action_trail_enabledaction_trail_oss_bucket_not_publiccs_kubernetes_cluster_cloud_monitor_enabledcs_kubernetes_cluster_ipvlan_enabledcs_kubernetes_cluster_log_service_enabledcs_kubernetes_cluster_network_policy_enabledcs_kubernetes_cluster_private_cluster_enabledecs_disk_encryption_enabledecs_instance_latest_os_patches_appliedecs_instance_with_no_legacy_networkecs_security_center_agent_installedecs_security_group_remote_administrationecs_security_group_restrict_ingress_rdp_allecs_security_group_restrict_ingress_ssh_allecs_unattached_disk_encryption_enabledlog_store_retention_period_365_daysmanual_controloss_bucket_encrypted_with_byokoss_bucket_encrypted_with_service_keyoss_bucket_enforces_ssloss_bucket_logging_enabledoss_bucket_public_access_blockedram_account_password_policy_min_length_14ram_account_password_policy_one_lowercase_letterram_account_password_policy_one_numberram_account_password_policy_one_symbolram_account_password_policy_one_uppercase_letterram_account_password_policy_reuse_5ram_password_policy_expire_365_or_greaterram_password_policy_expire_90ram_password_policy_max_login_attempts_5ram_policy_no_full_wildcard_privilegesram_root_account_mfa_enabledram_root_account_no_access_keysram_root_account_unusedram_user_access_key_rotated_90ram_user_console_access_mfa_enabledram_user_no_policiesram_user_unused_90rds_instance_postgresql_log_connections_parameter_onrds_instance_postgresql_log_disconnections_parameter_onrds_instance_postgresql_log_duration_parameter_onrds_instance_restrict_access_to_internetrds_instance_sql_audit_enabledrds_instance_sql_audit_retention_period_180_daysrds_instance_ssl_enabledrds_instance_tde_enabledrds_instance_tde_encrypted_with_byoksecurity_center_advanced_or_enterprise_editionsecurity_center_all_assets_installed_with_agentsls_alert_cloud_firewall_changessls_alert_console_authentication_failuressls_alert_console_signin_without_mfasls_alert_kms_key_disable_deletionsls_alert_oss_bucket_policy_changessls_alert_oss_permission_changessls_alert_ram_role_changessls_alert_rds_configuration_changessls_alert_root_account_usagesls_alert_security_group_changessls_alert_unauthorized_api_callssls_alert_vpc_changessls_alert_vpc_route_changesvpc_and_vswitch_flow_log_integrated_with_log_servicevpc_flow_logs_enabled
Query: cs_kubernetes_cluster_cloud_monitor_enabled
Usage
powerpipe query alicloud_compliance.query.cs_kubernetes_cluster_cloud_monitor_enabledSQL
with cluster_nodes as ( select c.arn, c.cluster_id, c.title as cluster_name, n.instance_id, c.tags, c.region, c.account_id, c._ctx from alicloud_cs_kubernetes_cluster as c join alicloud_cs_kubernetes_cluster_node as n on c.cluster_id = n.cluster_id),nodes_with_monitor as ( select cn.arn, cn.cluster_id, cn.cluster_name, cn.account_id, cn._ctx, cn.tags, cn.region, count(*) as total_nodes, count(m.instance_id) as monitored_nodes from cluster_nodes cn left join alicloud_cms_monitor_host m on cn.instance_id = m.instance_id group by cn.cluster_id, cn.cluster_name, cn.arn, cn.tags, cn._ctx, cn.account_id, cn.region) select arn as resource, case when total_nodes = 0 then 'skip' when monitored_nodes = 0 then 'alarm' when monitored_nodes < total_nodes then 'alarm' else 'ok' end as status, case when total_nodes = 0 then cluster_name || ' has no nodes.' when monitored_nodes = 0 then cluster_name || ' cloud monitor not enabled on any node.' when monitored_nodes < total_nodes then cluster_name || ' cloud monitor enabled on ' || monitored_nodes || ' out of ' || total_nodes || '.' else cluster_name || ' cloud monitor enabled on all nodes.' end as reason , account_id as account_id, region as regionfrom nodes_with_monitor cn;
Controls
The query is being used by the following controls: