RQL - display all VPC's, except DEFAULT, that do not have FlowLogs

[MPestell]

Hello all.

New to RQL.  I have the below RQL that identifies DEFAULT VPC's;

config where cloud.account IN ( 'AWS_EBU_Networked_Prod_DR_DA_01' ) and api.name = 'aws-ec2-describe-vpcs' AND json.rule = isDefault is true

I have the below RQL that shows all VPC's that do not have FlowLogs enabled;

config where cloud.account IN ( 'AWS_EBU_Networked_Prod_DR_DA_01' ) and api.name = 'aws-ec2-describe-vpcs' as X; config where api.name = 'aws-ec2-describe-flow-logs' as Y; filter ' not ($.Y.resourceId equals $.X.vpcId)'; show X;

Is it possible to combine the 2 so I only show VPC's that do not have FlowLogs enabled AND are not the DEFAULT VPC please??  You help most welcome.

[SRohatyn]

Hi @MPestell 

Quickly adding a filter to your second example, can you confirm if this is doing what you need:

config where api.name = 'aws-ec2-describe-vpcs' as X; config where api.name = 'aws-ec2-describe-flow-logs' as Y; filter '($.X.isDefault is false) and not($.Y.resourceId equals $.X.vpcId)'; show X;

[MPestell]

Hi and thank you for your reply.

That hasn't exactly worked.  What this is bringing back now is indeed those with isDefault=false, however it appears to be ignoring the RQL that looks for VPC's with 'no' Flowlog.  Instead it is bringing back just all VPC's that has a isDefault=false.

[MPestell · Accepted solution]

Actually I think I have it.  I don't understand 'why' this works but it does.  Be great if someone could explain the logic for future reference;

config where api.name = 'aws-ec2-describe-vpcs' as X; config where api.name = 'aws-ec2-describe-flow-logs' as Y; filter 'not($.Y.resourceId equals $.X.vpcId) or ($.X.isDefault == true)'; show X;

# appears that is applies the 'not' to both conditions.  Also it does not like 'and' but does work with 'or'