Control: S3 bucket default encryption should be enabled with KMS

powerpipe control run aws_compliance.control.s3_bucket_default_encryption_enabled_kms

powerpipe login
powerpipe control run aws_compliance.control.s3_bucket_default_encryption_enabled_kms --share

with data as (
  select
    distinct name
  from
    aws_s3_bucket,
    jsonb_array_elements(server_side_encryption_configuration -> 'Rules') as rules
  where
    rules -> 'ApplyServerSideEncryptionByDefault' ->> 'KMSMasterKeyID' is not null
  )
select
  b.arn as resource,
  case
    when d.name is not null then 'ok'
    else 'alarm'
  end status,
  case
    when d.name is not null then b.name || ' default encryption with KMS enabled.'
    else b.name || ' default encryption with KMS disabled.'
  end reason
  
  , b.region, b.account_id
from
  aws_s3_bucket as b
  left join data as d on b.name = d.name;