Querying the Current Configuration State of Amazon Resources - Amazon Config
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China.

Querying the Current Configuration State of Amazon Resources

You can use Amazon Config to query the current configuration state of Amazon resources based on configuration properties for a single account and Region or across multiple accounts and Regions. You can perform ad hoc, property-based queries against current Amazon resource state metadata across a list of resources that Amazon Config supports. For more information on the list of supported resource types, see Supported Resource Types for Advanced Queries.

The advanced query feature provides a single query endpoint and a powerful query language to get current resource state metadata without performing service-specific describe API calls. You can use configuration aggregators to run the same queries from a central account across multiple accounts and Amazon Regions.

Amazon Config uses a subset of structured query language (SQL) SELECT syntax to perform property-based queries and aggregations on the current configuration item (CI) data. The queries range in complexity from simple matches against tag and/or resource identifiers, to more complex queries, such as viewing all Amazon S3 buckets that have versioning disabled. This allows you to query exactly the current resource state you need without performing Amazon service-specific API calls.

You can use advanced query for:

  • Inventory management; for example, to retrieve a list of Amazon EC2 instances of a particular size.

  • Security and operational intelligence; for example, to retrieve a list of resources that have a specific configuration property enabled or disabled.

  • Cost optimization; for example, to identify a list of Amazon EBS volumes that are not attached to any EC2 instance.

  • Compliance data; for example, to retrieve a list of all your conformance packs and their compliance status.


The query language supports querying Amazon resources based on CI properties of all Amazon resource types supported by Amazon Config, including configuration data, tags, and relationships. It is a subset of SQL SELECT command with limitations, as mentioned in the following section. It supports aggregation functions such as AVG, COUNT, MAX, MIN, and SUM.


Advanced queries supports a subset of the resource types supported by Amazon Config. For a list of those supported resource types, see Supported Resource Types for Advanced Queries.


As a subset of SQL SELECT, the query syntax has following limitations:

  • No support for ALL, AS, DISTINCT, FROM, HAVING, JOIN, and UNION keywords in a query. NULL value queries are not supported.

  • No support for querying on third-party resources. Third-party resources retrieved using advanced queries will have the configuration field set as NULL.

  • No support for nested structures (such as tags) to be unpacked with SQL queries.

  • CIDR notation is converted to IP ranges for search. This means that "=" and "BETWEEN" search for any range that includes the provided IP, instead of for an exact one. To search for an exact IP range, you need to add in additional conditions to exclude IPs outside of the range. For example, to search for and only that IP block, you can do:

    SELECT * WHERE resourceType = 'AWS::EC2::SecurityGroup' AND configuration.ipPermissions.ipRanges BETWEEN '' AND '' AND NOT configuration.ipPermissions.ipRanges < '' AND NOT configuration.ipPermissions.ipRanges > ''

    For, you can search in a similar fashion:

    SELECT * WHERE resourceType = 'AWS::EC2::SecurityGroup' AND configuration.ipPermissions.ipRanges = '' AND NOT configuration.ipPermissions.ipRanges > '' AND NOT configuration.ipPermissions.ipRanges < ''
  • When querying against multiple properties within an array of objects, matches are computed against all the array elements. For example, for a resource R with rules A and B, the resource is compliant to rule A but noncompliant to rule B. The resource R is stored as:

    { configRuleList: [ { configRuleName: 'A', complianceType: 'compliant' }, { configRuleName: 'B', complianceType: 'non_compliant' } ] }

    R will be returned by this query:

    SELECT configuration WHERE configuration.configRuleList.complianceType = 'non_compliant' AND configuration.configRuleList.configRuleName = 'A'

    The first condition configuration.configRuleList.complianceType = 'non_compliant' is applied to ALL elements in R.configRuleList, because R has a rule (rule B) with complianceType = ‘non_compliant’, the condition is evaluated as true. The second condition configuration.configRuleList.configRuleName is applied to ALL elements in R.configRuleList, because R has a rule (rule A) with configRuleName = ‘A’, the condition is evaluated as true. As both conditions are true, R will be returned.

