Control: OpenSearch domains should have audit logging enabled.
Description
This control checks whether OpenSearch service domains have audit logging enabled. The rule is non-compliant if an OpenSearch service domain does not have audit logging enabled.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.opensearch_domain_audit_logging_enabledSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.opensearch_domain_audit_logging_enabled --shareSQL
This control uses a named query:
select arn as resource, case when log_publishing_options -> 'AUDIT_LOGS' ->> 'Enabled' = 'true' then 'ok' else 'ok' end as status, case when log_publishing_options -> 'AUDIT_LOGS' ->> 'Enabled' = 'true' then title || ' audit logging enabled.' else title || ' audit logging disabled.' end as reason , region, account_idfrom aws_opensearch_domain;