Control: Amazon DocumentDB manual cluster snapshots should not be public
Description
This control checks whether an Amazon DocumentDB manual cluster snapshot is public. The control fails if the manual cluster snapshot is public.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.docdb_cluster_snapshot_restrict_public_accessSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.docdb_cluster_snapshot_restrict_public_access --shareSQL
This control uses a named query:
select arn as resource, case when (cluster_snapshot ->> 'AttributeName' = 'restore') and cluster_snapshot -> 'AttributeValues' = '["all"]' then 'alarm' else 'ok' end status, case when (cluster_snapshot ->> 'AttributeName' = 'restore') and cluster_snapshot -> 'AttributeValues' = '["all"]' then title || ' does not restrict public access.' else title || ' restrict public access.' end reason , region, account_idfrom aws_docdb_cluster_snapshot, jsonb_array_elements(db_cluster_snapshot_attributes) as cluster_snapshot;