IN, NOT IN)

column IN (value1, value2, value3)

Examples

Return assets where region is either eu-west-1 OR us-east-1

region IN ("eu-west-1", "us-east-1")

Null and Empty Operators

Null and Empty operators can be used to check for empty values.

Null checks are applicable when the column type is int, string, boolean, or similar basic types (including JSON).

Empty checks are applicable when the column type is map, array, or similar container type.

Null (IS NULL, IS NOT NULL)

Examples

Return assets where name is null

Return assets where name is NOT null

Empty (IS EMPTY, IS NOT EMPTY)

Examples

Return assets where tags is empty

Return assets where tags is NOT empty

Array and Map Operators

Array Contains (CONTAINS)

Examples

Return assets where network_interface_ids contains a specific ID:

network_interface_ids CONTAINS "69415778-d961-5161-9ee3-82d310d04089"

Return assets where network_interface_ids contains a pattern match:

network_interface_ids CONTAINS "69415778-*"

Map Contains (CONTAINS)

column CONTAINS key:value

Examples

Return assets where tags contains the value picture-service .

tags CONTAINS picture-service

Return assets where tags contains a value that has the substringservice

Return assets where tags contains key service and value picture-service

tags CONTAINS service:picture-service

Return assets where tags contains key “service” and pattern-match picture anywhere in the value.

tags CONTAINS service:*picture*

Next Steps

• Asset Inventory - Use search syntax to find and filter assets
• Filters & Queries - Overview of filter and query capabilities
• Policies - Use filter expressions when defining policies