action_trail_enabledaction_trail_oss_bucket_not_publiccs_kubernetes_cluster_ipvlan_enabledcs_kubernetes_cluster_network_policy_enabledecs_disk_encryption_enabledecs_instance_with_no_legacy_networkecs_security_group_remote_administrationecs_security_group_restrict_ingress_rdp_allecs_security_group_restrict_ingress_ssh_allecs_unattached_disk_encryption_enabledmanual_controloss_bucket_encrypted_with_byokoss_bucket_encrypted_with_servcie_keyoss_bucket_enforces_ssloss_bucket_logging_enabledoss_bucket_public_access_blockedram_account_password_policy_min_length_14ram_account_password_policy_one_lowercase_letterram_account_password_policy_one_numberram_account_password_policy_one_symbolram_account_password_policy_one_uppercase_letterram_account_password_policy_reuse_5ram_password_policy_expire_90ram_password_policy_max_login_attempts_5ram_root_account_mfa_enabledram_root_account_no_access_keysram_root_account_unusedram_user_access_key_rotated_90ram_user_console_access_mfa_enabledram_user_no_policiesram_user_unused_90rds_instance_postgresql_log_connections_parameter_onrds_instance_postgresql_log_disconnections_parameter_onrds_instance_postgresql_log_duration_parameter_onrds_instance_restrict_access_to_internetrds_instance_sql_audit_enabledrds_instance_sql_audit_retention_period_180_daysrds_instance_ssl_enabledrds_instance_tde_enabledsecurity_center_advanced_or_enterprise_edition
Query: oss_bucket_enforces_ssl
Usage
powerpipe query alicloud_compliance.query.oss_bucket_enforces_ssl
Steampipe Tables
SQL
with ssl_ok as ( select distinct name, 'ok' as status from alicloud_oss_bucket, jsonb_array_elements(policy -> 'Statement') as s, jsonb_array_elements_text(s -> 'Principal') as p, jsonb_array_elements_text(s -> 'Resource') as r, jsonb_array_elements_text( s -> 'Condition' -> 'Bool' -> 'acs:SecureTransport' ) as ssl where p = '*' and s ->> 'Effect' = 'Deny' and ssl :: bool = false)select 'acs:oss:::' || b.name as resource, case when ok.status = 'ok' then 'ok' else 'alarm' end status, case when ok.status = 'ok' then b.title || ' bucket policy enforces HTTPS.' else b.title || ' bucket policy does not enforce HTTPS.' end reason , b.account_id as account_id, b.region as regionfrom alicloud_oss_bucket as b left join ssl_ok as ok on ok.name = b.name;
Controls
The query is being used by the following controls: