---
title: "Search AWS Resources"
method: POST
path: "/common/v1/search/aws/resources"
tags: ["Threat Hunting"]
---

# Search AWS Resources

`POST /common/v1/search/aws/resources`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/common/v1/search/aws/resources`
- Auth: API key in header `Authorization`

Allows you to search AWS workloads- EC2 and EBS Volumes backed up to Druva Cloud for the selected/provided Phoenix (Enterprise Workloads) organization IDs, AWS account IDs, and regions. Currently, only AWS workloads - EC2 and EBS Volumes are supported.

## Request body

- SearchAWSResourcesParams
  - `orgIDs` integer[]: Specify the unique Phoenix(Enterprise Workload) organization ID.
  - `accountIDs` integer[]: Specify the AWS Account IDs. You can obtain the ID using the 'Search AWS Accounts API'.
  - `regions` string[]: Specify the AWS region's code. For the list of supported regions, refer to the AWS Workloads documentation. For example, 'us-east-1' and 'us-west-2'.
  - `deviceIDs` integer[]: Specify the AWS Device IDs. You can obtain the ID using the 'List AWS Resources API'.
  - `tags` object[]: Specify the tag keys and tag values.
    - `Key` string: Name of tag.
    - `Value` string: Value of tag.
  - `pageToken` string: The token to access the next page of results. Use the token value received in the previous response's parameter 'nextPageToken'.

## Response `200`

Success

- SearchAWSResourcesResponse
  - `devices` object[]
    - `resourceName` string: Name of the resource. In case of EC2, resource name can be instance id or name given to instance. Example - docker-test
    - `type` string: Name of the resource type. Example - EC2, EBS.
    - `deviceID` integer: Unique identifier for a resource.
    - `awsAccountName` string: The name of AWS account.
    - `awsAccountID` integer: Unique identifier for AWS account IDs.
    - `orgID` integer: The unique identifier of the Phoenix (Enterprise Workloads) organization for the resource.
    - `region` string: AWS region
    - `regionLabel` string: Region label for AWS region. Example - Oregon (US West).
    - `resources` object[]: List of associated resources.
      - `resourceID` integer: Unique identifier for the associated resource.
  - `nextPageToken` string: The token to access the next page of results. This parameter will be empty for the last page of results.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)