turbot/aws_compliance

Query: rds_db_cluster_encrypted_with_cmk

Usage

powerpipe query aws_compliance.query.rds_db_cluster_encrypted_with_cmk

SQL

with rds_clusters as (
select
arn,
region,
account_id,
kms_key_id,
storage_encrypted,
title,
tags,
_ctx
from
aws_rds_db_cluster
), kms_keys as (
select
k.arn,
k.key_manager,
k.enabled
from
aws_kms_key as k
)
select
r.arn as resource,
case
when not storage_encrypted then 'alarm'
when storage_encrypted and c.key_manager = 'CUSTOMER' then 'ok'
else 'alarm'
end as status,
case
when not storage_encrypted then title || ' not encrypted.'
when storage_encrypted and c.key_manager = 'CUSTOMER' then title || ' encrypted with CMK.'
else title || ' not encrypted with CMK.'
end as reason
, region, account_id
from
rds_clusters as r
left join kms_keys as c on r.kms_key_id = c.arn;

Controls

The query is being used by the following controls: