> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/network-queries/network-config-query-examples.md).

# Network Configuration Query Examples

The following examples show you how to use [Network Configuration Query Attributes](/content-collections/search-and-investigate/network-queries/network-config-query-attributes.md) in RQL for investigating network and container exposure issues.

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><strong>AWS Use Cases</strong></td><td><strong>RQL</strong></td></tr><tr><td>Find all AWS EC2 instances that are accessible from any untrusted Internet source on administrative ports via SSH/RDP.</td><td><pre><code>config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and effective.action = 'Allow' and protocol.ports in ( 'tcp/22' , 'tcp/3389' )
</code></pre></td></tr><tr><td>Find all AWS EC2 instances that are accessible from any untrusted Internet source other than HTTP/HTTPS.</td><td><pre><code>config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and protocol.ports in ( 'tcp/0:79', 'tcp/81:442', 'tcp/444:65535' )
</code></pre></td></tr><tr><td>Find all AWS Redshift managed ENI that are accessible from any untrusted Internet source on any port/protocol.</td><td><pre><code>config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Interface' and dest.cloud.type = 'AWS' and dest.network.interface.owner in ( 'amazon-redshift' )
</code></pre></td></tr><tr><td>Find all AWS RDS managed ENI that are accessible from any untrusted Internet source on DB port/protocol 3306.</td><td><pre><code>config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Interface' and dest.cloud.type = 'AWS' and dest.network.interface.owner in ( 'amazon-rds' ) and protocol.ports in ( 'tcp/3306')
</code></pre></td></tr><tr><td>Find all AWS RDS managed ENI that are accessible from any untrusted Internet source on any port/protocol.</td><td><pre><code>config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Interface' and dest.cloud.type = 'AWS' and dest.network.interface.owner in ( 'amazon-rds')
</code></pre></td></tr><tr><td>Find all AWS ELB managed ENI that are accessible from any untrusted Internet source on any port/protocol other than HTTP/HTTPS.</td><td><pre><code>config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Interface' and dest.cloud.type = 'AWS' and dest.network.interface.owner in ( 'amazon-elb' )  and protocol.ports in ( 'tcp/0:79', 'tcp/81:442', 'tcp/444:65535' )
</code></pre></td></tr><tr><td><p>Find all AWS VPCs that have EC2 Instances that are accessible from any untrusted Internet source on any port/protocol other than web traffic (HTTP/HTTPs).</p><p>If you use the alert.on RQL attribute, it is only applicable for policies and alerts and has no effect on investigate queries.</p></td><td><pre><code>config from network where source.network = '0.0.0.0/0' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and protocol.ports in ( 'tcp/0:79', 'tcp/81:442', 'tcp/444:65535' ) and alert.on = 'DestVPC'
</code></pre></td></tr><tr><td>Find all AWS EC2 instances with outbound access to any untrusted Internet destination.</td><td><pre><code>config from network where source.resource.type = 'Instance' and source.cloud.type = 'AWS' and dest.network = UNTRUST_INTERNET
</code></pre></td></tr><tr><td><p>Find if instance A in VPC-1 (staging environment) can communicate with instance A in VPC-2 (production environment).</p><p>For E-W network analysis, specify at least one specific source and destination VPC.</p></td><td><pre><code>config from network where source.resource.type = 'Instance' and source.vpc.id = 'vpc-0657741d2470e9869' and source.cloud.type = 'AWS' and source.tag = 'env=staging' and dest.resource.type = 'Instance' and dest.vpc.id = 'vpc-0a8818db3474831ef' and dest.cloud.type = 'AWS' and dest.tag = 'env=prod'
</code></pre></td></tr><tr><td>Find all AWS EC2 instances that are accessible from any untrusted Internet source where routing exists, however effective security policy is ‘Deny’.</td><td><pre><code>config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and effective.action = 'Deny'
</code></pre></td></tr><tr><td><p>Find if instance A in VPC-1 (staging environment) can communicate with a private S3 bucket using VPC endpoint that contains sensitive information.</p><p>For E-W network analysis, specify at least one specific source and destination VPC.</p></td><td><pre><code>config from network where source.resource.type = 'Instance' and source.vpc.id = 'vpc-0a8818db3474831ef' and source.tag = 'env=staging' and dest.resource.type = 'Service' and dest.service.name = 'com.amazonaws.vpce.us-east-1.vpce-svc-0ff33532fa2a4a999' and dest.vpc.id = 'vpc-0a8818db3474831ee'
</code></pre><p>To find out all supported service.name in your environment, use the following RQL:</p><pre><code>config from cloud.resource where api.name = 'aws-describe-vpc-endpoints' AND json.rule = serviceName exists addcolumn serviceName
</code></pre></td></tr><tr><td>Find all Amazon ELB (load balancer) interfaces that are accessible on the Internet on port TCP/22.</td><td><pre><code>config from network where source.network = INTERNET and dest.resource.type = 'Interface' and dest.network.interface.owner = 'amazon-elb' and protocol.ports = 'tcp/22' and effective.action = 'Allow'
</code></pre></td></tr><tr><td>Find all AWS EC2 Instances with unrestricted access (0.0.0.0/0) from the Internet other than the Web traffic.</td><td><pre><code>config from network where source.network = '0.0.0.0/0' and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and protocol.ports in ( 'tcp/0:79', 'tcp/81:442', 'tcp/444:65535' )
</code></pre></td></tr><tr><td>Find all AWS EC2 Instances with network access from any IP in the range 20.0.0.0/24 other than the Web traffic.</td><td><pre><code>config from network where source.network = '20.0.0.0/24' and address.match.criteria = 'partial_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS' and protocol.ports in ( 'tcp/0:79', 'tcp/81:442', 'tcp/444:65535' )
</code></pre></td></tr></tbody></table>

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><strong>Azure Use Cases</strong></td><td><strong>RQL</strong></td></tr><tr><td>Find Azure PostgreSQL (PaaS) instance reachable from untrust Internet source on TCP port 5432.</td><td><pre><code>config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'PaaS' and dest.cloud.type = 'AZURE' and dest.paas.service.type in ( 'MicrosoftDBforPostgreSQLFlexibleServers', 'MicrosoftDBforPostgreSQLServers' ) and protocol.ports = 'tcp/5432'
</code></pre></td></tr><tr><td>Find Azure VM instance in running state that is Internet reachable with unrestricted access (0.0.0.0/0) other than HTTP/HTTPS port.</td><td><pre><code>config from network where source.network = '0.0.0.0/0' and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'AZURE' and protocol.ports in ( 'tcp/0:79', 'tcp/81:442', 'tcp/444:65535' ) and dest.resource.state = 'Active'
</code></pre></td></tr><tr><td>Find Azure MySQL (PaaS) instance reachable from untrust internet source on TCP port 3306.</td><td><pre><code>config from network where source.network = UNTRUST_INTERNET and dest.resource.type = 'PaaS' and dest.cloud.type = 'AZURE' and dest.paas.service.type in ( 'MicrosoftDBforMySQLFlexibleServers', 'MicrosoftDBforMySQLServers' ) and protocol.ports = 'tcp/3306'
</code></pre></td></tr></tbody></table>

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><strong>Kubernetes Use Cases</strong></td><td><strong>RQL</strong></td></tr><tr><td>Find K8s Services that are Internet Facing on EKS clusters on AWS.</td><td><pre><code>config from network where source.network = 'Untrusted_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'AWS'
</code></pre></td></tr><tr><td>Find K8s Services that are Internet Facing on AKS clusters in Azure.</td><td><pre><code>config from network where source.network = 'Untrusted_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'Azure'
</code></pre></td></tr><tr><td>Find K8s Services that are Internet Facing on GKE clusters in GCP.</td><td><pre><code>config from network where source.network = 'Untrusted_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'GCP'
</code></pre></td></tr><tr><td>Scope down searches on a specific cluster and namespace.</td><td><pre><code>config from network where source.network = 'Untrusted_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'GCP' and dest.k8s.cluster.name = 'yourClusterID'

config from network where source.network = 'Untrusted\_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'GCP' and dest.k8s.cluster.name = 'yourClusterID' and dest.k8s.namespace = 'yourNamespaceName' </code></pre></td></tr><tr><td>Search by using tags.</td><td><pre><code>config from network where source.network = 'Untrusted\_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'GCP' and dest.k8s.cluster.name = 'yourClusterID' and dest.k8s.label = 'app=dev' </code></pre></td></tr><tr><td>Identify K8s Services that are Internet Facing over a non-standard port.</td><td><pre><code>config from network where source.network = 'Untrusted\_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'AWS' and protocol.ports = 'tcp/9090' </code></pre></td></tr><tr><td>Find if a specific container image is associated with deployed pods that are Internet exposed.</td><td><pre><code>config from network where source.network = = 'Untrusted\_Internet' and dest.resource.type = 'K8s Service' and dest.cloud.type = 'GCP' and dest.k8s.container.image = 'nginx:latest' </code></pre></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/search-and-investigate/network-queries/network-config-query-examples.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.