Control: Compute Instances should restrict high level basic role

powerpipe control run gcp_compliance.control.compute_instance_wth_no_high_level_basic_role

powerpipe login
powerpipe control run gcp_compliance.control.compute_instance_wth_no_high_level_basic_role --share

with policy_with_high_level_basic_role as (
  select
    distinct entity,
    project
  from
    gcp_iam_policy,
    jsonb_array_elements(bindings) as p,
    jsonb_array_elements_text(p -> 'members') as entity
  where
    p ->> 'role' in ( 'roles/owner' , 'roles/editor' )
), compute_instance_with_high_level_basic_role as (
  select
    distinct self_link
  from
    gcp_compute_instance as i,
    jsonb_array_elements(service_accounts) as e
    left join policy_with_high_level_basic_role as b on b.entity = concat('serviceAccount:' || (e ->> 'email'))
  where
    b.entity is not null
)
select
  i.self_link as resource,
  case
    when i.name like 'gke-%' and labels ? 'goog-gke-node' then 'skip'
    when p.self_link is not null then 'alarm'
    else 'ok'
  end as status,
  case
    when i.name like 'gke-%' and labels ? 'goog-gke-node' then title || ' created by GKE.'
    when p.self_link is not null then i.title || ' allow high level basic role.'
    else i.title || ' restrict high level basic role.'
  end as reason
  
  , location as location, project as project
from
  gcp_compute_instance as i
  left join compute_instance_with_high_level_basic_role as p on p.self_link = i.self_link;