turbot/azure_compliance

Query: log_profile_enabled_for_all_subscription

Usage

powerpipe query azure_compliance.query.log_profile_enabled_for_all_subscription

SQL

with log_profiles as (
select
subscription_id
from
azure_log_profile
group by
subscription_id
)
select
sub.id as resource,
case
when i.subscription_id is null then 'alarm'
else 'ok'
end as status,
case
when i.subscription_id is null then sub.display_name || ' does not collect activity logs.'
else sub.display_name || ' collects activity logs.'
end as reason
, sub.display_name as subscription
from
azure_subscription as sub
left join log_profiles as i on i.subscription_id = sub.subscription_id;

Controls

The query is being used by the following controls: