Control: EMR clusters server side encryption (SSE KMS) enabled with KMS

powerpipe control run aws_compliance.control.emr_cluster_encryption_at_rest_with_sse_kms

powerpipe login
powerpipe control run aws_compliance.control.emr_cluster_encryption_at_rest_with_sse_kms --share

select
  cluster_arn as resource,
  case
    when s.name is null then 'alarm'
    when not (encryption_configuration -> 'EnableAtRestEncryption')::bool then 'alarm'
    when (encryption_configuration -> 'AtRestEncryptionConfiguration' -> 'S3EncryptionConfiguration' ->> 'EncryptionMode') = 'SSE-KMS' then 'ok'
    else 'alarm'
  end as status,
  case
    when s.name is null then c.title || ' security configuration disabled.'
    when not (encryption_configuration -> 'EnableAtRestEncryption')::bool then c.title || ' encryption at rest disabled.'
    when (encryption_configuration -> 'AtRestEncryptionConfiguration' -> 'S3EncryptionConfiguration' ->> 'EncryptionMode') = 'SSE-KMS' then c.title || ' encryption at rest enabled with SSE KMS.'
    else c.title || ' encryption at rest not enabled with SSE KMS.'
  end as reason
  
  , c.region, c.account_id
from
  aws_emr_cluster as c
  left join aws_emr_security_configuration as s on c.security_configuration = s.name and s.region = s.region and s.account_id = c.account_id;