turbot/ibm_insights

Query: ibm_is_security_group_unrestricted_outbound_count

Usage

powerpipe query ibm_insights.query.ibm_is_security_group_unrestricted_outbound_count

Steampipe Tables

SQL

with outbound_sg as (
select
id,
count(*)
from
ibm_is_security_group,
jsonb_array_elements(rules) as r
where
(r -> 'remote' ->> 'cidr_block' = '0.0.0.0/0')
and r ->> 'protocol' <> 'icmp'
and (r ->> 'port_min' = '1' and r ->> 'port_max' = '65535')
and
r ->> 'direction' = 'outbound'
group by
id
)
select
'Unrestricted Outbound (Excludes ICMP)' as label,
count(*) as value,
case
when count(*) = 0 then 'ok'
else 'alert'
end as type
from
ibm_is_security_group as sg
where sg.id in (select id from outbound_sg);

Dashboards

The query is used in the dashboards: