> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/asset-config-queries/asset-config-query-examples.md).

# Asset Configuration Query Examples

Some examples for asset configuration queries for AWS, Azure, and GCP.

Review examples that show you how to use [Config Query Attributes](/content-collections/search-and-investigate/asset-config-queries/asset-config-query-attributes.md) for investigating issues on the following cloud platform:

* [Config Query Examples for AWS](#event-query-examples-for-aws)
* [Config Query Examples for Azure](#event-query-examples-for-azure)
* [Config Query Examples for GCP](#event-query-examples-for-gcp)

## Config Query Examples for AWS

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>DESCRIPTION</td><td>RQL</td></tr><tr><td>View users who enabled console access with both access keys and passwords.</td><td><pre><code>config from cloud.resource where api.name = 'aws-iam-get-credential-report' AND json.rule = access_key_1_active is true or access_key_2_active is true and password_enabled is true
</code></pre></td></tr><tr><td>List root accounts that do not have MFA enabled.</td><td><pre><code>config from cloud.resource where api.name = 'aws-iam-get-account-summary' AND json.rule='not AccountMFAEnabled equals 1'
</code></pre></td></tr><tr><td>List active access keys.</td><td><pre><code>config from cloud.resource where api.name = 'aws-iam-list-access-keys' AND json.rule = status equals "Active"
</code></pre></td></tr><tr><td>View all S3 buckets that are accessible to the public through bucket ACLs.</td><td><pre><code>config from cloud.resource where api.name='aws-s3api-get-bucket-acl' AND json.rule="(acl.grants[?(@.grantee=='AllUsers')] size > 0)"
</code></pre></td></tr><tr><td>View all S3 buckets that are accessible to the public through bucket policy.</td><td><pre><code>config from cloud.resource where api.name = 'aws-s3api-get-bucket-acl' and json.rule = "policy.Statement exists and policy.Statement[?(@.Action=='s3:GetObject' &#x26;&#x26; @.Effect=='Allow')].Principal contains *"
</code></pre></td></tr><tr><td>Displays the number of VPCs that do not have subnets associated only when there are more than 2 VPCs.</td><td><pre><code>config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-vpcs' as X; config from cloud.resource where api.name = 'aws-ec2-describe-subnets' as Y; filter 'not $.X.vpcId equals $.Y.vpcId'; show X; count(X) > 2
</code></pre></td></tr><tr><td>Check for S3:GetObject operations.</td><td><p>You can include other operations related to S3 buckets, such as s3:PutObject, s3:*, s3:GetBucketAcl, s3:ListBucket, s3:ListAllMyBuckets, s3:PutObjectAcl, s3:GetObjectAcl, and s3:GetObjectVersion.</p><pre><code>config from cloud.resource where api.name = 'aws-s3api-get-bucket-acl' and json.rule = "policy.Statement exists and policy.Statement[?(@.Action=='s3:GetObject' &#x26;&#x26; @.Effect=='Allow' || @.Action=='s3:ListBucket' &#x26;&#x26; @.Effect=='Allow' || @.Action=='s3:*' &#x26;&#x26; @.Effect=='Allow' || @.Action=='s3:GetBucketAcl' &#x26;&#x26; @.Effect=='Allow' || @.Action=='s3:PutObject' &#x26;&#x26; @.Effect=='Allow' || @.Action=='s3:GetObjectAcl' &#x26;&#x26; @.Effect=='Allow' || @.Action=='s3:GetObjectVersion' &#x26;&#x26; @.Effect=='Allow')].Principal contains *"
</code></pre></td></tr></tbody></table>

## Config Query Examples for Azure

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>DESCRIPTION</td><td>RQL</td></tr><tr><td>View SQL Server firewall rules that allow access to any Azure internal resources.</td><td><pre><code>config from cloud.resource where api.name = 'azure-sql-server-list' AND json.rule = "firewallRules.[*] size > 0 and firewallRules.[*].['endIpAddress'] contains 0.0.0.0 and firewallRules.[*].['startIpAddress'] contains 0.0.0.0"
</code></pre></td></tr><tr><td>List security center resource groups in Azure that do not specify a security contact email address.</td><td><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center' AND json.rule = 'name == default and (properties.securityContactConfiguration.securityContactEmails !isEmpty or properties.securityContactConfiguration exists)'
</code></pre></td></tr><tr><td>View SQL databases where encryption is disabled.</td><td><pre><code>config from cloud.resource where api.name = 'azure-sql-db-list' AND json.rule=’transparentDataEncryption is false’
</code></pre></td></tr><tr><td>List Azure VNETs that are peered successfully.</td><td><pre><code>config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-network-vnet-list' AND json.rule = " ['properties.virtualNetworkPeerings'][*]. ['properties.provisioningState'] contains Succeeded "
</code></pre></td></tr><tr><td>Display a count of the number of Azure Activity log alerts if the total number is less than one.</td><td><pre><code>config from cloud.resource where api.name = 'azure-activity-log-alerts' as X; count(X) &#x3C; 1
</code></pre></td></tr><tr><td>Display Azure hosts that match the queried private IP address.</td><td><pre><code>config from cloud.resource where api.name = 'azure-vm-list' AND json.rule = ['properties.networkProfile'].networkInterfaces[*].privateIpAddress contains "1"
</code></pre></td></tr></tbody></table>

## Config Query Examples for GCP

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>DESCRIPTION</td><td>RQL</td></tr><tr><td>View firewall rules that allow internet traffic through the MongoDB port (27017).</td><td><pre><code>config from cloud.resource where api.name='gcloud-compute-firewall-rules-list' AND json.rule='sourceRanges[*] contains 0.0.0.0/0 and allowed[*].ports[*] == 27017'
</code></pre></td></tr><tr><td>List SQL Instances where SSL is not configured.</td><td><pre><code>config from cloud.resource where api.name='gcloud-sql-instances-list' and json.rule = 'settings.ipConfiguration.requireSsl is true'
</code></pre></td></tr><tr><td>List virtual machine (VM) instances where preemptive termination is enabled.</td><td><pre><code>config from cloud.resource where api.name = 'gcloud-compute-instances-list' AND json.rule = 'scheduling.preemptible is true'
</code></pre></td></tr><tr><td>View all storage buckets or objects that are publicly accessible.</td><td><pre><code>config from cloud.resource where cloud.type = 'gcp' AND cloud.service = 'Google Cloud Storage' AND api.name = 'gcloud-storage-buckets-list' AND json.rule = 'acl[*].entity contains allUsers or acl[*].entity contains allAuthenticatedUsers'
</code></pre></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/search-and-investigate/asset-config-queries/asset-config-query-examples.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.