Ex.1 case: Service Account

{
    "resource_type": "identity.ServiceAccount",
    "query": {
        "aggregate": {
            "group": {
                "keys": [
                    {
                        "key": "provider",
                        "name": "provider"
                    },
                    {
                        "key": "service_account_id",
                        "name": "service_account_id"
                    },
                    {
                        "key": "name",
                        "name": "service_account_name"
                    }
                ]
            }
        },
        "sort": {
            "name": "resource_count",
            "desc": true
        },
        "limit": 5
    },
    "join": [
        {
            "keys": [
                "service_account_id"   
            ],
            "resource_type": "inventory.Server",
            "query": {
                "aggregate": {
                    "unwind": [
                        {
                            "path": "collection_info.service_accounts"
                        }
                    ],
                    "group": {
                        "keys": [
                            {
                                "key": "service_account_id",
                                "name": "service_account_id"
                            }
                        ],
                        "fields": [
                            {
                                "operator": "count",
                                "name": "server_count"
                            }
                        ]
                    }
                }
            }
        },
        {
            "keys": [
                "service_account_id"
            ],
            "type": "RIGHT",
            "resource_type": "inventory.CloudService",
            "query": {
                "aggregate": {
                    "unwind": [
                        {
                            "path": "collection_info.service_accounts"
                        }
                    ],
                    "group": {
                        "keys": [
                            {
                                "key": "service_account_id",
                                "name": "service_account_id"
                            }
                        ],
                        "fields": [
                            {
                                "operator": "count",
                                "name": "cloud_service_count"
                            }
                        ]
                    }
                }
            }
        },
        {
            "keys": [
                "service_account_id"
            ],
            "type": "RIGHT",
            "resource_type": "secret.Secret",
            "query": {
                "aggregate": {
                    "group": {
                        "keys": [
                            {
                                "key": "service_account_id",
                                "name": "service_account_id"
                            }
                        ],
                        "fields": [
                            {
                                "operator": "count",
                                "name": "secret_count"
                            }
                        ]
                    }
                }
            }
        }
    ],
    "formulas": [
        {
            "name": "resource_count",
            "formula": "server_count + cloud_service_count"
        }
    ]
}

Last updated