Control: SSM documents should have the block public sharing setting enabled
Description
This control checks whether the block public sharing setting is enabled for AWS Systems Manager documents. The control fails if the block public sharing setting is disabled for Systems Manager documents.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.ssm_document_block_public_sharing_setting_enabled
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.ssm_document_block_public_sharing_setting_enabled --share
SQL
This control uses a named query:
select arn as resource, case when setting_value = 'Enable' then 'ok' else 'alarm' end as status, case when setting_value = 'Enable' then title || ' public sharing setting enabled for region ' || region || '(' || account_id || ').' else title || ' public sharing setting disabled for region ' || region || '(' || account_id || ').' end as reason , region, account_idfrom aws_ssm_service_settingwhere setting_id = '/ssm/documents/console/public-sharing-permission';