turbot/aws_compliance

Query: redshift_cluster_encrypted_with_cmk

Usage

powerpipe query aws_compliance.query.redshift_cluster_encrypted_with_cmk

SQL

with redshift_clusters as (
select
arn,
region,
account_id,
kms_key_id,
encrypted,
title,
tags,
_ctx
from
aws_redshift_cluster
), kms_keys as (
select
k.arn,
k.key_manager
from
aws_kms_key as k
)
select
r.arn as resource,
case
when not encrypted then 'alarm'
when encrypted and c.key_manager = 'CUSTOMER' then 'ok'
else 'alarm'
end as status,
case
when not encrypted then title || ' not encrypted.'
when encrypted and c.key_manager = 'CUSTOMER' then title || ' encrypted with CMK.'
else title || ' not encrypted with CMK.'
end as reason
, region, account_id
from
redshift_clusters as r
left join kms_keys as c on r.kms_key_id = c.arn;

Controls

The query is being used by the following controls: