NEW: The State of AWS Security 2026 - Free WhitepaperFree AWS Security Whitepaper

AWSMap

Inventory one AWS account or your whole AWS Organization, then query it with SQL or plain English

A fast, comprehensive tool for mapping and inventorying AWS resources across 150+ services and all regions. Scan one account, or every account of an AWS Organization with awsmap org (v1.9.0), store results in a local SQLite database, and query your inventory using SQL or natural language. Compare scans over time with drift detection, find idle resources with waste detection, and audit tag compliance. Includes 30 pre-built security, compliance and inventory queries, 1,381 example questions and HTML, JSON and CSV output. Available on PyPI (Python 3.10 or later) and Docker Hub (amd64 and arm64).

View on GitHub

Features

Coverage

150+ AWS services supported
All regions scanned in parallel
Global services handled intelligently
Multi-account support (scan & query across accounts)
AWS Organizations scan from one profile (awsmap org)
Tag filtering with AND/OR logic

Query Engine

Local SQLite database (auto-stored)
Custom SQL queries on inventory history
30 pre-built security, compliance and inventory queries
Natural language interface (ask in English)
1,381 service-organized example questions

History & Governance

Drift detection: added, removed and modified resources between scans (awsmap diff)
Waste detection from collected data, no extra API calls (awsmap waste)
Tag compliance score against required tags (awsmap tags)
Query any past scan with --scan

AWS Organizations (v1.9.0)

Assumes a role in each member account (default OrganizationAccountAccessRole, configurable)
Read-only session policy plus ReadOnlyAccess on role assumption, on by default (--no-session-policy turns it off). If STS rejects the managed policy, awsmap falls back to the inline policy alone, which is not read-only for an administrator role: use a role that is read-only on its own
Retries transient failures; an account with failed services is stored as partial (those services are left out of that scan, their previous rows are kept) and the scan exits with code 2. --dry-run exits 1 if any account is inaccessible
Summary lists the API calls that were denied, so you know what the inventory could not see

Performance

40 parallel workers by default
~2 minutes for typical accounts
Region-aware collectors skip unsupported regions
Batch operations where available

Output & Reports

Interactive HTML reports with dark mode
JSON with full resource details
CSV for spreadsheet analysis
Clickable tag badges and ARN copy

Configuration

Persistent config (awsmap config set/get/list)
Default profile, regions, services, format
Custom queries in ~/.awsmap/queries/
Shell completion (bash, zsh, fish)

Installation & Usage

PyPI Installation (Python 3.10 or later)

pip install awsmap

Docker

docker pull tarekcheikh/awsmap

Scan

# Full account inventory
awsmap -p myprofile


# Specific services & regions
awsmap -p myprofile -s ec2,s3,rds -r us-east-1,eu-west-1


# Filter by tags
awsmap -p myprofile -t Owner=John -t Environment=Production

SQL Queries

# Custom SQL on your inventory
awsmap query "SELECT service, COUNT(*) FROM resources GROUP BY service"


# Pre-built security queries
awsmap query -n admin-users
awsmap query -n public-s3-buckets
awsmap query -n open-security-groups

Natural Language

# Ask in plain English
awsmap ask how many resources per region
awsmap ask show me all EC2 instances without Owner tag
awsmap ask which S3 buckets are in eu-west-1

Examples Library

# Browse 1,381 example questions
awsmap examples
awsmap examples lambda
awsmap examples lambda 5
awsmap examples --search "encryption"

Scan a Whole AWS Organization

# Check that awsmap can reach every member account (no resource is scanned)
awsmap org -p org-root --dry-run


# Scan the organization, one OU, or chosen accounts
awsmap org -p org-root
awsmap org -p org-root --ou ou-prod-12345678
awsmap org -p org-root --accounts 111122223333,444455556666


