Query: cloudtrail_trail_encryption_status

with trail_encryption_status as (
  select
    name as trail_name,
    case
      when kms_key_id is null then 'disabled'
      else 'enabled'
    end as encryption_status
  from
    aws_cloudtrail_trail
  where
    home_region = region
)
select
  encryption_status,
  count(*)
from
  trail_encryption_status
group by encryption_status;