Search Examples
Do you need help writing search syntax? Join us on Discord and we'll do our best to help!
Have you written a search others may find useful? Contributions to this page are welcome!
note
All queries listed here are safe to try out, as they will NOT modify your resources.
aws_alb
Orphaned Load Balancers that have no active backend
> search is(aws_alb) and age > 7d and backends==[]
with(empty, <-- is(aws_alb_target_group) and target_type = instance and age > 7d
with(empty, <-- is(aws_ec2_instance) and instance_status != terminated)
)
<-[0:1]- is(aws_alb_target_group) or is(aws_alb)
aws_iam_access_key
Ensure there is only one active access key available for any single IAM user
> search is(access_key) and access_key_status = "Active" |
aggregate user_name as user : sum(1) as number_of_keys
certificate
Find expired ssl certificates currently in use
> search is(certificate) and expires < @NOW@ <--
quota
Find current quota consumption to prevent service interruptions
> search is(quota) and usage > 0
volume
Find unused AWS volumes older than 30 days with no IO in the past 7 days
> search is(aws_ec2_volume) and age > 30d and last_access > 7d and last_update > 7d and volume_status = available