Who rated this post

Hello team,

I am trying to execute the below join query in achieve the below output-

1. Only Service accounts that has have elevated roles (e.g., roles/owner, roles/editor)

2. Service accounts that have atleast one user-managed key

config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-projects-get-iam-user' AND json.rule = user contains "iam.gserviceaccount.com" and (roles[*] contains "admin" or roles[*] contains "Admin" or roles[*] contains "roles/editor" or roles[*] contains "roles/owner") as X;config from cloud.resource where api.name = 'gcloud-iam-service-accounts-keys-list' AND json.rule = keyType equals "USER_MANAGED" as Y;config from cloud.resource where api.name = 'gcloud-iam-service-accounts-list' as Z;filter '($.Y.name contains $.Z.email and $.Z.email in $.X.user)';show Z;

However getting the Illegal argument error even though it seems the query syntax is correct as per the green check mark . Please refer to the attached screenshot and suggest on the same please. Appreciate your help on the same.

Regards

Arnab