turbot/aws_compliance

Query: cloudtrail_trail_enabled_account

Usage

powerpipe query aws_compliance.query.cloudtrail_trail_enabled_account

SQL

with trails_enabled_account as (
select
account_id,
count(*) as num
from
aws_cloudtrail_trail
where
home_region = region
and is_logging
group by
account_id
)
select
a.arn as resource,
case
when b.num > 0 then 'ok'
else 'alarm'
end as status,
case
when b.num > 0 then a.title || ' has ' || b.num || ' trails enabled.'
else a.title || ' has no trail enabled.'
end as reason
, a.region, a.account_id
from
aws_account as a
left join trails_enabled_account b on a.account_id = b.account_id;

Controls

The query is being used by the following controls: