How to run AWS CONFIG advanced queries using Lambda Function


My requirement is to generate a report to list all AWS resource by executing AWS Config advanced queries using Lambda function on regular basis . Could you please assist how to achieve it

asked 2 years ago1889 views
3 Answers

You can query the AWS Config API for advanced queries with the SelectResourceConfig API call. See the AWS documentation for an (CLI) example.

answered 2 years ago
  • I created lambda function and invoking the SelectResourceConfig API using aws cli using below query and it is failing with "Syntax error in module 'lambda_function': invalid syntax (, line 23)".

    import subprocess import logging import boto3

    logger = logging.getLogger() logger.setLevel(logging.INFO)

    def run_command(command): command_list = command.split(' ') #print(command_list) try:"Running shell command: "{}"".format(command)) result =, stderr=subprocess.STDOUT, stdout=subprocess.PIPE); #print(result)"Command output:\n---\n{}\n---".format(result.stdout.decode('UTF-8'))) except Exception as e: logger.error("Exception: {}".format(e)) return False

    return result

    def lambda_handler(event, context):

    run_command('/opt/aws configservice select-resource-config --expression "SELECT 

    resourceName, resourceType, configuration.tags.value, configuration.vpcId, configuration.subnetId, configuration.publicDnsName, configuration.privateIpAddress, configuration.imageId, configuration.iamInstanceProfile.arn, configuration.instanceId, configuration.instanceType, configuration.securityGroups, configuration.platform, configuration.architecture, configuration.availabilityZone, WHERE resourceType = 'AWS::EC2::Instance' order by resourceId, resourceName, resourceType,"')


You could use AWS Eventbridge (what used to be called Cloudwatch Events earlier) to create a Scheduler rule that will trigger at periodic intervals. You can define a lambda function as the target of the Lambda function.

Inside the lambda function you can call the relevant API that will give you what you want. For example, if you want to use the AWS Config API ListDiscoveredResources, then you can call the API from inside your lambda function. There are samples provided in the documentation for supported languages - You could write the output to a file and save it on S3.

profile pictureAWS
answered 2 years ago

Please follow our blog article on this:

def create_report(aggregator_name, today):
    client = boto3.client('config')
    response = client.select_aggregate_resource_config(
        Expression=f"SELECT * WHERE configurationItemCaptureTime LIKE '{today}%'",
    changed_resources = response["Results"]
    json_list = [json.loads(line) for line in changed_resources]
answered 9 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions