Control: 6 SSM Automation should have CloudWatch logging enabled

Description

This control checks whether Amazon CloudWatch logging is enabled for AWS Systems Manager (SSM) Automation. The control fails if CloudWatch logging isn't enabled for SSM Automation.

SSM Automation is an AWS Systems Manager tool that helps you build automated solutions to deploy, configure, and manage AWS resources at scale using predefined or custom runbooks. To meet operational or security requirements for your organization, you might need to provide a record of the scripts that it runs. You can configure SSM Automation to send the output from aws:executeScript actions in your runbooks to an Amazon CloudWatch Logs log group that you specify. With CloudWatch Logs, you can monitor, store, and access log files from various AWS services.

Remediation

For information about enabling CloudWatch logging for SSM Automation, see Logging Automation action output with CloudWatch Logs in the AWS Systems Manager User Guide.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_ssm_6

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_ssm_6 --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when setting_value = 'CloudWatch' then 'ok'
    else 'alarm'
  end as status,
  case
    when setting_value = 'CloudWatch' then title || ' CloudWatch logging enabled for region ' || region || '(' || account_id || ').'
    else title || ' CloudWatch logging disabled for region ' || region || '(' || account_id || ').'
  end as reason
  , region, account_id
from
  aws_ssm_service_setting
where
  setting_id = '/ssm/automation/customer-script-log-destination';

Control: 6 SSM Automation should have CloudWatch logging enabled

Description

Remediation

Usage

SQL

Tags