RQL Query Works in Investigate > Search but Fails in Policy Definition (Terraform v1.5.7 Example Included)

[A.Putrevu]

Hi Community,

I’m facing an issue where RQL queries that work perfectly in the Investigate > Search console do not work when used in policy definitions via Terraform (v1.5.7). For example:

Query that works in Investigate > Search:

config from cloud.resource where api.name = 'aws-ec2-describe-internet-gateways' as X; config from cloud.resource where api.name = 'aws-ec2-describe-vpcs' as Y; filter '$.X.attachments[*].vpcId equals $.Y.vpcId'; show Y;

This returns the expected results in the search console, showing VPCs with attached IGWs.

Problem:
When I use this query in a policy definition, I get a 400 error:
invalid_search_query severity:error subject:invalid_rule

Context:

• I have 100+ similar queries that work in search but fail in policy definitions.
• I understand that policy definitions may have stricter RQL requirements, but I need to enforce these checks as policies.

Questions:

1. Why do multi-resource/join queries work in search but not in policies?
2. Is there a workaround or best practice to convert such queries for policy use?
3. How can I enforce policies for conditions that require joining multiple resources?
4. Is there any documentation or guidance for writing policy-compatible RQL queries?

Any help or examples would be greatly appreciated!!

[JCalloway4]

Hello A. Putttrevu!
My customer uses multiple joins in Terraform "pushed" policies frequently, so I'm not sure that is your issue. 

I read where you ran the query manually and it works.  However, have you tried creating the policy in the GUI just to see?

Also, can you give us some more specifics as to how you're using Terraofrm to deploy policies, e.g. what provider are you using, and what version, and are you using any API endpoints, and if so, which ones?

Thanks 🙂