turbot/aws_compliance

Query: cloudtrail_trail_enabled

Usage

powerpipe query aws_compliance.query.cloudtrail_trail_enabled

Steampipe Tables

SQL

with trails_enabled as (
select
arn,
is_logging
from
aws_cloudtrail_trail
where
home_region = region
)
select
a.arn as resource,
case
when b.is_logging is null and a.is_logging then 'ok'
when b.is_logging then 'ok'
else 'alarm'
end as status,
case
when b.is_logging is null and a.is_logging then a.title || ' enabled.'
when b.is_logging then a.title || ' enabled.'
else a.title || ' disabled.'
end as reason
, a.region, a.account_id
from
aws_cloudtrail_trail as a
left join trails_enabled b on a.arn = b.arn;

Controls

The query is being used by the following controls: