Here is the standard Cypher query for Cartography to map out the network layout connecting **VPCs**, **Subnets**, and **EC2 instances** that have public IP addresses. In Cartography, EC2 instances connect to Subnets via Elastic Network Interfaces (`NetworkInterface`). ### Recommended Query (Includes Network Interfaces) This query returns the full graph path so Neo4j Browser can render the visual network layout: ```cypher MATCH path = (vpc:AWSVpc)-[:HAS_SUBNET]->(subnet:EC2Subnet)<-[:PART_OF_SUBNET]-(nic:NetworkInterface)<-[:NETWORK_INTERFACE]-(instance:EC2Instance) WHERE instance.publicipaddress IS NOT NULL AND instance.publicipaddress <> '' RETURN path ``` --- ### Simplified Query (VPC -> Subnet -> Instance) If you prefer a simpler visualization without rendering the explicit `NetworkInterface` nodes: ```cypher MATCH (vpc:AWSVpc)-[:HAS_SUBNET]->(subnet:EC2Subnet)<-[:PART_OF_SUBNET]-(:NetworkInterface)<-[:NETWORK_INTERFACE]-(instance:EC2Instance) WHERE instance.publicipaddress IS NOT NULL AND instance.publicipaddress <> '' RETURN vpc, subnet, instance ``` --- ### Tabular Summary Query If you want a tabular report listing the details rather than a visual graph layout: ```cypher MATCH (vpc:AWSVpc)-[:HAS_SUBNET]->(subnet:EC2Subnet)<-[:PART_OF_SUBNET]-(nic:NetworkInterface)<-[:NETWORK_INTERFACE]-(instance:EC2Instance) WHERE instance.publicipaddress IS NOT NULL AND instance.publicipaddress <> '' RETURN vpc.id AS VpcId, subnet.id AS SubnetId, instance.id AS InstanceId, instance.name AS InstanceName, instance.publicipaddress AS PublicIP, nic.public_ip AS InterfacePublicIP ORDER BY VpcId, SubnetId, InstanceId ``` --- ### Helpful Additions / Filters 1. **Filter by a specific AWS Account:** Add `(account:AWSAccount)-[:RESOURCE]->(vpc)` to the match pattern: ```cypher MATCH path = (account:AWSAccount)-[:RESOURCE]->(vpc:AWSVpc)-[:HAS_SUBNET]->(subnet:EC2Subnet)<-[:PART_OF_SUBNET]-(nic:NetworkInterface)<-[:NETWORK_INTERFACE]-(instanc…[truncated]