Control: Glue data catalog metadata encryption should be enabled

powerpipe control run aws_compliance.control.glue_data_catalog_encryption_settings_metadata_encryption_enabled

powerpipe login
powerpipe control run aws_compliance.control.glue_data_catalog_encryption_settings_metadata_encryption_enabled --share

select
  'arn:' || partition || '::' || region || ':' || account_id as resource,
  case
    when encryption_at_rest is not null and encryption_at_rest ->> 'CatalogEncryptionMode' != 'DISABLED' then 'ok'
    else 'alarm'
  end as status,
  case
    when encryption_at_rest is not null and encryption_at_rest ->> 'CatalogEncryptionMode' != 'DISABLED' then 'Glue data catalog metadata encryption is enabled in ' || region || '.'
    else 'Glue data catalog metadata encryption is disabled in ' || region || '.'
  end as reason
  , region, account_id
from
  aws_glue_data_catalog_encryption_settings;