# Finish an interrupted scan
awsmap org -p org-root --resume

Drift, Waste and Tag Compliance

# What changed since the last scan, or in the last 7 days?
awsmap diff
awsmap diff --from 7d


# Idle or wasteful resources, from data already collected
awsmap waste


# Tag compliance against required tags
awsmap tags -R Owner,Environment,CostCenter

Try It Without an AWS Account

awsmap demo
awsmap query --db ~/.awsmap/demo.db -n admin-users
awsmap diff --db ~/.awsmap/demo.db --from 30d

CLI Options

Option	Description
`-p, --profile`	AWS profile name
`-r, --region`	Region(s) to scan (comma-separated)
`-s, --services`	Service(s) to scan (comma-separated)
`-t, --tag`	Filter by tag Key=Value (multiple allowed)
`-f, --format`	Output: html (default), json, csv
`-o, --output`	Output file path
`-w, --workers`	Parallel workers (default: 40)
`-q, --quiet`	Suppress progress output
`--timings`	Show timing summary per service
`--exclude-defaults`	Exclude default AWS resources
`--no-db`	Skip database storage
`--list-services`	List available service collectors
`query <SQL>`	Run a SQL query against inventory
`query -n <name>`	Run a pre-built named query
`query -l`	List all pre-built queries
`query -a <account>`	Scope query to a specific account
`ask <question>`	Query inventory in natural language
`examples [service]`	Browse example questions by service
`examples --search <keyword>`	Search across all example questions
`config set <key> <value>`	Set a config value (profile, regions, etc.)
`config list`	Show all configuration
`completion <shell>`	Generate shell completion (bash/zsh/fish)
`org -p <profile>`	Scan every account of an AWS Organization (management or delegated admin profile)
`org --dry-run`	Check role assumption in the member accounts without scanning resources
`org --ou <id> / --accounts <list>`	Limit the organization scan to one OU (child OUs included) or to chosen accounts (IDs, aliases or names)
`org --exclude <list>`	Leave out accounts (IDs, aliases or names)
`org --resume`	Skip accounts whose latest scan in the last 24 hours had no incomplete service
`org --role-name <name>`	Role to assume in member accounts (default: OrganizationAccountAccessRole)
`diff [--from <date>] [--to <date>]`	Compare snapshots: added, removed and modified resources
`waste`	Find potentially idle or wasteful resources
`tags -R <keys>`	Audit tag compliance against required tag keys
`query --scan <latest\|previous\|first\|scan_id>`	Run a query against a specific scan instead of the current snapshot
`demo`	Generate a demo database with synthetic inventory data

Pre-built Security Queries

admin-rolesIAM roles with admin policies attached

admin-usersIAM users with admin permissions (direct or via group membership)

cross-account-rolesIAM roles with trust policies allowing external accounts

default-vpcsDefault VPCs across all regions

ebs-unencryptedEBS volumes without encryption

encryption-statusS3 buckets and their encryption configuration

iam-inactive-usersIAM users who have never logged in or have no access keys

lambda-high-memoryLambda functions with memory greater than 512 MB

lambda-runtimesLambda functions grouped by runtime

missing-tagResources missing a required tag (default: Owner)

old-access-keysIAM users with access keys (check create_date for age)

open-security-groupsSecurity groups with inbound rules open to 0.0.0.0/0

public-s3-bucketsS3 buckets with public access enabled

rds-enginesRDS instances grouped by engine

rds-no-multi-azRDS instances without Multi-AZ enabled

rds-publicRDS instances with public access enabled

rds-unencryptedRDS instances without encryption

resources-by-accountResource count per account

resources-by-regionResource count per region

resources-by-serviceResource count per service and type

resources-by-tagResources that have a specific tag (default: Owner)

resources-per-account-serviceResource count per account per service

s3-no-loggingS3 buckets without access logging enabled

s3-no-versioningS3 buckets without versioning enabled

secrets-no-rotationSecrets Manager secrets without automatic rotation

stopped-instancesEC2 instances in stopped state

untagged-resourcesResources without any tags

unused-eipsElastic IPs not associated with any instance

unused-volumesEBS volumes not attached to any instance

users-without-mfaIAM users without MFA enabled

Need Help Implementing?

We can help you deploy and customize this tool for your specific needs, or build custom solutions.