Control: RDS DB cluster snapshots should not be publicly restorable
Description
This control checks whether RDS DB cluster snapshots prohibit access to other accounts. It is recommended that your RDS cluster snapshots should not be public in order to prevent potential leak or misuse of sensitive data or any other kind of security threat. If your RDS cluster snapshot is public; then the data which is backed up in that snapshot is accessible to all other AWS accounts.
Usage
Run the control in your terminal:
powerpipe control run aws_perimeter.control.rds_db_cluster_snapshot_prohibit_public_accessSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_perimeter.control.rds_db_cluster_snapshot_prohibit_public_access --shareSteampipe Tables
SQL
select arn as resource, case when cluster_snapshot -> 'AttributeValues' = '["all"]' then 'alarm' else 'ok' end status, case when cluster_snapshot -> 'AttributeValues' = '["all"]' then title || ' publicly restorable.' else title || ' not publicly restorable.' end reason , region, account_idfrom aws_rds_db_cluster_snapshot, jsonb_array_elements(db_cluster_snapshot_attributes) as cluster_snapshot;