turbot/aws_compliance

Query: elastic_beanstalk_environment_logs_to_cloudwatch

Usage

powerpipe query aws_compliance.query.elastic_beanstalk_environment_logs_to_cloudwatch

SQL

with beanstalk_environment_logs_enabled as (
select
distinct e.arn
from
aws_elastic_beanstalk_environment as e,
jsonb_array_elements(e.configuration_settings) as c,
jsonb_array_elements(c -> 'OptionSettings') as s
where
s ->> 'OptionName' = 'StreamLogs'
and s ->> 'Value' = 'true'
group by
arn
)
select
e.arn as resource,
case
when l.arn is not null then 'ok'
else 'alarm'
end as status,
case
when l.arn is not null then title || ' send logs to AWS CloudWatch.'
else title || ' does not send logs to AWS CloudWatch.'
end as reason
, region, account_id
from
aws_elastic_beanstalk_environment as e
left join beanstalk_environment_logs_enabled as l on e.arn = l.arn;

Controls

The query is being used by the following controls: