RQL query to find Security Groups in AWS that are not attached to any EC2 instance

• RQL query to find Security Groups in AWS that are not attached to, or associated with, any EC2 (Elastic Compute Cloud) instance

• Prisma Cloud
• AWS

config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-security-groups' as X; config from cloud.resource where api.name = 'aws-ec2-describe-instances' as Y; filter ' not ($.Y.securityGroups[*].groupId contains $.X.groupId) '; show X;

• AWS Security Group "SG_NoEC2" not attached to any EC2 instance created. 

• Run the above RQL query in "Investigate" tab to list all the Security Groups in AWS that are not attached to any EC2 instance. In our example, it listed "SG_NoEC2".

• For additional RQL query examples, refer RQL Example Library