Control: OpenSearch domains logs to AWS CloudWatch Logs

Description

This control checks whether AWS OpenSearch Service domains are configured to send logs to CloudWatch logs. The rule is non-compliant if logging is not configured.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.opensearch_domain_logs_to_cloudwatch

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.opensearch_domain_logs_to_cloudwatch --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when log_publishing_options is null then 'alarm'
    when
      ( log_publishing_options -> 'AUDIT_LOGS' is null
        or log_publishing_options -> 'AUDIT_LOGS' -> 'Enabled' = 'false'
        or (log_publishing_options -> 'AUDIT_LOGS' -> 'Enabled' = 'true' and log_publishing_options -> 'AUDIT_LOGS' -> 'CloudWatchLogsLogGroupArn' is not null)
      )
      and
      ( log_publishing_options -> 'INDEX_SLOW_LOGS' is null
        or log_publishing_options -> 'INDEX_SLOW_LOGS' -> 'Enabled' = 'false'
        or (log_publishing_options -> 'INDEX_SLOW_LOGS' -> 'Enabled' = 'true' and log_publishing_options -> 'INDEX_SLOW_LOGS' -> 'CloudWatchLogsLogGroupArn' is not null)
      )
      and
      ( log_publishing_options -> 'SEARCH_SLOW_LOGS' is null
        or log_publishing_options -> 'SEARCH_SLOW_LOGS' -> 'Enabled' = 'false'
        or (log_publishing_options -> 'SEARCH_SLOW_LOGS' -> 'Enabled' = 'true' and log_publishing_options -> 'SEARCH_SLOW_LOGS' -> 'CloudWatchLogsLogGroupArn' is not null)
      )
      and
      ( log_publishing_options -> 'ES_APPLICATION_LOGS' is null
        or log_publishing_options -> 'ES_APPLICATION_LOGS' -> 'Enabled' = 'false'
        or (log_publishing_options -> 'ES_APPLICATION_LOGS' -> 'Enabled' = 'true' and log_publishing_options -> 'ES_APPLICATION_LOGS' -> 'CloudWatchLogsLogGroupArn' is not null)
      )
      then 'ok'
    else 'alarm'
  end as status,
  case
    when log_publishing_options is null then title || ' logging not enabled.'
    when
      ( log_publishing_options -> 'AUDIT_LOGS' is null
        or log_publishing_options -> 'AUDIT_LOGS' -> 'Enabled' = 'false'
        or (log_publishing_options -> 'AUDIT_LOGS' -> 'Enabled' = 'true' and log_publishing_options -> 'AUDIT_LOGS' -> 'CloudWatchLogsLogGroupArn' is not null)
      )
      and
      ( log_publishing_options -> 'INDEX_SLOW_LOGS' is null
        or log_publishing_options -> 'INDEX_SLOW_LOGS' -> 'Enabled' = 'false'
        or (log_publishing_options -> 'INDEX_SLOW_LOGS' -> 'Enabled' = 'true' and log_publishing_options -> 'INDEX_SLOW_LOGS' -> 'CloudWatchLogsLogGroupArn' is not null)
      )
      and
      ( log_publishing_options -> 'SEARCH_SLOW_LOGS' is null
        or log_publishing_options -> 'SEARCH_SLOW_LOGS' -> 'Enabled' = 'false'
        or (log_publishing_options -> 'SEARCH_SLOW_LOGS' -> 'Enabled' = 'true' and log_publishing_options -> 'SEARCH_SLOW_LOGS' -> 'CloudWatchLogsLogGroupArn' is not null)
      )
      and
      ( log_publishing_options -> 'ES_APPLICATION_LOGS' is null
        or log_publishing_options -> 'ES_APPLICATION_LOGS' -> 'Enabled' = 'false'
        or (log_publishing_options -> 'ES_APPLICATION_LOGS' -> 'Enabled' = 'true' and log_publishing_options -> 'ES_APPLICATION_LOGS' -> 'CloudWatchLogsLogGroupArn' is not null)
      ) then title || ' send logs to AWS CloudWatch.'
    else title || ' does not send logs to AWS CloudWatch.'
  end as reason
  
  , region, account_id
from
  aws_opensearch_domain;

Control: OpenSearch domains logs to AWS CloudWatch Logs

Description

Usage

SQL

Tags