Control: Elastic Beanstalk environments should have enhanced health reporting enabled

powerpipe control run aws_compliance.control.elastic_beanstalk_environment_logs_to_cloudwatch

powerpipe login
powerpipe control run aws_compliance.control.elastic_beanstalk_environment_logs_to_cloudwatch --share

with beanstalk_environment_logs_enabled as (
  select
    distinct e.arn
  from
    aws_elastic_beanstalk_environment as e,
    jsonb_array_elements(e.configuration_settings) as c,
    jsonb_array_elements(c -> 'OptionSettings') as s
  where
    s ->> 'OptionName' = 'StreamLogs'
    and s ->> 'Value' = 'true'
  group by
    arn
)
select
  e.arn as resource,
  case
    when l.arn is not null then 'ok'
    else 'alarm'
  end as status,
  case
    when l.arn is not null then title || ' send logs to AWS CloudWatch.'
    else title || ' does not send logs to AWS CloudWatch.'
  end as reason
  
  , region, account_id
from
  aws_elastic_beanstalk_environment as e
  left join beanstalk_environment_logs_enabled as l on e.arn = l.arn;