AWS ResourceExplorer

Definition

AWS Resource Explorer indexes resources across AWS services and regions so you can search from a single query interface (console, API, or CLI). With an aggregator index in an AWS Organization, search spans member accounts. Views scope results and attach IAM permissions for delegated self-service search. Resource Explorer answers “what exists where?” — it is an inventory search layer, not a configuration history or compliance engine.

When to use it

• Ad hoc discovery: finding orphaned EBS volumes, stray Elastic IPs, or resources in regions teams forgot about
• Decommissioning a service, region, or account — enumerate everything before delete
• Tag hygiene audits — locate resources missing cost-allocation or environment tags
• First-pass organization-wide inventory before deeper AWS Config or custom CMDB work

When not to use it

• Continuous compliance evidence or configuration drift history — use AWS Config
• Batch operational actions on grouped resources — use Resource Groups or tag-based automation
• Real-time security alerting — Resource Explorer is query-oriented, not an event stream
• Replacing a full asset CMDB with ownership, lifecycle, and dependency metadata Resource Explorer does not store

Tips

• Create an organization-level aggregator index in your management or delegated admin account — without it, search stays single-account
• Grant resource-explorer-2:Search and read permissions on underlying services; search succeeds only for resource types the caller can describe
• Save frequent queries as views for platform teams and auditors with least-privilege IAM
• Run Resource Explorer before major region exits or account closures — Config history helps later, but search finds what to delete now
• Pair with Tag Editor when audits find gaps — search finds offenders, Tag Editor fixes tags in bulk

Gotchas

Serious

• Confused with Config: Teams treat search results as compliance proof. Resource Explorer shows current index state, not who changed what or when.
• Incomplete index: New service types or regions may require index updates; stale indexes miss resources during cleanup exercises.
• Over-broad IAM: Views that expose every account to every engineer leak infrastructure topology — scope views by OU or environment.

Regular

• Resource Explorer indexing lag means very new resources may not appear immediately after creation.
• Complex queries across many accounts can hit API pagination limits — export or script large inventories.
• Free to use, but the API calls underlying services describe — throttling on heavily queried accounts is possible.

Official references

• What is AWS Resource Explorer? — indexing, search syntax, and views
• Aggregator indexes for Organizations — multi-account search setup

Related FactualMinds content

• AWS Managed Services Provider
• AWS Well-Architected Review