Control: Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs

powerpipe control run azure_compliance.control.monitor_diagnostic_settings_exists_for_subscription

powerpipe login
powerpipe control run azure_compliance.control.monitor_diagnostic_settings_exists_for_subscription --share

with subscription_diagnostic_settings as (
  select
    distinct subscription_id
  from
    azure_diagnostic_setting
)
select
  sub.id as resource,
  case
    when d.subscription_id is null then 'alarm'
    else 'ok'
  end as status,
  case
    when d.subscription_id is null then sub.display_name || ' does not have a diagnostic setting for subscription activity logs.'
    else sub.display_name || ' has a diagnostic setting for subscription activity logs.'
  end as reason
  
  , sub.display_name as subscription
from
  azure_subscription as sub
  left join subscription_diagnostic_settings as d on d.subscription_id = sub.subscription_id;