Control: AppSync GraphQL API field level logs should be enabled

Description

This control checks whether field level logs are enabled for the AppSync GraphQL API.

Usage

Run the control in your terminal:

powerpipe control run terraform_aws_compliance.control.appsync_graphql_api_field_level_logs_enabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_aws_compliance.control.appsync_graphql_api_field_level_logs_enabled --share

SQL

This control uses a named query:

select
  address as resource,
  case
    when (attributes_std -> 'log_config' ->> 'field_log_level') in ('ALL','ERROR') then 'ok'
    else 'alarm'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std -> 'log_config' ->> 'field_log_level') in ('ALL','ERROR') then ' field level logs enabled'
    else ' field level logs disabled'
  end || '.' reason
  
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'aws_appsync_graphql_api';

Control: AppSync GraphQL API field level logs should be enabled

Description

Usage

SQL

Tags