Control: Amazon OpenSearch domains should be in a VPC private subnet

powerpipe control run aws_perimeter.control.opensearch_domain_in_vpc

powerpipe login
powerpipe control run aws_perimeter.control.opensearch_domain_in_vpc --share

with public_subnets as (
  select
    distinct a -> 'SubnetId' as SubnetId
  from
    aws_vpc_route_table as t,
    jsonb_array_elements(associations) as a,
    jsonb_array_elements(routes) as r
  where
    r ->> 'DestinationCidrBlock' = '0.0.0.0/0'
    and r ->> 'GatewayId' like 'igw-%'
), opensearch_domain_with_public_subnet as (
  select
    arn
  from
    aws_opensearch_domain ,
    jsonb_array_elements(vpc_options -> 'SubnetIds') as s
  where
    s in (select SubnetId from public_subnets)
)
select
  d.arn as resource,
  case
    when d.vpc_options ->> 'VPCId' is null then 'alarm'
    when d.vpc_options ->> 'VPCId' is not null and p.arn is not null then 'alarm'
    else 'ok'
  end status,
  case
    when vpc_options ->> 'VPCId' is null then title || ' not in VPC.'
    when d.vpc_options ->> 'VPCId' is not null and p.arn is not null then title || ' attached to public subnet.'
    else title || ' in VPC ' || (vpc_options ->> 'VPCId') || '.'
  end reason
  
  , d.region, d.account_id
from
  aws_opensearch_domain as d
  left join opensearch_domain_with_public_subnet as p on d.arn = p.arn;