AMA: Find AWS Instances by their Private IP Addresses

[Deleted User]

How would I construct a query that finds AWS instances by their private IP addresses that return public IPs, AMIs, Accounts, Instance IDs and any tags associated with each?

[Deleted User]

The following pre-supposes you are using the tagging feature in your AWS integration, just replace the IP_ADDRESS with the real IP. Please note that I'm not aware of a way to return all tags. I believe you would have to enumerate the tags you want to include (e.g. using i.tag.<name_of_tag> in the RETURN clause).

FIND aws_instance WITH privateIpAddress = "" AS i
RETURN
  i.publicIpAddressAS PublicIP,
  i.imageId AS AMI,
  i.tag.AccoutnName AS AccountName,
  i.id AS InstanceId

You can  format this query to accept multiple IP addresses.

FIND aws_instance 
WITH privateIpAddress = ("x.x.x.x" or "x.y.x.y")

 You can find the original article to this AMA on the JupiterOne blog.