Search Traversals

<-- traverses the graph inbound, --> traverses the graph outbound.

Outbound

--> traverses the graph outbound to the next level.

Example

Select AWS accounts and traverse the graph outbound

> search is(aws_account) -->

This query would return a list of all matching regions.

Inbound

<-- traverses the graph inbound to the next level.

Example

Select AWS EC2 instances, traverse the graph inbound, and filter to only return the aws_regions

> search is(aws_ec2_instance) <-- is(aws_region)

Including the Current Node

-[0:1]-> traverses the graph outbound, starting from the current node (0) until the next level (1). The result will contain the current node plus all nodes one level outbound. The same applies for inbound with this statement <-[0:1]-.

Example

Return all resources

> search is(aws_region) -[0:1]->`

Example

Return all aws_regions with name global, together with all accounts

> search is(aws_region) and name==global <-[0:1]-

By Depth

Range

-[start:until]-> traverses the graph outbound starting from a user defined depth to a user defined depth. The graph will be traversed from the current node according to this specification. All matching nodes will be returned. The same applies for inbound traversals with <-[start:until]-.

Example

The following query answers the question, "Which instance profile is used for ec2 instances connected to an alb target group?"

Select aws_alb_target_groups, traverse 2 levels inbound, and filter for aws_iam_instance_profiles

> search is(aws_alb_target_groups) <-[2:2]- is(aws_iam_instance_profile)

One-Sided Range

-[start:]-> traverses the graph outbound starting from a user defined depth to the leafs of the graph. The graph will be traversed from the current node according to this specification. All matching nodes will be returned. The same applies for inbound traversals with <-[start:]-.

Example

> search is(aws_account) and name==sunshine -[0:]->

This query will select the aws account with name sunshine and then select all nodes outbound to this node. This will select everything Fix Inventory knows about nodes in this account.

Bi-Directional

<-[start:until]-> traverses the graph inbound and outbound starting from a user defined depth to a user defined depth. The graph will be traversed from the current node according to this specification. All matching nodes will be returned.

Example

Select nodes with the name sunset connected on any depth to the AWS account

> search name="sunset" and is(aws_account) <-[0:]->

By Edge Type

Every edge has a type which defines the relationship between two nodes.

The types of edge can be specified via the graph traversal: -<edge_type>[<start>:<until>]->. If more than one type should be used for the traversal, the types need to be separated by comma.

Fix Inventory currently supports two types of edges.

Default Edges

Default edges are assumed if no specific edge type is defined or requested. This usually means the "logical" dependency between two resources.

A volume or network interface might be attached to a volume. The dependency between the 2 is expressed as default edge. Every resource in Fix Inventory is connected via an edge of type default.

Delete Edges

If a resource has dependencies of type delete, then this resource can not be deleted right away. All transitive dependencies need to be deleted first, while the order is also defined in the graph. You can see the blast radius of a delete operation by following all transitive dependencies.

Examples

Selects all instances, walk the default edge outbound, and filter on volumes; returns volumes that are attached to an instance

> search is(instance) -default-> is(volume)

Blast radius of resources that are affected when volume foo would be deleted

> search is(volume) and name==foo -delete[1:]->

Select all volumes and traverse one step using default/delete dependency; returns all resources that are found

> search is(volume) and name==foo -default,delete->

There is special syntax if you want to traverse the graph in both directions using different edge types for every direction:

Pick one volume, then traverse delete dependencies both inbound and outbound

> search is(volume) limit 1 <-delete[1:1]->

Pick one volume, then traverse inbound using delete dependencies and outbound using both delete and default dependencies

> search is(volume) limit 1 <-delete[1:1]default,delete->

Abbreviations

There are abbreviations for commonly used traversal selectors:

Abbreviated Selector	Unabbreviated Selector
-->	-[1:1]->
<--	<-[1:1]-
<-->	<-[1:1]->
<-[x]-	<-[x:x]-

Examples

Abbreviated	Unabbreviated
search is(aws_account) -->	search is(aws_account) -[1:1]->
search is(aws_region) <-->	search is(aws_region) <-[1:1]->
<-[x]-	<-[x:x]-
search is(aws_region) <-[3]->	search is(aws_region) <-[3:3]->

Commands

There are also commands to perform a traversal selection, to which input can be piped:

Command	Traversal Selector
predecessors	<-- or <-[1:1]-
successors	--> or -[1:1]->
ancestors	<-[1:]-
descendants	-[1:]->