Control: App Service Environment should enable internal encryption

powerpipe control run azure_compliance.control.app_service_environment_internal_encryption_enabled

powerpipe login
powerpipe control run azure_compliance.control.app_service_environment_internal_encryption_enabled --share

with app_service_environment as (
  select
    distinct id as id
  from
    azure_app_service_environment,
    jsonb_array_elements(cluster_settings ) as s
  where
    s ->> 'name' = 'InternalEncryption'
    and s ->> 'value' = 'true'
)
select
  a.id as resource,
  case
    when b.id is not null then 'ok'
    else 'alarm'
  end as status,
  case
    when b.id is not null then a.title || ' internal encryption enabled.'
    else a.name || ' internal encryption disabled.'
  end as reason
  
  , a.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_app_service_environment as a
  left join app_service_environment as b on a.id = b.id
  left join azure_subscription as sub on sub.subscription_id = a.subscription_id;