Compliance-focused queries
Ensure cloud compliance with SQL
Maintaining compliance across cloud environments requires continuous monitoring and enforcement of policies. CloudQuery enables you to run SQL queries on your cloud asset inventory, allowing you to quickly verify compliance with regulatory standards like CIS, ISO 27001, and NIST.
Compliance queries in action
Here are some essential queries to help you maintain compliance and avoid costly violations.
Find untagged resources (AWS, GCP, Azure)
Why it matters: Lack of tagging makes compliance tracking and cost allocation difficult.
SELECT
cloud, account, name, region, resource_type
FROM
cloud_assets
WHERE
tags = '{}' OR tags IS NULL;Identify inconsistent tagging formats (AWS, GCP, Azure)
Why it matters: Tag inconsistency prevents automated cost allocation and policy enforcement.
SELECT
cloud, account, name, region, resource_type
FROM
cloud_assets
WHERE
tags LIKE '%Environment%'
OR tags LIKE '%ENV%'
OR tags LIKE '%Env%'
OR tags LIKE '%env%'
OR tags LIKE '%ENVIRONMENT%';Identify resources not tagged according to a governance policy (AWS, GCP, Azure)
Why it matters: Proper tagging helps track resources for compliance, auditing, and cost allocation.
SELECT
cloud, account, name, region, resource_type, tags
FROM
cloud_assets
WHERE
tags NOT LIKE '%cost_center%'
OR tags NOT LIKE '%owner%'
OR tags NOT LIKE '%environment%';Identify resources running in unauthorized regions (AWS, GCP, Azure)
Why it matters: Regulatory restrictions prevent companies from deploying workloads in unauthorized regions.
SELECT
cloud, account, name, region, resource_type
FROM
cloud_assets
WHERE
region NOT IN ('us-east-1', 'us-west-1', 'eu-west-1');Find AWS RDS instances lacking automated backups (AWS)
Why it matters: Without backups, organizations risk permanent data loss.
SELECT
db_instance_arn, backup_retention_period, region
FROM
aws_rds_instances
WHERE
backup_retention_period = 0;Identify databases without SSL encryption (AWS)
Why it matters: Unsecured database connections expose data to attacks.
SELECT
*
FROM
aws_rds_instances
WHERE
empty(ca_certificate_identifier);List RDS instances not using encryption at rest (AWS)
Why it matters: Unencrypted databases violate compliance and security policies.
SELECT
*
FROM
aws_rds_instances
WHERE
storage_encrypted=false;Find IAM users without MFA enabled (AWS)
Why it matters: Lack of MFA increases the risk of account compromise.
SELECT
u.*
FROM
aws_iam_users AS u
LEFT JOIN
aws_iam_mfa_devices AS m
ON
u.user_name = m.user_name
WHERE
m.user_name IS NULL;Want more?
These are just a few examples of how CloudQuery turns your cloud into an instantly queryable database—giving you unparalleled visibility into compliance risks.
Check out the main query examples page for more ways to audit, secure, and optimize your cloud—all with SQL!