Query: eks_cluster_audit_logging_status

select
  audit_logging_status,
  count(*)
from (
  select
    case when l->'Enabled'= 'false' then
      'disabled'
    else
      'enabled'
    end audit_logging_status
  from
    aws_eks_cluster,
    jsonb_array_elements(logging -> 'ClusterLogging') as l,
    jsonb_array_elements_text(l -> 'Types') as t
  where
    t ='audit'
  ) as e
group by
  audit_logging_status
order by
  audit_logging_status desc;