topic Re: Join RQL query throwing Failed to execute RQL search . Illegal Argument in General Topics

Join RQL query throwing Failed to execute RQL search . Illegal Argument

ABanjerjee — Wed, 04 Jun 2025 11:30:45 GMT

Hello team,

I am trying to execute the below join query in achieve the below output-

1. Only Service accounts that has have elevated roles (e.g., roles/owner, roles/editor)

2. Service accounts that have atleast one user-managed key

config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-projects-get-iam-user' AND json.rule = user contains "iam.gserviceaccount.com" and (roles[*] contains "admin" or roles[*] contains "Admin" or roles[*] contains "roles/editor" or roles[*] contains "roles/owner") as X;config from cloud.resource where api.name = 'gcloud-iam-service-accounts-keys-list' AND json.rule = keyType equals "USER_MANAGED" as Y;config from cloud.resource where api.name = 'gcloud-iam-service-accounts-list' as Z;filter '($.Y.name contains $.Z.email and $.Z.email in $.X.user)';show Z;

However getting the Illegal argument error even though it seems the query syntax is correct as per the green check mark . Please refer to the attached screenshot and suggest on the same please. Appreciate your help on the same.

Regards

Arnab

Re: Join RQL query throwing Failed to execute RQL search . Illegal document

ABanjerjee — Wed, 04 Jun 2025 11:30:20 GMT

AN typo error. The exact error message was "Failed to execute RQL search . Illegal Argument"

Re: Join RQL query throwing Failed to execute RQL search . Illegal Argument

helen628young — Fri, 06 Jun 2025 05:32:44 GMT

Hello,

a mismatch in field types in your filter. Try this revised query:

config from cloud.resource
where api.name = 'gcloud-iam-service-accounts-keys-list'
AND json.rule = keyType equals "USER_MANAGED"
as Y;

config from cloud.resource
where api.name = 'gcloud-iam-service-accounts-list'
as Z;

filter 'Z.email in X.user and Y.name contains Z.name';
show Z;

Best Regard,

Helen