Control: SSM Automation should have CloudWatch logging enabled
Description
This control checks whether Amazon CloudWatch logging is enabled for AWS Systems Manager (SSM) Automation. The control fails if CloudWatch logging isn't enabled for SSM Automation.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.ssm_automation_cloudwatch_logging_enabled
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.ssm_automation_cloudwatch_logging_enabled --share
SQL
This control uses a named query:
select arn as resource, case when setting_value = 'CloudWatch' then 'ok' else 'alarm' end as status, case when setting_value = 'CloudWatch' then title || ' CloudWatch logging enabled for region ' || region || '(' || account_id || ').' else title || ' CloudWatch logging disabled for region ' || region || '(' || account_id || ').' end as reason , region, account_idfrom aws_ssm_service_settingwhere setting_id = '/ssm/automation/customer-script-log-destination';