Can I list all the Public IPs that are configured on Active Instances running in GCP, AWS and Azure Public Cloud Environment using Prisma Cloud RQL query?
1208
Created On 07/30/22 15:58 PM - Last Modified 05/12/25 15:10 PM
Question
- Can I list all the Public IPs that are configured on Active Instances running in GCP, AWS and Azure Public Cloud Environment using Prisma Cloud RQL query?
Environment
- Prisma Cloud
- Public Cloud Environments eg. AWS, GCP
Answer
- To list all the Public IPs that are configured on Active Instances running in GCP, AWS and Azure Public Cloud Environment, 3 separate RQL queries will be needed, as RQL queries from different Cloud Providers cannot be joined together.
- Examples for Cloud Providers are provided below:
I. AWS - There is no direct Public IP endpoint and the data returned would just be a list of ENIs which have a Public IP attached.
Example
config from cloud.resource where api.name = 'aws-ec2-describe-network-interfaces' AND json.rule = association.publicIp exists
II. GCP - Data on Public IPs can be gathered using the API 'gcloud-compute-addresses'.
Example
config from cloud.resource where api.name = 'gcloud-compute-addresses'
III. Azure - API 'azure-network-public-ip-address' is ingested, which provides metadata including any Public IP assigned in Azure and what it is attached to.
Example
config from cloud.resource where api.name = 'azure-network-public-ip-address'
Additional Information
- Fore more RQL examples, refer: RQL Example Library