Cloud CMDB vs Traditional CMDB: A 2026 Comparison

kind: source
spec:
  name: aws
  path: cloudquery/aws
  version: "latest"
  destinations: [postgresql]
  tables:
    - aws_ec2_instances
    - aws_rds_instances
    - aws_s3_buckets
    - aws_bedrock_custom_models

-- Traditional CMDB proprietary query
SELECT name, ci_type, status
FROM cmdb_ci
WHERE ci_type = 'Server'
-- Basic info. Cloud-specific attributes: missing.

-- Cloud CMDB with standard PostgreSQL
SELECT
  instance_id,
  instance_type,
  vpc_id,
  public_ip_address,
  tags
FROM aws_ec2_instances
WHERE state_name = 'running'
  AND tags->>'Environment' = 'production'
  AND public_ip_address IS NOT NULL;

-- Find all custom Bedrock models deployed across AWS accounts
SELECT
  account_id,
  region,
  model_arn,
  model_name,
  tags
FROM aws_bedrock_custom_models
ORDER BY account_id, region;

-- Identify AI workloads without cost allocation tags
SELECT account_id, region, model_arn
FROM aws_bedrock_custom_models
WHERE NOT tags ? 'CostCenter' OR NOT tags ? 'Team';

-- All public-facing instances with SSH open to 0.0.0.0/0
SELECT
  i.instance_id,
  i.public_ip_address,
  sg.group_id
FROM aws_ec2_instances i
JOIN LATERAL JSONB_ARRAY_ELEMENTS(i.security_groups) AS sg_ref ON true
JOIN aws_ec2_security_groups sg ON sg.group_id = sg_ref->>'GroupId'
WHERE i.public_ip_address IS NOT NULL
  AND sg.ip_permissions @> '[{"IpProtocol": "tcp", "FromPort": 22, "ToPort": 22, "IpRanges": [{"CidrIp": "0.0.0.0/0"}]}]'::jsonb;

-- Find EC2 instances missing required governance tags
SELECT instance_id, tags
FROM aws_ec2_instances
WHERE NOT tags ? 'Owner'
   OR NOT tags ? 'Environment'
   OR NOT tags ? 'CostCenter';

-- Running EC2 instances in the same VPC as the RDS cluster (starting scope for blast radius analysis)
SELECT
  i.instance_id,
  i.instance_type,
  i.tags->>'Service' AS service
FROM aws_ec2_instances i
WHERE i.vpc_id = (
  SELECT vpc_id FROM aws_rds_clusters
  WHERE db_cluster_identifier = 'prod-api-cluster'
)
AND i.state_name = 'running';

-- Unused EBS volumes older than 30 days
SELECT account_id, region, volume_id, size, volume_type, create_time
FROM aws_ebs_volumes
WHERE attachments = '[]'::jsonb
  AND create_time < NOW() - INTERVAL '30 days';

-- Which RDS clusters lacked encryption on a specific audit date?
-- Requires a sync to have run on that date; use <= with ORDER BY _cq_sync_time DESC for nearest-prior snapshot
SELECT
  _cq_sync_time::date AS snapshot_date,
  account_id,
  region,
  db_cluster_identifier,
  storage_encrypted
FROM aws_rds_clusters
WHERE _cq_sync_time::date = '2026-01-15'
  AND storage_encrypted = false
ORDER BY account_id, region;

-- Find running instances not tracked in your known IaC inventory
WITH tf_instances AS (
  SELECT unnest(ARRAY['i-abc123', 'i-def456']) AS instance_id
)
SELECT a.instance_id, a.instance_type, a.tags
FROM aws_ec2_instances a
LEFT JOIN tf_instances t ON a.instance_id = t.instance_id
WHERE t.instance_id IS NULL
  AND a.state_name = 'running';