> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/permissions-queries/permissions-query-conditions.md).

# Permissions Query Conditions

Get more granular search results in your permissions queries, by applying conditions to the `config from iam where` query in your RQL search. Use conditions to minimize the exposure of a resource based policy by making it available only to an organization or specific account, or use it to minimize the access to a machine (EC2 instances or Lambda functions); for example, if a machine has publicly available permissions, you can add a condition to enable actions only to a specific IP address.

[Permissions Query Attributes](/content-collections/search-and-investigate/permissions-queries/permissions-query-attributes.md) also includes the `grantedby.cloud.condition` attribute that assists with permissions queries where the policy statement may or may not contain conditions. For instance, the example below filters all results with the source IP address:

`config from iam where grantedby.cloud.policy.condition('aws:sourceIP') does not exist`

Several additional operators are also supported to give you more flexibility on how filters are applied. The examples below show how they can be used with the `config from iam where` query to apply conditions.

| Description                                                                                            | RQL                                                                                                                 | Operator       |
| ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------- | -------------- |
| Show results where a specific condition exists.                                                        | `config from iam where grantedby.cloud.policy.condition ('aws:sourceIP') exists`                                    | exists         |
| Show results where a specific condition doesn’t exist.                                                 | `config from iam where grantedby.cloud.policy.condition ('aws:sourceIP') does not exist`                            | does not exist |
| Show results where a specific condition and operator exists.                                           | `config from iam where grantedby.cloud.policy.condition ('aws:sourceIP', 'IpAddress') exists`                       | exists         |
| Show results where a specific condition and operator doesn’t exist.                                    | `config from iam where grantedby.cloud.policy.condition ('aws:sourceIP', 'IpAddress') does not exist`               | does not exist |
| Show results where a specific condition with a specific value exists.                                  | `config from iam where grantedby.cloud.policy.condition ('aws:sourceIP') = '1.1.1.1'`                               | =              |
| Show results where a specific condition with a different value exists.                                 | `config from iam where grantedby.cloud.policy.condition ('aws:sourceIP') != '1.1.1.1'`                              | !=             |
| Show results where a specific condition and operator with a specific value exists.                     | `config from iam where grantedby.cloud.policy.condition ('aws:sourceIP', 'IpAddress') = '1.1.1.1'`                  | =              |
| Show results where a specific condition and operator with a different value exists.                    | `config from iam where grantedby.cloud.policy.condition ('aws:sourceIP', 'IpAddress') != '1.1.1.1'`                 | !=             |
| Show results where a specific condition and operator with one or more different values does not exist. | `config from iam where grantedby.cloud.policy.condition ('aws:sourceIP') NOT IN ('1.1.1.1', '2.2.2.2')`             | NOT IN         |
| Show results where a specific condition and operator with one or more different values exists.         | `config from iam where grantedby.cloud.policy.condition('aws:sourceIP', 'IpAddress') NOT IN ('1.1.1.1', '2.2.2.2')` | NOT IN         |
| Show results where a specific condition with one or more values exists.                                | `config from iam where grantedby.cloud.policy.condition ('aws:sourceIP') IN ('1.1.1.1')`                            | IN             |
| Show results where a specific condition and operator with one or more values exists.                   | `config from iam where grantedby.cloud.policy.condition ('aws:sourceIP', 'IpAddress') IN ('1.1.1.1')`               | IN             |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/search-and-investigate/permissions-queries/permissions-query-conditions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.