AWS Resource Explorer Launches Immediate Resource Discovery within a Region

AWS now provides immediate access to resource search capabilities in all accounts through AWS Resource Explorer. With this launch, you no longer need to activate Resource Explorer to discover your resources in a Region.

To start searching, you need, at minimum, permissions in the AWS Resource Explorer Read Only Access or AWS Read Only Access managed policies. You can discover resources in the AWS Resource Explorer console, Unified Search, and AWS CLI and SDKs. To search the full inventory of supported resources, including historical backfill and automatic updates, complete Resource Explorer setup. This requires additional permissions to create a Service-Linked Role (SLR), so that Resource Explorer can automatically complete setup in each Region where you search. On your first search per authenticated session, Resource Explorer will attempt to create the SLR to provide search results from the full inventory of supported resource types. When you have the necessary permissions, Resource Explorer will automatically complete setup in each Region where you search.

To learn more about this feature, visit the AWS Resource Explorer documentation.

FAQs

1. Why does searching attempt to create the AWSServiceRoleForResourceExplorer (Role Policy) with no additional action needed?

Search provides fundamental functionality and Resource Explorer will deliver the most complete resource results based on your permissions. To determine if you have permissions to create the Resource Explorer SLR, Resource Explorer will make an API call per authenticated session to attempt to create the SLR. If you have create SLR permissions, Resource Explorer will complete setup, so you have access to a full inventory of supported resources per Region. If you do not have create SLR permissions, you can continue to search with partial results. Partial results include all tagged resources and supported untagged resources created after the feature launch, but not complete historical data.

2. I'm seeing authorization failed events on Create SLR for Resource Explorer. What is this and how can I remove them? What should I do if I do not want searching to attempt to the create SLR?

These events occur when you do not have iam:CreateServiceLinkedRole permissions to create the Resource Explorer SLR. If you do not want any resource search experience in your account, you can disallow resource-explorer-2:Search permissions to prevent the create SLR attempt. Any Resource Explorer search requests will be denied if the user/role/policy does not allow the Search action on AWS Resource Explorer. These calls will fail authentication when invoking Resource Explorer APIs and will not attempt to create the SLR. If you want to search your full inventory of supported resources, creating the SLR is a one-time action per account.

3. Which mechanisms do I have to limit what users can search in my account?

You can create a user view in Resource Explorer to define filters that determine which resources can be returned by queries using the view. Views also control who can search for resources. You can create views to specify what resource types, tags, or Regions users can see when using that view to search.

4. What should I do if I have SLR permissions, but the SLR is not getting created when I search?

You can use the CreateResourceExplorerSetup API or complete setup in the Resource Explorer console (one-click banner or Settings page) to create indexes in all or a subset of Regions directly.

5. What is the CreateResourceExplorerSetup API?

The CreateResourceExplorerSetup API allows you to programmatically enable Resource Explorer in a single operation, including 1) create the Resource Explorer SLR (if it does not exist already), 2) create indexes in all or a subset of Regions, 3) create and associate default views in those Regions, and 4) enable cross-Region search.

6. If a SLR already exists in my account, what will happen when I search?

Because the SLR exists at an account level, if you search in a different Region with at least permission in AWSResourceExplorerReadOnlyAccess, Resource Explorer uses the SLR to create an index and view and provides historical backfill and automatic updates in that Region. If you have cross-Region search enabled or have previously deleted an index in a Region, index and view creation will not be completed automatically. Resource Explorer will not alter your existing cross-Region setup or onboard a Region that has already offboarded from Resource Explorer.

7. If I am an existing customer of Resource Explorer, will my experience change?

If you have already configured Resource Explorer with cross-Region search, your experience will remain the same. Resource Explorer will not alter your existing cross-Region setup. If you had previously set up Resource Explorer in a subset of Regions and search in a new Region for the first time with the right permissions, Resource Explorer will automatically create an index and view. If you search in a Region where you previously deleted an index, index and view creation will not be automatically completed because Resource Explorer will not onboard a Region that has previously been off-boarded.