Query: cloudtrail_trail_logging_status

with trail_logging_status as (
  select
    name as trail_name,
    case
      when not is_logging then 'disabled'
      else 'enabled'
    end as logging_status
  from
    aws_cloudtrail_trail
  where
    home_region = region
)
select
  logging_status,
  count(*)
from
  trail_logging_status
group by logging_status;