AWS

Manage EC2 instances, S3 buckets, and IAM directly from your dashboard.

Questions you can answer 102

Each one is a saved query that ships with ConfigView, reading your AWS data on your own server. Ask it in plain English, SQL, Slack or the API.

Which AWS admins have active access keys?
List long-lived access keys held by AWS admins with their age and last use
Does our AWS root account have an active access key?
Why does this principal have admin in AWS?
Show which policy attachment grants each AWS admin their access
Is AWS admin access coming from a group, an inline policy or a direct attachment?
Who has admin access in AWS?
List every AWS admin across IAM users, roles and Identity Center
Who can do anything in our AWS account?
Which AWS admins don't have MFA?
List IAM admin users with no MFA device, including root
Do any AWS admins with a console password lack a second factor?
Which AWS principals could make themselves admin?
Find AWS users and roles with IAMFullAccess who aren't admins yet
Who in AWS is one API call away from admin?
Does the AWS root account have MFA enabled?
When was the AWS root user last signed in?
Show me the security status of our AWS root account
Who is assigned an admin permission set in AWS Identity Center?
List AWS SSO users and groups with admin permission sets by account
Which Identity Center groups give admin access to AWS accounts?
What always-on flat fees are we paying in AWS, like NAT gateways and dedicated IPs?
List AWS hourly charges for Transfer endpoints, NAT gateways and CloudWatch dashboards
Which zombie AWS resources are billing us by the hour regardless of usage?
Which CloudWatch alarms are firing right now?
Show me every AWS CloudWatch alarm currently in ALARM state
Are any CloudWatch metric alarms going off at the moment?
Which AWS regions don't have an active Config recorder?
Find regions where AWS Config isn't recording
Do we have gaps in AWS Config coverage across regions?
Which API operations are driving our AmazonCloudWatch cost?
Break down the last 30 days of AWS Config spend by operation and usage type
Drill into AWS Transfer Family cost by operation and region
How much are we spending in each AWS region?
Break down the last 30 days of AWS cost by region
Are we paying for anything in AWS regions we don't use?
What does our daily AWS spend look like over the last 30 days?
Show me AWS cost per day for the past month
Did our AWS bill jump on any particular day recently?
Which AWS services changed the most in cost week over week?
Compare this week's AWS spend by service to last week
Did any AWS service suddenly double in cost this week?
What are our biggest DynamoDB tables by size?
List the top 50 DynamoDB tables ranked by storage
Which DynamoDB tables take up the most space?
Which ECR repositories take up the most storage?
List our largest AWS ECR repos by total image size
Where are container images piling up in ECR?
How many tasks are running in each ECS cluster?
Show me our AWS ECS clusters with running and pending task counts
How many active services does each ECS cluster have?
How many AWS load balancers do we have of each type?
Break down our ELBs by application, network and classic
How many of our load balancers are internet-facing vs internal?
What did we spend on each AWS service in the last 30 days?
Give me a 30-day AWS cost total for every service
How much is our AWS bill per service over the last month?
Which GuardDuty findings are high severity and still unarchived?
Show me the actionable high-severity GuardDuty findings in AWS
Are there any open GuardDuty findings rated 7 or above?
How much did each linked AWS account cost in March 2026?
Reconcile the AWS consolidated invoice by linked account for a given month
Show AWS spend per linked account for June 2026 to match the invoice
What did linked account 123456789012 spend per service in March 2026?
Reconcile one AWS linked account's invoice detail by service for a month
Break down a single linked account's AWS bill by service for May 2026
Which customer-managed KMS keys don't have rotation turned on?
List AWS KMS keys where automatic key rotation is off
Are any of our enabled KMS keys never rotated?
Which Lambda functions are running on a deprecated runtime?
List AWS Lambda functions on end-of-life runtimes
Do we have any Lambdas stuck on an EOL Python or Node version?
How many Lambda functions do we have on each runtime?
Break down our AWS Lambda functions by runtime
Which Lambda runtimes are we most concentrated on?
How many Macie sensitive-data findings do we have by severity?
Break down AWS Macie findings by severity with affected resource counts
Has Macie found sensitive data in our S3 buckets?
How much did ELB, ECS, Lambda, GuardDuty and Route 53 cost us in the last 30 days?
Show last month's AWS spend for the five pilot services
What are the pilot AWS services costing us per service this month?
What hosted zones do we have in Route 53?
List every Route 53 hosted zone with its record count
How many DNS records are in each of our Route 53 zones?
Which AWS Secrets Manager secrets haven't rotated in over 90 days?
Find secrets in Secrets Manager where rotation is enabled but never ran
Show me stale secret rotations for our compliance review
What critical and high Security Hub findings are still unresolved?
Show me new or notified AWS Security Hub findings rated critical or high
How many high-severity Security Hub findings are still open?
How close are we to our SES sending quota in each region?
Show AWS SES send quota and 24-hour usage per region
What's our daily SES email sending limit and how much have we used?
Which SQS queues have a message backlog?
Find AWS SQS queues with lots of visible or in-flight messages piling up
Are any of our SQS consumers falling behind?
What are our most expensive AWS line items by usage type and region?
Show the top 50 AWS billing lines from the last 30 days
Which AWS usage types should we kill to cut the bill?
Which WAF web ACLs aren't attached to anything?
List AWS WAF Web ACLs with zero associated resources
Are we paying for any WAF ACLs that protect nothing?

What ConfigView collects from AWS 70

EC2 Instances

Retrieve and manage AWS EC2 Instances information.
VPCs

Retrieve and manage AWS VPCs information.
CloudTrail

Retrieve and manage AWS CloudTrail information.
Cost (Daily)

Retrieve and manage AWS Cost (Daily) information.
Cost by Linked Account (Invoice Reconcile)

Retrieve and manage Cost by Linked Account (Invoice Reconcile) information.
EBS Unattached Volumes

Retrieve and manage EBS Unattached Volumes information.
Elastic IPs (Unused)

Retrieve and manage Elastic IPs (Unused) information.
EBS Snapshots (Aged)

Retrieve and manage EBS Snapshots (Aged) information.
S3 Storage Stats

Retrieve and manage S3 Storage Stats information.
Compute Optimizer Recommendations

Retrieve and manage Compute Optimizer Recommendations information.
RDS (Idle)

Retrieve and manage RDS (Idle) information.
Cost by Resource

Retrieve and manage Cost by Resource information.
Elastic Load Balancers

Inventory of Application, Network, Gateway, and Classic load balancers across all active regions.
ELB Cost

Daily Cost Explorer slice for Elastic Load Balancing grouped by usage type and region (last 30 days).
ECS Clusters

ECS clusters with nested services and tasks across all active regions.
ECS Cost

Daily Cost Explorer slice for Amazon Elastic Container Service grouped by usage type and region (last 30 days).
Lambda Functions

Lambda function inventory with runtime, memory, timeout, VPC config, and tags across all active regions.
Lambda Cost

Daily Cost Explorer slice for AWS Lambda grouped by usage type and region (last 30 days).
GuardDuty Findings

Active GuardDuty findings across all detectors and regions with severity, type, and affected resource.
GuardDuty Cost

Daily Cost Explorer slice for Amazon GuardDuty grouped by usage type and region (last 30 days).
Route 53 Hosted Zones

Public and private hosted zones with their record sets and tags.
Route 53 Cost

Daily Cost Explorer slice for Amazon Route 53 grouped by usage type and region (last 30 days).
SQS Queues

Standard and FIFO queues with message counts and visibility timeout.
SQS Cost

Daily Cost Explorer slice for Amazon Simple Queue Service.
Redshift Clusters

Redshift cluster inventory: node type, size, status, encryption, public accessibility.
Redshift Cost

Daily Cost Explorer slice for Amazon Redshift.
CloudFront Distributions

CDN distributions with origins, aliases, price class, HTTP version, IPv6 status.
CloudFront Cost

Daily Cost Explorer slice for Amazon CloudFront.
DynamoDB Tables

Table inventory with item counts, sizes, billing mode, and capacity settings.
DynamoDB Cost

Daily Cost Explorer slice for Amazon DynamoDB.
SNS Topics

Topic inventory with subscription counts and KMS encryption status.
SNS Cost

Daily Cost Explorer slice for Amazon Simple Notification Service.
CloudWatch Alarms

Metric-alarm inventory with current state, threshold, comparison operator, and actions.
CloudWatch Cost

Daily Cost Explorer slice for AmazonCloudWatch.
Detective Graphs

Detective behavior graphs and member-account counts.
Detective Cost

Daily Cost Explorer slice for Amazon Detective.
Glue (Databases, Jobs, Crawlers)

Catalog databases, ETL jobs, and crawlers in one inventory table keyed by resource type.
Glue Cost

Daily Cost Explorer slice for AWS Glue.
Transfer Family Servers

SFTP/FTPS/FTP servers with endpoint type, identity provider, protocols, and user count.
Transfer Family Cost

Daily Cost Explorer slice for AWS Transfer Family.
ECR Repositories

Container image repositories with image counts, sizes, and scan-on-push status.
ECR Cost

Daily Cost Explorer slice for Amazon EC2 Container Registry (ECR).
End User Messaging Phone Numbers

Phone-number inventory (origination IDs) with country code, type, and status.
End User Messaging Cost

Daily Cost Explorer slice for AWS End User Messaging.
Cognito Pools

User pools and identity pools with MFA configuration and estimated user counts.
Cognito Cost

Daily Cost Explorer slice for Amazon Cognito.
SES Identities

Email/domain identities with verification, DKIM status, and 24-hour send quotas.
SES Cost

Daily Cost Explorer slice for Amazon Simple Email Service.
KMS Keys

KMS keys with alias, state, usage, key manager, rotation status, and deletion date.
KMS Cost

Daily Cost Explorer slice for AWS Key Management Service.
AWS Config Recorders

Configuration recorders, delivery channels, and Config-rule counts per region.
AWS Config Cost

Daily Cost Explorer slice for AWS Config.
Security Hub Findings

Active Security Hub findings with severity, compliance status, and workflow state.
Security Hub Cost

Daily Cost Explorer slice for AWS Security Hub.
Macie Findings

Macie sensitive-data findings with severity, category, and affected S3 resource.
Macie Cost

Daily Cost Explorer slice for Amazon Macie.
API Gateway APIs

REST, HTTP, and WebSocket APIs in one inventory keyed by api_type.
API Gateway Cost

Daily Cost Explorer slice for Amazon API Gateway.
Kinesis Streams

Data Streams with shard count, retention, encryption, and stream mode.
Kinesis Cost

Daily Cost Explorer slice for Amazon Kinesis.
WAF Web ACLs

WAFv2 Web ACLs (REGIONAL + CLOUDFRONT) with rules, capacity, and associated resources.
WAF Cost

Daily Cost Explorer slice for AWS WAF.
Secrets Manager Secrets

Secret metadata (NOT values): name, KMS key, rotation schedule, last accessed/rotated dates.
Secrets Manager Cost

Daily Cost Explorer slice for AWS Secrets Manager.
IAM Users (Admin Audit)

IAM users with MFA status, console access, access-key counts, and a computed admin flag. Includes the root account.
IAM Roles (Admin Audit)

IAM roles with trust policy summary, last-used date, and admin flag. Separates human-assumable roles from service-linked ones.
IAM Groups (Admin Audit)

IAM groups with member lists and admin flag — the path most accounts actually use to grant admin.
IAM Policy Attachments

Every policy attachment flattened across users, groups, and roles, including inherited ones. Shows why a principal has the access it has.
IAM Access Keys

Long-lived access keys with age, status, and last-used service — flagged when the owner is an admin.
Identity Center Assignments

AWS IAM Identity Center (SSO) assignments: permission set, target account, and the resolved user or group. Where admin access lives in SSO-based orgs.

Back to Integrations