Use these fields when searching your AWS EC2 assets on the Assets list.
Good to Know
- Your results may return Terminated instances. It's recommended you include aws.ec2instanceState in your query to reduce the number of results.
- The syntax is different when writing queries for tag rules than when searching assets in the Assets list. Be sure to follow the syntax tips in the drop-down when writing your query.
Show the EC2 instance with a certain account ID. [string - exact match]
aws.ec2.accountId: 123456789012
aws.ec2.accountId is null // you must remove the colon
after the field name for is null search
Show EC2 instances by the availability zone. Use backticks for exact match. [string - full text search]
aws.ec2.availabilityZone: us-east-1a
Show EC2 instances with a cloud agent (true) or without a cloud agent (false). This field is not supported in Cloud Asset Search tag rules. [boolean]
aws.ec2.hasAgent: true
Show EC2 instances with the hostname you're looking for. Use backticks for exact match. [string - full text search]
aws.ec2.hostname: abc.qualys.com
Show EC2 instances with a certain Image (AMI) ID. Use backticks for exact match. [string - full text search]
aws.ec2.imageId: `ami-2ea83347`
Show EC2 instances with a certain instance ID. Use backticks for exact match. This field is not supported in Cloud Asset Search tag rules. [string - full text search]
aws.ec2.instanceId: i-1234567890abcdef0
Show EC2 instances by instance state (e.g. RUNNING, STOPPED). Select from names in the drop-down menu. [string - selectable field]
aws.ec2.instanceState: RUNNING
Show EC2 instances with the instance type you're interested in. Select from names in the drop-down menu. [string - selectable field]
aws.ec2.instanceType: t2.micro
Show EC2 instances that are Qualys scanners (true) or not Qualys scanners (false). This field is not supported in Cloud Asset Search tag rules. [boolean]
aws.ec2.isQualysScanner: true
Show EC2 instances with a certain kernel ID (AKI). Use backticks for exact match. This field is not supported in Cloud Asset Search tag rules. [string - full text search]
aws.ec2.kernelId: aki-70ab0c10
Show EC2 instances launched within a date range or on specific date. Note - For tag creation only YYYY-MM-DD format is supported. All date formats are supported for search. [date]
aws.ec2.launchDate: [2017-06-15 ... 2017-06-30]
Show the EC2 instance with the private DNS address of interest. Use backticks for exact match. [string - full text search]
aws.ec2.privateDNS: ip-10-90-2-85.ec2.internal
Show EC2 instances with the private IPv4 address you're interested in or within IP range. [string - full text search]
aws.ec2.privateIpAddress: 10.90.0.119
aws.ec2.privateIpAddress: [10.1.78.23 ... 10.100.78.235]
Show the EC2 instance with the public DNS address of interest. Use backticks for exact match. [string - full text search]
aws.ec2.publicDNS: ec2-52-70-141-154.compute-1.amazonaws.com
Show EC2 instances with the public IPv4 address you're interested in or within IP range. [string - full text search]
aws.ec2.publicIpAddress: 52.70.141.154
aws.ec2.publicIpAddress: [52.70.141.154 ... 52.70.141.164]
Show EC2 instances in the region of interest using the region code. Select from codes in the drop-down menu. [string - selectable field]
aws.ec2.region.code: us-east-1
Show EC2 instances in the region of interest using the region name. Select from names in the drop-down menu. [string - selectable field]
aws.ec2.region.name: US East (N. Virginia)
Show EC2 instances that are Spot instances (true) or not Spot instances (false). Note - This field is not supported in Cloud Asset Search tag rules. [boolean]
aws.ec2.spotInstance: true
Show EC2 instances with a certain subnet ID. Use backticks for exact match. [string - full text search]
aws.ec2.subnetId: subnet-bc02c0d4
Show EC2 instances with a certain VPC ID. Use backticks for exact match. [string - full text search]
aws.ec2.vpcId: vpc-1e37cd76
Show EC2 instances with a certain AWS tag key and value. [string - exact match]
aws.tags: (key:abc and value:xyz)
Show EC2 instances with a certain AWS tag key. Use backticks for exact match. [string - full text search]
Show EC2 instances with a certain AWS tag value. Use backticks for exact match. [string - full text search]
aws.tags.value: dailybuild