turbot/steampipe-mod-aws-compliance

Control: SSM Automation should have CloudWatch logging enabled

Description

This control checks whether Amazon CloudWatch logging is enabled for AWS Systems Manager (SSM) Automation. The control fails if CloudWatch logging isn't enabled for SSM Automation.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.ssm_automation_cloudwatch_logging_enabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.ssm_automation_cloudwatch_logging_enabled --share

SQL

This control uses a named query:

select
arn as resource,
case
when setting_value = 'CloudWatch' then 'ok'
else 'alarm'
end as status,
case
when setting_value = 'CloudWatch' then title || ' CloudWatch logging enabled for region ' || region || '(' || account_id || ').'
else title || ' CloudWatch logging disabled for region ' || region || '(' || account_id || ').'
end as reason
, region, account_id
from
aws_ssm_service_setting
where
setting_id = '/ssm/automation/customer-script-log-destination';

Tags