Question about RQL 'userIDGroupPairs[*]' from security group

[AmYoon]

Hello. I am asking if you can give some help about creating a RQL for a custom policy.

I was trying to create a RQL about AWS security groups that tries to find if the description in userIdGroupPairs[*] for each inbound or outbound rules('ipPermissions' / 'ipPermissionsEgress') does not include these two strings, "SAC*" or "ACE*".

(After each strings, it each has some unique numbers so we want to find by the common strings of each SAC and ACE)

As you can see from the resource config and if you know how the RQL queries, the each of the Security Group Rules are separated with four fields (ipv4Ranges, ipv6Ranges, prefixListIds, userIdGroupPairs) and the related information are just arranged under each fields.(Check the example screenshot)

I want to check if each of these lists  of descriptions one by one whether they contain SAC or ACE but from my RQL below,

I could only check if either or not 'userIdGroupPairs' contain SAC or ACE from the whole list.

• The RQL example is like below :
  config from cloud.resource api.name = 'aws-ec2-describe-security-groups' AND json.rule = (ipPermissions[*].userIdGroupPairs[*] is not empty and ipPermissions[?all(userIdGroupPairs[*].description does not contain SAC and userIdGroupPairs[*].description does not contain ACE)] exists) or (ipPermissionsEgress[*].userIdGroupPairs[*] is not empty and ipPermissionsEgress[?all(userIdGroupPairs[*].description does not contain SAC and userIdGroupPairs[*].description does not contain ACE)] exists)

Hope you give some tips about this RQL or if there are some other useful operators can be used that I couldn't find.

Thank you.

Prisma Cloud 

[MDavis29]

Hello,

Testing this on an example resource in my lab you should be able to select multiple fields under the ipPermissions array, as well as select AND, and OR for each items under that ray as you build out the RQL query.  I did notice an small syntax error at the beginning of the query.  Fix that and give it another attempt and try using the auto complete from the JSON rule viewer to help as well.
config from cloud.resource where api.name =