[RQL] How to construct a query to investigate on all AWS Security Groups that has outbound to 0.0.0.0

[rogerhuang]

Reference: https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html

RQL that is not working: config from cloud.resource where cloud.type = 'aws' AND api.name = 'describe-security-groups' AND json.rule = "IpPermissionsEgress[IpRanges[?any (CidrIp equals 0.0.0.0/0)]]" 

Does not seems to be right. Need RQL expert here! Thanks

[rogerhuang]

Somehow figure out something like this and so far no error.

config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' and json.rule = (($.ipPermissions[?(@.ipProtocol==-1)].ipRanges[*] contains 0.0.0.0/0 or $.ipPermissions[?(@.ipProtocol==-1)].ipv6Ranges[*].cidrIpv6 contains ::/0))

[ACurran2]

That works.  Or a more simplified version of the query to only look for ipv4 outbound to 0.0.0.0/0 could be:

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-security-groups' AND json.rule = '((ipPermissionsEgress[*] equals 0.0.0.0/0))'