- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
11-15-2023 01:06 PM
Can _DateTime function be used to check the date of a tag on a resource in AWS? My current query syntax is accepted by prisma however the _DateTime functions are not actually checking the tag (type string because all tags are strings in AWS) so it is returning undesired output.
Current query (should return all volumes with a (tag.key=Retain).value greater than 365 days old:
config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-volumes' AND AND json.rule = _DateTime.ageInDays(tags[?(@.key=='Retain')].value) > 365 addcolumn tags[?(@.key=='Retain')].value
Are there any examples of checking a tag using the _DateTime function or any other ways to work with a date in prisma to check the value of a tag's date? Or any useful links/resources to look into this further are appreciated! Prisma Cloud AWS
11-16-2023 12:41 PM
It seems that the way the documentation is written that while it is possible to use the _DateTime function to get the various time and age related properties from a resources, it doesen't seem to be possible to use it to get the time and date of attributes of the resources. If you look at the examples, you can use the TimeDate function against resources an EC2 instance or a key, but not from an attribute of the recourse, like a tag.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!