  • The SELECT all columns shorthand (that is SELECT *) selects only the top-level, scalar properties of a CI. The scalar properties returned are accountId, awsRegion, arn, availabilityZone, configurationItemCaptureTime, resourceCreationTime, resourceId, resourceName, resourceType, and version.

  • Wildcard limitations:

    • Wildcards are supported only for property values and not for property keys (for example, ...WHERE someKey LIKE 'someValue%' is supported but ...WHERE 'someKey%' LIKE 'someValue%' is not supported).

    • Support for only suffix wildcards (for example, ...LIKE 'AWS::EC2::%' and ...LIKE 'AWS::EC2::_' is supported but ...LIKE '%::EC2::Instance' and ...LIKE '_::EC2::Instance'is not supported).

    • Wildcard matches must be at least three characters long (for example, ...LIKE 'ab%' and ...LIKE 'ab_' is not allowed but ...LIKE 'abc%' and ...LIKE 'abc_' is allowed).


    The "_" (single underscore) is also treated as a wildcard.

  • Aggregation limitations:

    • Aggregate functions can accept only a single argument or property.

    • Aggregate functions cannot take other functions as arguments.

    • GROUP BY with an ORDER BY clause referencing aggregate functions may contain only a single property.

    • For all other aggregations GROUP BY clauses may contain up to three properties.

    • Pagination is supported for all aggregate queries except when ORDER BY clause has an aggregate function. For example, GROUP BY X, ORDER BY Y does not work if Y is an aggregate function.

    • No support for HAVING clauses in aggregations.

Region Support

Advanced queries is supported in the following Regions:

Region name Region Endpoint Protocol
Africa (Cape Town) af-south-1 config.af-south-1.amazonaws.com HTTPS
Asia Pacific (Hong Kong) ap-east-1 config.ap-east-1.amazonaws.com HTTPS
Asia Pacific (Mumbai) ap-south-1 config.ap-south-1.amazonaws.com HTTPS
Asia Pacific (Seoul) ap-northeast-2 config.ap-northeast-2.amazonaws.com HTTPS
Asia Pacific (Singapore) ap-southeast-1 config.ap-southeast-1.amazonaws.com HTTPS
Asia Pacific (Sydney) ap-southeast-2 config.ap-southeast-2.amazonaws.com HTTPS
Asia Pacific (Tokyo) ap-northeast-1 config.ap-northeast-1.amazonaws.com HTTPS
Amazon GovCloud (US-East) us-gov-east-1 config.us-gov-east-1.amazonaws.com HTTPS
Amazon GovCloud (US-West) us-gov-west-1 config.us-gov-west-1.amazonaws.com HTTPS
Canada (Central) ca-central-1 config.ca-central-1.amazonaws.com HTTPS
China (Beijing)* cn-north-1 config.cn-north-1.amazonaws.com.cn HTTPS
China (Ningxia)* cn-northwest-1 config.cn-northwest-1.amazonaws.com.cn HTTPS
Europe (Frankfurt) eu-central-1 config.eu-central-1.amazonaws.com HTTPS
Europe (Ireland) eu-west-1 config.eu-west-1.amazonaws.com HTTPS
Europe (London) eu-west-2 config.eu-west-2.amazonaws.com HTTPS
Europe (Milan) eu-south-1 config.eu-south-1.amazonaws.com HTTPS
Europe (Paris) eu-west-3 config.eu-west-3.amazonaws.com HTTPS
Europe (Stockholm) eu-north-1 config.eu-north-1.amazonaws.com HTTPS
Middle East (Bahrain) me-south-1 config.me-south-1.amazonaws.com HTTPS
South America (São Paulo) sa-east-1 config.sa-east-1.amazonaws.com HTTPS
US East (N. Virginia) us-east-1 config.us-east-1.amazonaws.com HTTPS
US East (Ohio) us-east-2 config.us-east-2.amazonaws.com HTTPS
US West (N. California) us-west-1 config.us-west-1.amazonaws.com HTTPS
US West (Oregon) us-west-2 config.us-west-2.amazonaws.com HTTPS

*Saved queries is not available in China (Beijing), and China (Ningxia) Regions.

*Advanced queries for multi-account multi-regions is not available in China (Beijing), and China (Ningxia) Regions.