Control: ELB application and classic load balancer logging should be enabled

powerpipe control run aws_compliance.control.elb_application_classic_lb_logging_enabled

powerpipe login
powerpipe control run aws_compliance.control.elb_application_classic_lb_logging_enabled --share

(
  select
    arn as resource,
    case
      when load_balancer_attributes @> '[{"Key": "access_logs.s3.enabled", "Value": "true"}]' then 'ok'
      else 'alarm'
    end as status,
    case
      when load_balancer_attributes @> '[{"Key": "access_logs.s3.enabled", "Value": "true"}]' then title || ' logging enabled.'
      else title || ' logging disabled.'
    end as reason
    
    , region, account_id
  from
    aws_ec2_application_load_balancer
)
union
(
  select
    'arn:' || partition || ':elasticloadbalancing:' || region || ':' || account_id || ':loadbalancer/' || title as resource,
    case
      when access_log_enabled = 'true' then 'ok'
      else 'alarm'
    end as status,
    case
      when access_log_enabled = 'true' then title || ' logging enabled.'
      else title || ' logging disabled.'
    end as reason
    
    , region, account_id
  from
    aws_ec2_classic_load_balancer
);