Prisma RQL to get unused AWS IAM roles.

MBhamare — Thu, 14 Aug 2025 18:15:46 GMT

Hi team/friends,

Need your help on-

Re: Prisma RQL to get unused AWS IAM roles.

LMegrelis — Thu, 14 Aug 2025 23:33:09 GMT

Hello

We offer many out of the box policies for unused AWS IAM roles.

ex. A more specific policy is "AWS Users and Machine Identities with IAM Data Write permissions are unused for 90 days"

config from iam where source.cloud.type = 'AWS' and action.access.level = 'Data Write' and action.lastaccess.days > 90

A more general RQL is:

config from iam where source.idp.service = 'AWS Identity Center' AND action.lastaccess.days > 30

If you tell me exactly what you are looking for I can tailor the RQL further.