How to get resources with a value inside any keys

Hi! I’m trying to write a policy that finds aws vpn connection tunnels that have no tunnels up. When searching for tunnels without any filters the resources.json look like this:

[
  {
    (lots of stuff here)
    "VgwTelemetry": [
      {
        "AcceptedRouteCount": 3,
        "LastStatusChange": "2020-06-24T04:33:19+00:00",
        "OutsideIpAddress": "1.1.1.1",
        "Status": "UP",
        "StatusMessage": ""
      },
      {
        "AcceptedRouteCount": 3,
        "LastStatusChange": "2020-06-07T19:41:11+00:00",
        "OutsideIpAddress": "1.1.1.2",
        "Status": "DOWN",
        "StatusMessage": ""
      }
    ]
  }
]

Basically what I’m trying to do is filter resources that have no "Status": "UP" keys in them. I tried to do something like this:

- name: aws-vpnconnection-alltunnelsaredown-find
    description: |
      Find connections with no tunnels up
    resource: aws.vpn-connection
    filters:
      - not:
        - VgwTelemetry.[*].Status: UP

But this doesn’t seem to work. What is the proper way to do this?

[kapilt]

so because the value comes back as an array from expression, comparing to a singleton policy value won’t match for equality, you’ll need to use the long form of the value filter.

- name: aws-vpnconnection-tunnelisdown-find
    resource: aws.vpn-connection
    description: |
      Find connections with no tunnels up
    filters:
      - type: value
         key: VgwTelemetry[].Status
         op: contains
         value: DOWN

[kapilt]

its useful to try out jmespath-terminal package for exploring this locally with the cli

VgwTelemetry[].Status: DOWN