turbot/gcp_compliance

Query: storage_bucket_log_retention_policy_lock_enabled

Usage

powerpipe query gcp_compliance.query.storage_bucket_log_retention_policy_lock_enabled

SQL

with log_sink_buckets as (
select
split_part(destination, '/', 2) as bucket_name,
project
from
gcp_logging_sink
where
destination like 'storage.googleapis.com/%'
)
select
b.self_link resource,
case
when s.bucket_name is null then 'skip'
when b.retention_policy is null then 'alarm'
when b.retention_policy ->> 'is_locked' = 'true' then 'ok'
else 'ok'
end as status,
case
when s.bucket_name is null then title || ' does not export logs.'
when b.retention_policy is null then title || ' retention policy not defined.'
when b.retention_policy ->> 'is_locked' = 'false'
then title || ' has retention policy with bucket lock.'
else title || ' retention policy with no bucket lock.'
end as reason
, b.location as location, b.project as project
from
gcp_storage_bucket as b
left join log_sink_buckets as s on s.bucket_name = b.name and b.project = s.project;

Controls

The query is being used by the following controls: