Permissions Query Conditions

Get more granular search results in your permissions queries, by applying conditions to the config from iam where query in your RQL search. Use conditions to minimize the exposure of a resource based policy by making it available only to an organization or specific account, or use it to minimize the access to a machine (EC2 instances or Lambda functions); for example, if a machine has publicly available permissions, you can add a condition to enable actions only to a specific IP address.

Permissions Query Attributes also includes the grantedby.cloud.condition attribute that assists with permissions queries where the policy statement may or may not contain conditions. For instance, the example below filters all results with the source IP address:

config from iam where grantedby.cloud.policy.condition('aws:sourceIP') does not exist

Several additional operators are also supported to give you more flexibility on how filters are applied. The examples below show how they can be used with the config from iam where query to apply conditions.

Description	RQL	Operator
Show results where a specific condition exists.	config from iam where grantedby.cloud.policy.condition ('aws:sourceIP') exists	exists
Show results where a specific condition doesn’t exist.	config from iam where grantedby.cloud.policy.condition ('aws:sourceIP') does not exist	does not exist
Show results where a specific condition and operator exists.	config from iam where grantedby.cloud.policy.condition ('aws:sourceIP', 'IpAddress') exists	exists
Show results where a specific condition and operator doesn’t exist.	config from iam where grantedby.cloud.policy.condition ('aws:sourceIP', 'IpAddress') does not exist	does not exist
Show results where a specific condition with a specific value exists.	config from iam where grantedby.cloud.policy.condition ('aws:sourceIP') = '1.1.1.1'	=
Show results where a specific condition with a different value exists.	config from iam where grantedby.cloud.policy.condition ('aws:sourceIP') != '1.1.1.1'	!=
Show results where a specific condition and operator with a specific value exists.	config from iam where grantedby.cloud.policy.condition ('aws:sourceIP', 'IpAddress') = '1.1.1.1'	=
Show results where a specific condition and operator with a different value exists.	config from iam where grantedby.cloud.policy.condition ('aws:sourceIP', 'IpAddress') != '1.1.1.1'	!=
Show results where a specific condition and operator with one or more different values does not exist.	config from iam where grantedby.cloud.policy.condition ('aws:sourceIP') NOT IN ('1.1.1.1', '2.2.2.2')	NOT IN
Show results where a specific condition and operator with one or more different values exists.	config from iam where grantedby.cloud.policy.condition('aws:sourceIP', 'IpAddress') NOT IN ('1.1.1.1', '2.2.2.2')	NOT IN
Show results where a specific condition with one or more values exists.	config from iam where grantedby.cloud.policy.condition ('aws:sourceIP') IN ('1.1.1.1')	IN
Show results where a specific condition and operator with one or more values exists.	config from iam where grantedby.cloud.policy.condition ('aws:sourceIP', 'IpAddress') IN ('1.1.1.1')	IN