Prisma Cloud: RQL to search empty tags for EC2 instances
131
Created On 01/20/23 16:22 PM - Last Modified 06/12/26 12:17 PM
Symptom
Example of resource configuration where EC2 tag value is empty:
And result is :
{
"tags": [
{
"key": "AwsId",
"value": ""
},
{
"key": "Name",
"value": "test tag with cspm"
}Environment
- Prisma Cloud
- RQL
Cause
- The tags are case sensitive so be sure to match exactly the tag key name.
- This query will avoid any false positives of other EC2 values that have both key and value pair.
Resolution
In the Investigate Page use the query below:
config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = tags[?any( key equals "AwsId" and value isEmpty )] exists
Additional Information
View our RQL Library here for additional quieries.