https://live.paloaltonetworks.com/t5/prisma-cloud-discussions/rql-to-find-out-custom-aws-ec2-instance-keypair/m-p/291878#M84 <P>We have a custom AWS security checklist that we are manually running against each AWS account, and in that, we have a check to see if key pairs of all EC2 instances are created per function and per region when creating an instance with AMI. I'm looking for an RQL to find out custom Keypair.</P><P>&nbsp;</P><P>I started with the following RQL but doesnt seem to get anywhere.&nbsp;</P><P>&nbsp;</P><P>config where api.name = 'aws-ec2-describe-key-pairs' AND json.rule = "KeyName" limit search records to 100</P> Wed, 02 Sep 2020 18:11:51 GMT Junaid-Khan 2020-09-02T18:11:51Z https://live.paloaltonetworks.com/t5/prisma-cloud-discussions/rql-to-find-out-custom-aws-ec2-instance-keypair/m-p/291878#M84 <P>We have a custom AWS security checklist that we are manually running against each AWS account, and in that, we have a check to see if key pairs of all EC2 instances are created per function and per region when creating an instance with AMI. I'm looking for an RQL to find out custom Keypair.</P><P>&nbsp;</P><P>I started with the following RQL but doesnt seem to get anywhere.&nbsp;</P><P>&nbsp;</P><P>config where api.name = 'aws-ec2-describe-key-pairs' AND json.rule = "KeyName" limit search records to 100</P> Wed, 02 Sep 2020 18:11:51 GMT https://live.paloaltonetworks.com/t5/prisma-cloud-discussions/rql-to-find-out-custom-aws-ec2-instance-keypair/m-p/291878#M84 Junaid-Khan 2020-09-02T18:11:51Z https://live.paloaltonetworks.com/t5/prisma-cloud-discussions/rql-to-find-out-custom-aws-ec2-instance-keypair/m-p/295571#M85 <P>This RQL might do the trick: config where api.name = 'aws-ec2-describe-instances' AND json.rule = keyName contains "KEYNAME"</P> Thu, 31 Oct 2019 21:17:18 GMT https://live.paloaltonetworks.com/t5/prisma-cloud-discussions/rql-to-find-out-custom-aws-ec2-instance-keypair/m-p/295571#M85 ebeuerlein 2019-10-31T21:17:18Z